Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
03/12/2023, 04:15
Behavioral task
behavioral1
Sample
64944a1f7d846006e04b6101d40a28b4.exe
Resource
win7-20231020-en
General
-
Target
64944a1f7d846006e04b6101d40a28b4.exe
-
Size
1.2MB
-
MD5
64944a1f7d846006e04b6101d40a28b4
-
SHA1
139989bce70344cee6a009cbe197e43c263aa6a5
-
SHA256
311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa
-
SHA512
da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba
-
SSDEEP
24576:yV4G6JWrIWNuFYRF4Bs2kpvjpqzeRVXJIcXStT:y4WrIWMietCvjtRVJCJ
Malware Config
Signatures
-
Detect PureLogs payload 7 IoCs
resource yara_rule behavioral1/memory/2540-0-0x00000000010F0000-0x0000000001228000-memory.dmp family_purelogs behavioral1/files/0x002f0000000149b3-2208.dat family_purelogs behavioral1/files/0x002f0000000149b3-2210.dat family_purelogs behavioral1/files/0x002f0000000149b3-2211.dat family_purelogs behavioral1/memory/2376-2213-0x0000000000BC0000-0x0000000000CF8000-memory.dmp family_purelogs behavioral1/files/0x002f0000000149b3-2216.dat family_purelogs behavioral1/files/0x002f0000000149b3-2226.dat family_purelogs -
Detect ZGRat V1 29 IoCs
resource yara_rule behavioral1/memory/2848-18-0x000000001B110000-0x000000001B1F4000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-21-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-22-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-24-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-26-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-28-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-30-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-32-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-34-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-36-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-38-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-40-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-42-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-44-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-46-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-48-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-50-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-52-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-54-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-56-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-58-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-60-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-62-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-64-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-66-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-68-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-70-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-72-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 behavioral1/memory/2848-74-0x000000001B110000-0x000000001B1F0000-memory.dmp family_zgrat_v1 -
Executes dropped EXE 2 IoCs
pid Process 2376 Default.exe 2648 Default.exe -
Loads dropped DLL 2 IoCs
pid Process 736 taskeng.exe 2376 Default.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2540 set thread context of 2848 2540 64944a1f7d846006e04b6101d40a28b4.exe 29 PID 2376 set thread context of 2648 2376 Default.exe 34 -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 2648 Default.exe 2648 Default.exe 2648 Default.exe 2648 Default.exe 2648 Default.exe 2648 Default.exe 2648 Default.exe 2648 Default.exe 2648 Default.exe 2648 Default.exe 2648 Default.exe 2648 Default.exe 2648 Default.exe 2648 Default.exe 2648 Default.exe 2648 Default.exe 2648 Default.exe 2648 Default.exe 2648 Default.exe 2648 Default.exe 2648 Default.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2540 64944a1f7d846006e04b6101d40a28b4.exe Token: SeDebugPrivilege 2848 64944a1f7d846006e04b6101d40a28b4.exe Token: SeDebugPrivilege 2376 Default.exe Token: SeDebugPrivilege 2648 Default.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2848 2540 64944a1f7d846006e04b6101d40a28b4.exe 29 PID 2540 wrote to memory of 2848 2540 64944a1f7d846006e04b6101d40a28b4.exe 29 PID 2540 wrote to memory of 2848 2540 64944a1f7d846006e04b6101d40a28b4.exe 29 PID 2540 wrote to memory of 2848 2540 64944a1f7d846006e04b6101d40a28b4.exe 29 PID 2540 wrote to memory of 2848 2540 64944a1f7d846006e04b6101d40a28b4.exe 29 PID 2540 wrote to memory of 2848 2540 64944a1f7d846006e04b6101d40a28b4.exe 29 PID 2540 wrote to memory of 2848 2540 64944a1f7d846006e04b6101d40a28b4.exe 29 PID 736 wrote to memory of 2376 736 taskeng.exe 33 PID 736 wrote to memory of 2376 736 taskeng.exe 33 PID 736 wrote to memory of 2376 736 taskeng.exe 33 PID 2376 wrote to memory of 2648 2376 Default.exe 34 PID 2376 wrote to memory of 2648 2376 Default.exe 34 PID 2376 wrote to memory of 2648 2376 Default.exe 34 PID 2376 wrote to memory of 2648 2376 Default.exe 34 PID 2376 wrote to memory of 2648 2376 Default.exe 34 PID 2376 wrote to memory of 2648 2376 Default.exe 34 PID 2376 wrote to memory of 2648 2376 Default.exe 34 PID 2648 wrote to memory of 1816 2648 Default.exe 35 PID 2648 wrote to memory of 1816 2648 Default.exe 35 PID 2648 wrote to memory of 1816 2648 Default.exe 35 PID 2648 wrote to memory of 1508 2648 Default.exe 36 PID 2648 wrote to memory of 1508 2648 Default.exe 36 PID 2648 wrote to memory of 1508 2648 Default.exe 36 PID 2648 wrote to memory of 1660 2648 Default.exe 37 PID 2648 wrote to memory of 1660 2648 Default.exe 37 PID 2648 wrote to memory of 1660 2648 Default.exe 37 PID 2648 wrote to memory of 556 2648 Default.exe 38 PID 2648 wrote to memory of 556 2648 Default.exe 38 PID 2648 wrote to memory of 556 2648 Default.exe 38 PID 2648 wrote to memory of 1532 2648 Default.exe 39 PID 2648 wrote to memory of 1532 2648 Default.exe 39 PID 2648 wrote to memory of 1532 2648 Default.exe 39 PID 2648 wrote to memory of 3068 2648 Default.exe 40 PID 2648 wrote to memory of 3068 2648 Default.exe 40 PID 2648 wrote to memory of 3068 2648 Default.exe 40 PID 2648 wrote to memory of 3024 2648 Default.exe 41 PID 2648 wrote to memory of 3024 2648 Default.exe 41 PID 2648 wrote to memory of 3024 2648 Default.exe 41 PID 2648 wrote to memory of 1512 2648 Default.exe 42 PID 2648 wrote to memory of 1512 2648 Default.exe 42 PID 2648 wrote to memory of 1512 2648 Default.exe 42 PID 2648 wrote to memory of 2500 2648 Default.exe 43 PID 2648 wrote to memory of 2500 2648 Default.exe 43 PID 2648 wrote to memory of 2500 2648 Default.exe 43 PID 2648 wrote to memory of 1128 2648 Default.exe 44 PID 2648 wrote to memory of 1128 2648 Default.exe 44 PID 2648 wrote to memory of 1128 2648 Default.exe 44 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\64944a1f7d846006e04b6101d40a28b4.exe"C:\Users\Admin\AppData\Local\Temp\64944a1f7d846006e04b6101d40a28b4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\64944a1f7d846006e04b6101d40a28b4.exeC:\Users\Admin\AppData\Local\Temp\64944a1f7d846006e04b6101d40a28b4.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {4AA96890-1EE8-4D65-B55A-8365DCAC9357} S-1-5-21-2084844033-2744876406-2053742436-1000:GGPVHMXR\Admin:Interactive:[1]1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Exception\dqaql\Default.exeC:\Users\Admin\AppData\Local\Exception\dqaql\Default.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Exception\dqaql\Default.exeC:\Users\Admin\AppData\Local\Exception\dqaql\Default.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe4⤵PID:1816
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe4⤵PID:1508
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe4⤵PID:1660
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe4⤵PID:556
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe4⤵PID:1532
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe4⤵PID:3068
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe4⤵PID:3024
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe4⤵PID:1512
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe4⤵PID:2500
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe4⤵PID:1128
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD564944a1f7d846006e04b6101d40a28b4
SHA1139989bce70344cee6a009cbe197e43c263aa6a5
SHA256311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa
SHA512da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba
-
Filesize
1.2MB
MD564944a1f7d846006e04b6101d40a28b4
SHA1139989bce70344cee6a009cbe197e43c263aa6a5
SHA256311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa
SHA512da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba
-
Filesize
1.2MB
MD564944a1f7d846006e04b6101d40a28b4
SHA1139989bce70344cee6a009cbe197e43c263aa6a5
SHA256311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa
SHA512da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba
-
Filesize
1.2MB
MD564944a1f7d846006e04b6101d40a28b4
SHA1139989bce70344cee6a009cbe197e43c263aa6a5
SHA256311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa
SHA512da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba
-
Filesize
1.2MB
MD564944a1f7d846006e04b6101d40a28b4
SHA1139989bce70344cee6a009cbe197e43c263aa6a5
SHA256311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa
SHA512da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba