Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2023, 04:14

General

  • Target

    64944a1f7d846006e04b6101d40a28b4.exe

  • Size

    1.2MB

  • MD5

    64944a1f7d846006e04b6101d40a28b4

  • SHA1

    139989bce70344cee6a009cbe197e43c263aa6a5

  • SHA256

    311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa

  • SHA512

    da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba

  • SSDEEP

    24576:yV4G6JWrIWNuFYRF4Bs2kpvjpqzeRVXJIcXStT:y4WrIWMietCvjtRVJCJ

Malware Config

Signatures

  • Detect PureLogs payload 8 IoCs
  • Detect ZGRat V1 29 IoCs
  • PureLogs

    PureLogs is an infostealer written in C#.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\64944a1f7d846006e04b6101d40a28b4.exe
    "C:\Users\Admin\AppData\Local\Temp\64944a1f7d846006e04b6101d40a28b4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1408
    • C:\Users\Admin\AppData\Local\Temp\64944a1f7d846006e04b6101d40a28b4.exe
      C:\Users\Admin\AppData\Local\Temp\64944a1f7d846006e04b6101d40a28b4.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3056
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {31B7C51C-E05E-4D79-9EC9-B051C02455FC} S-1-5-21-2085049433-1067986815-1244098655-1000:AHLBRYJO\Admin:Interactive:[1]
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Users\Admin\AppData\Local\Exception\okjuokzh\Default.exe
      C:\Users\Admin\AppData\Local\Exception\okjuokzh\Default.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1828
      • C:\Users\Admin\AppData\Local\Exception\okjuokzh\Default.exe
        C:\Users\Admin\AppData\Local\Exception\okjuokzh\Default.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1824
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
          4⤵
            PID:1100
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
            4⤵
              PID:2908
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
              4⤵
                PID:2096
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                4⤵
                  PID:3028
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                  4⤵
                    PID:2116
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                    4⤵
                      PID:1756
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                      4⤵
                        PID:2416
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                        4⤵
                          PID:3012
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                          4⤵
                            PID:3052
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                            4⤵
                              PID:2892

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Exception\okjuokzh\Default.exe

                        Filesize

                        1.2MB

                        MD5

                        64944a1f7d846006e04b6101d40a28b4

                        SHA1

                        139989bce70344cee6a009cbe197e43c263aa6a5

                        SHA256

                        311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa

                        SHA512

                        da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba

                      • C:\Users\Admin\AppData\Local\Exception\okjuokzh\Default.exe

                        Filesize

                        1.2MB

                        MD5

                        64944a1f7d846006e04b6101d40a28b4

                        SHA1

                        139989bce70344cee6a009cbe197e43c263aa6a5

                        SHA256

                        311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa

                        SHA512

                        da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba

                      • C:\Users\Admin\AppData\Local\Exception\okjuokzh\Default.exe

                        Filesize

                        1.2MB

                        MD5

                        64944a1f7d846006e04b6101d40a28b4

                        SHA1

                        139989bce70344cee6a009cbe197e43c263aa6a5

                        SHA256

                        311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa

                        SHA512

                        da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba

                      • \Users\Admin\AppData\Local\Exception\okjuokzh\Default.exe

                        Filesize

                        1.2MB

                        MD5

                        64944a1f7d846006e04b6101d40a28b4

                        SHA1

                        139989bce70344cee6a009cbe197e43c263aa6a5

                        SHA256

                        311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa

                        SHA512

                        da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba

                      • \Users\Admin\AppData\Local\Exception\okjuokzh\Default.exe

                        Filesize

                        1.2MB

                        MD5

                        64944a1f7d846006e04b6101d40a28b4

                        SHA1

                        139989bce70344cee6a009cbe197e43c263aa6a5

                        SHA256

                        311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa

                        SHA512

                        da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba

                      • memory/1408-7-0x00000000006F0000-0x000000000073C000-memory.dmp

                        Filesize

                        304KB

                      • memory/1408-1-0x000007FEF5AA0000-0x000007FEF648C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/1408-4-0x000000001AFB0000-0x000000001B090000-memory.dmp

                        Filesize

                        896KB

                      • memory/1408-5-0x000000001B090000-0x000000001B158000-memory.dmp

                        Filesize

                        800KB

                      • memory/1408-6-0x000000001B4C0000-0x000000001B588000-memory.dmp

                        Filesize

                        800KB

                      • memory/1408-2-0x000000001B160000-0x000000001B1E0000-memory.dmp

                        Filesize

                        512KB

                      • memory/1408-18-0x000007FEF5AA0000-0x000007FEF648C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/1408-0-0x0000000000980000-0x0000000000AB8000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/1408-3-0x00000000004F0000-0x00000000005D2000-memory.dmp

                        Filesize

                        904KB

                      • memory/1824-4410-0x0000000000DA0000-0x0000000000E20000-memory.dmp

                        Filesize

                        512KB

                      • memory/1824-2246-0x0000000000DA0000-0x0000000000E20000-memory.dmp

                        Filesize

                        512KB

                      • memory/1824-2225-0x000007FEF5A00000-0x000007FEF63EC000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/1824-4411-0x000007FEF5A00000-0x000007FEF63EC000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/1828-2226-0x000007FEF5A00000-0x000007FEF63EC000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/1828-2212-0x000007FEF5A00000-0x000007FEF63EC000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/1828-2214-0x000000001AD20000-0x000000001ADA0000-memory.dmp

                        Filesize

                        512KB

                      • memory/1828-2213-0x0000000001210000-0x0000000001348000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/3056-38-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-60-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-26-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-28-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-30-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-32-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-34-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-36-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-22-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-42-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-40-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-44-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-46-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-48-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-50-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-54-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-52-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-56-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-58-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-24-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-64-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-66-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-68-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-62-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-70-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-72-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-74-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-21-0x000000001AE20000-0x000000001AF00000-memory.dmp

                        Filesize

                        896KB

                      • memory/3056-20-0x0000000000870000-0x00000000008F0000-memory.dmp

                        Filesize

                        512KB

                      • memory/3056-19-0x000000001AE20000-0x000000001AF04000-memory.dmp

                        Filesize

                        912KB

                      • memory/3056-17-0x000007FEF5AA0000-0x000007FEF648C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/3056-14-0x0000000000400000-0x00000000004AA000-memory.dmp

                        Filesize

                        680KB

                      • memory/3056-13-0x000007FFFFFD3000-0x000007FFFFFD4000-memory.dmp

                        Filesize

                        4KB

                      • memory/3056-12-0x0000000000400000-0x00000000004AA000-memory.dmp

                        Filesize

                        680KB

                      • memory/3056-10-0x0000000000400000-0x00000000004AA000-memory.dmp

                        Filesize

                        680KB

                      • memory/3056-8-0x0000000000400000-0x00000000004AA000-memory.dmp

                        Filesize

                        680KB

                      • memory/3056-2203-0x0000000000160000-0x0000000000168000-memory.dmp

                        Filesize

                        32KB

                      • memory/3056-2204-0x0000000000810000-0x0000000000866000-memory.dmp

                        Filesize

                        344KB

                      • memory/3056-2205-0x00000000022F0000-0x0000000002344000-memory.dmp

                        Filesize

                        336KB

                      • memory/3056-2207-0x000007FEF5AA0000-0x000007FEF648C000-memory.dmp

                        Filesize

                        9.9MB