Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
03/12/2023, 04:14
Behavioral task
behavioral1
Sample
64944a1f7d846006e04b6101d40a28b4.exe
Resource
win7-20231023-en
General
-
Target
64944a1f7d846006e04b6101d40a28b4.exe
-
Size
1.2MB
-
MD5
64944a1f7d846006e04b6101d40a28b4
-
SHA1
139989bce70344cee6a009cbe197e43c263aa6a5
-
SHA256
311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa
-
SHA512
da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba
-
SSDEEP
24576:yV4G6JWrIWNuFYRF4Bs2kpvjpqzeRVXJIcXStT:y4WrIWMietCvjtRVJCJ
Malware Config
Signatures
-
Detect PureLogs payload 8 IoCs
resource yara_rule behavioral1/memory/1408-0-0x0000000000980000-0x0000000000AB8000-memory.dmp family_purelogs behavioral1/files/0x000f000000015ce1-2208.dat family_purelogs behavioral1/files/0x000f000000015ce1-2210.dat family_purelogs behavioral1/files/0x000f000000015ce1-2211.dat family_purelogs behavioral1/memory/1828-2213-0x0000000001210000-0x0000000001348000-memory.dmp family_purelogs behavioral1/memory/1828-2214-0x000000001AD20000-0x000000001ADA0000-memory.dmp family_purelogs behavioral1/files/0x000f000000015ce1-2215.dat family_purelogs behavioral1/files/0x000f000000015ce1-2222.dat family_purelogs -
Detect ZGRat V1 29 IoCs
resource yara_rule behavioral1/memory/3056-19-0x000000001AE20000-0x000000001AF04000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-21-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-22-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-24-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-26-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-28-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-30-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-32-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-34-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-36-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-38-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-42-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-40-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-44-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-46-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-48-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-50-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-54-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-52-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-56-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-58-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-60-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-64-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-66-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-68-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-62-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-70-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-72-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 behavioral1/memory/3056-74-0x000000001AE20000-0x000000001AF00000-memory.dmp family_zgrat_v1 -
Executes dropped EXE 2 IoCs
pid Process 1828 Default.exe 1824 Default.exe -
Loads dropped DLL 2 IoCs
pid Process 1832 taskeng.exe 1828 Default.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1408 set thread context of 3056 1408 64944a1f7d846006e04b6101d40a28b4.exe 29 PID 1828 set thread context of 1824 1828 Default.exe 34 -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 1824 Default.exe 1824 Default.exe 1824 Default.exe 1824 Default.exe 1824 Default.exe 1824 Default.exe 1824 Default.exe 1824 Default.exe 1824 Default.exe 1824 Default.exe 1824 Default.exe 1824 Default.exe 1824 Default.exe 1824 Default.exe 1824 Default.exe 1824 Default.exe 1824 Default.exe 1824 Default.exe 1824 Default.exe 1824 Default.exe 1824 Default.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1408 64944a1f7d846006e04b6101d40a28b4.exe Token: SeDebugPrivilege 3056 64944a1f7d846006e04b6101d40a28b4.exe Token: SeDebugPrivilege 1828 Default.exe Token: SeDebugPrivilege 1824 Default.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 1408 wrote to memory of 3056 1408 64944a1f7d846006e04b6101d40a28b4.exe 29 PID 1408 wrote to memory of 3056 1408 64944a1f7d846006e04b6101d40a28b4.exe 29 PID 1408 wrote to memory of 3056 1408 64944a1f7d846006e04b6101d40a28b4.exe 29 PID 1408 wrote to memory of 3056 1408 64944a1f7d846006e04b6101d40a28b4.exe 29 PID 1408 wrote to memory of 3056 1408 64944a1f7d846006e04b6101d40a28b4.exe 29 PID 1408 wrote to memory of 3056 1408 64944a1f7d846006e04b6101d40a28b4.exe 29 PID 1408 wrote to memory of 3056 1408 64944a1f7d846006e04b6101d40a28b4.exe 29 PID 1832 wrote to memory of 1828 1832 taskeng.exe 33 PID 1832 wrote to memory of 1828 1832 taskeng.exe 33 PID 1832 wrote to memory of 1828 1832 taskeng.exe 33 PID 1828 wrote to memory of 1824 1828 Default.exe 34 PID 1828 wrote to memory of 1824 1828 Default.exe 34 PID 1828 wrote to memory of 1824 1828 Default.exe 34 PID 1828 wrote to memory of 1824 1828 Default.exe 34 PID 1828 wrote to memory of 1824 1828 Default.exe 34 PID 1828 wrote to memory of 1824 1828 Default.exe 34 PID 1828 wrote to memory of 1824 1828 Default.exe 34 PID 1824 wrote to memory of 1100 1824 Default.exe 35 PID 1824 wrote to memory of 1100 1824 Default.exe 35 PID 1824 wrote to memory of 1100 1824 Default.exe 35 PID 1824 wrote to memory of 2908 1824 Default.exe 36 PID 1824 wrote to memory of 2908 1824 Default.exe 36 PID 1824 wrote to memory of 2908 1824 Default.exe 36 PID 1824 wrote to memory of 2096 1824 Default.exe 37 PID 1824 wrote to memory of 2096 1824 Default.exe 37 PID 1824 wrote to memory of 2096 1824 Default.exe 37 PID 1824 wrote to memory of 3028 1824 Default.exe 38 PID 1824 wrote to memory of 3028 1824 Default.exe 38 PID 1824 wrote to memory of 3028 1824 Default.exe 38 PID 1824 wrote to memory of 2116 1824 Default.exe 39 PID 1824 wrote to memory of 2116 1824 Default.exe 39 PID 1824 wrote to memory of 2116 1824 Default.exe 39 PID 1824 wrote to memory of 1756 1824 Default.exe 40 PID 1824 wrote to memory of 1756 1824 Default.exe 40 PID 1824 wrote to memory of 1756 1824 Default.exe 40 PID 1824 wrote to memory of 2416 1824 Default.exe 41 PID 1824 wrote to memory of 2416 1824 Default.exe 41 PID 1824 wrote to memory of 2416 1824 Default.exe 41 PID 1824 wrote to memory of 3012 1824 Default.exe 42 PID 1824 wrote to memory of 3012 1824 Default.exe 42 PID 1824 wrote to memory of 3012 1824 Default.exe 42 PID 1824 wrote to memory of 3052 1824 Default.exe 43 PID 1824 wrote to memory of 3052 1824 Default.exe 43 PID 1824 wrote to memory of 3052 1824 Default.exe 43 PID 1824 wrote to memory of 2892 1824 Default.exe 44 PID 1824 wrote to memory of 2892 1824 Default.exe 44 PID 1824 wrote to memory of 2892 1824 Default.exe 44 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\64944a1f7d846006e04b6101d40a28b4.exe"C:\Users\Admin\AppData\Local\Temp\64944a1f7d846006e04b6101d40a28b4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\64944a1f7d846006e04b6101d40a28b4.exeC:\Users\Admin\AppData\Local\Temp\64944a1f7d846006e04b6101d40a28b4.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3056
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {31B7C51C-E05E-4D79-9EC9-B051C02455FC} S-1-5-21-2085049433-1067986815-1244098655-1000:AHLBRYJO\Admin:Interactive:[1]1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Exception\okjuokzh\Default.exeC:\Users\Admin\AppData\Local\Exception\okjuokzh\Default.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Exception\okjuokzh\Default.exeC:\Users\Admin\AppData\Local\Exception\okjuokzh\Default.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe4⤵PID:1100
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe4⤵PID:2908
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe4⤵PID:2096
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe4⤵PID:3028
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe4⤵PID:2116
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe4⤵PID:1756
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe4⤵PID:2416
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe4⤵PID:3012
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe4⤵PID:3052
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe4⤵PID:2892
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD564944a1f7d846006e04b6101d40a28b4
SHA1139989bce70344cee6a009cbe197e43c263aa6a5
SHA256311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa
SHA512da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba
-
Filesize
1.2MB
MD564944a1f7d846006e04b6101d40a28b4
SHA1139989bce70344cee6a009cbe197e43c263aa6a5
SHA256311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa
SHA512da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba
-
Filesize
1.2MB
MD564944a1f7d846006e04b6101d40a28b4
SHA1139989bce70344cee6a009cbe197e43c263aa6a5
SHA256311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa
SHA512da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba
-
Filesize
1.2MB
MD564944a1f7d846006e04b6101d40a28b4
SHA1139989bce70344cee6a009cbe197e43c263aa6a5
SHA256311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa
SHA512da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba
-
Filesize
1.2MB
MD564944a1f7d846006e04b6101d40a28b4
SHA1139989bce70344cee6a009cbe197e43c263aa6a5
SHA256311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa
SHA512da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba