Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2023, 10:39
Behavioral task
behavioral1
Sample
588506d91ec77a608a62417ea1d67204b1b173bd90af7e17cf52bbd0f03f7d2d.exe
Resource
win7-20231023-en
General
-
Target
588506d91ec77a608a62417ea1d67204b1b173bd90af7e17cf52bbd0f03f7d2d.exe
-
Size
1.5MB
-
MD5
6367fb0d52b90b807550b3eedbb277f0
-
SHA1
426f118550fa5006fbcab8c6d78b105600bf82c3
-
SHA256
588506d91ec77a608a62417ea1d67204b1b173bd90af7e17cf52bbd0f03f7d2d
-
SHA512
185171a50f2ce8d0742dc2e1fee5b2b91fd6884f899726495823124eed8b83094a9d570b04f7a9fbcaac56eca7e48a1c1679a3f284ea0ac3707340df1584b671
-
SSDEEP
24576:Aj3JaPnj1wF03rp/EKWVgdG2rhQpG458wNNqZ:Aj3JE1wclEKMgdGpGydNy
Malware Config
Signatures
-
Detect PureLogs payload 4 IoCs
resource yara_rule behavioral2/memory/2540-0-0x000002E19F090000-0x000002E19F20A000-memory.dmp family_purelogs behavioral2/files/0x00070000000231da-2217.dat family_purelogs behavioral2/files/0x00070000000231da-2218.dat family_purelogs behavioral2/files/0x00070000000231da-2222.dat family_purelogs -
Detect ZGRat V1 33 IoCs
resource yara_rule behavioral2/memory/5100-11-0x0000020A25540000-0x0000020A25624000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-17-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-23-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-21-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-31-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-29-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-27-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-33-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-37-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-47-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-49-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-61-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-63-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-67-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-69-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-75-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-73-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-71-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-65-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-59-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-57-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-55-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-53-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-51-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-45-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-43-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-41-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-39-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-35-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-25-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-19-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-15-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 behavioral2/memory/5100-14-0x0000020A25540000-0x0000020A25620000-memory.dmp family_zgrat_v1 -
Executes dropped EXE 2 IoCs
pid Process 2752 MajorRevision.exe 3276 MajorRevision.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2540 set thread context of 5100 2540 588506d91ec77a608a62417ea1d67204b1b173bd90af7e17cf52bbd0f03f7d2d.exe 90 PID 2752 set thread context of 3276 2752 MajorRevision.exe 93 PID 3276 set thread context of 4964 3276 MajorRevision.exe 94 PID 4964 set thread context of 3536 4964 MSBuild.exe 95 -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2540 588506d91ec77a608a62417ea1d67204b1b173bd90af7e17cf52bbd0f03f7d2d.exe 2752 MajorRevision.exe 3276 MajorRevision.exe 3276 MajorRevision.exe 4964 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2540 588506d91ec77a608a62417ea1d67204b1b173bd90af7e17cf52bbd0f03f7d2d.exe Token: SeDebugPrivilege 5100 588506d91ec77a608a62417ea1d67204b1b173bd90af7e17cf52bbd0f03f7d2d.exe Token: SeDebugPrivilege 2752 MajorRevision.exe Token: SeDebugPrivilege 3276 MajorRevision.exe Token: SeDebugPrivilege 4964 MSBuild.exe Token: SeDebugPrivilege 3536 MSBuild.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2540 wrote to memory of 5100 2540 588506d91ec77a608a62417ea1d67204b1b173bd90af7e17cf52bbd0f03f7d2d.exe 90 PID 2540 wrote to memory of 5100 2540 588506d91ec77a608a62417ea1d67204b1b173bd90af7e17cf52bbd0f03f7d2d.exe 90 PID 2540 wrote to memory of 5100 2540 588506d91ec77a608a62417ea1d67204b1b173bd90af7e17cf52bbd0f03f7d2d.exe 90 PID 2540 wrote to memory of 5100 2540 588506d91ec77a608a62417ea1d67204b1b173bd90af7e17cf52bbd0f03f7d2d.exe 90 PID 2540 wrote to memory of 5100 2540 588506d91ec77a608a62417ea1d67204b1b173bd90af7e17cf52bbd0f03f7d2d.exe 90 PID 2540 wrote to memory of 5100 2540 588506d91ec77a608a62417ea1d67204b1b173bd90af7e17cf52bbd0f03f7d2d.exe 90 PID 2752 wrote to memory of 3276 2752 MajorRevision.exe 93 PID 2752 wrote to memory of 3276 2752 MajorRevision.exe 93 PID 2752 wrote to memory of 3276 2752 MajorRevision.exe 93 PID 2752 wrote to memory of 3276 2752 MajorRevision.exe 93 PID 2752 wrote to memory of 3276 2752 MajorRevision.exe 93 PID 2752 wrote to memory of 3276 2752 MajorRevision.exe 93 PID 3276 wrote to memory of 4964 3276 MajorRevision.exe 94 PID 3276 wrote to memory of 4964 3276 MajorRevision.exe 94 PID 3276 wrote to memory of 4964 3276 MajorRevision.exe 94 PID 3276 wrote to memory of 4964 3276 MajorRevision.exe 94 PID 3276 wrote to memory of 4964 3276 MajorRevision.exe 94 PID 3276 wrote to memory of 4964 3276 MajorRevision.exe 94 PID 3276 wrote to memory of 4964 3276 MajorRevision.exe 94 PID 4964 wrote to memory of 3536 4964 MSBuild.exe 95 PID 4964 wrote to memory of 3536 4964 MSBuild.exe 95 PID 4964 wrote to memory of 3536 4964 MSBuild.exe 95 PID 4964 wrote to memory of 3536 4964 MSBuild.exe 95 PID 4964 wrote to memory of 3536 4964 MSBuild.exe 95 PID 4964 wrote to memory of 3536 4964 MSBuild.exe 95 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\588506d91ec77a608a62417ea1d67204b1b173bd90af7e17cf52bbd0f03f7d2d.exe"C:\Users\Admin\AppData\Local\Temp\588506d91ec77a608a62417ea1d67204b1b173bd90af7e17cf52bbd0f03f7d2d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\588506d91ec77a608a62417ea1d67204b1b173bd90af7e17cf52bbd0f03f7d2d.exeC:\Users\Admin\AppData\Local\Temp\588506d91ec77a608a62417ea1d67204b1b173bd90af7e17cf52bbd0f03f7d2d.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5100
-
-
C:\Users\Admin\AppData\Local\IsFamilyOrAssembly\soefca\MajorRevision.exeC:\Users\Admin\AppData\Local\IsFamilyOrAssembly\soefca\MajorRevision.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\IsFamilyOrAssembly\soefca\MajorRevision.exeC:\Users\Admin\AppData\Local\IsFamilyOrAssembly\soefca\MajorRevision.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD56367fb0d52b90b807550b3eedbb277f0
SHA1426f118550fa5006fbcab8c6d78b105600bf82c3
SHA256588506d91ec77a608a62417ea1d67204b1b173bd90af7e17cf52bbd0f03f7d2d
SHA512185171a50f2ce8d0742dc2e1fee5b2b91fd6884f899726495823124eed8b83094a9d570b04f7a9fbcaac56eca7e48a1c1679a3f284ea0ac3707340df1584b671
-
Filesize
1.5MB
MD56367fb0d52b90b807550b3eedbb277f0
SHA1426f118550fa5006fbcab8c6d78b105600bf82c3
SHA256588506d91ec77a608a62417ea1d67204b1b173bd90af7e17cf52bbd0f03f7d2d
SHA512185171a50f2ce8d0742dc2e1fee5b2b91fd6884f899726495823124eed8b83094a9d570b04f7a9fbcaac56eca7e48a1c1679a3f284ea0ac3707340df1584b671
-
Filesize
1.5MB
MD56367fb0d52b90b807550b3eedbb277f0
SHA1426f118550fa5006fbcab8c6d78b105600bf82c3
SHA256588506d91ec77a608a62417ea1d67204b1b173bd90af7e17cf52bbd0f03f7d2d
SHA512185171a50f2ce8d0742dc2e1fee5b2b91fd6884f899726495823124eed8b83094a9d570b04f7a9fbcaac56eca7e48a1c1679a3f284ea0ac3707340df1584b671
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\588506d91ec77a608a62417ea1d67204b1b173bd90af7e17cf52bbd0f03f7d2d.exe.log
Filesize1KB
MD584a01db52ea5a878520e162c80acfcd3
SHA149b7c5c072f6c32e54cc97c1dcbee90de0dd4738
SHA25625ff806b9c85928aee814fa3aebbf45fa9735a7f594a6261f0779e89eb8c3bfe
SHA5120516cbe6b9b7842be7f00ba3159a4df31257fc4e9db8ccb8f9f720801174f3d49327b7881c59ea12a4767c6d3e7c99a3b707c10279dfb39f12f9792134e6248e
-
Filesize
1KB
MD584a01db52ea5a878520e162c80acfcd3
SHA149b7c5c072f6c32e54cc97c1dcbee90de0dd4738
SHA25625ff806b9c85928aee814fa3aebbf45fa9735a7f594a6261f0779e89eb8c3bfe
SHA5120516cbe6b9b7842be7f00ba3159a4df31257fc4e9db8ccb8f9f720801174f3d49327b7881c59ea12a4767c6d3e7c99a3b707c10279dfb39f12f9792134e6248e
-
Filesize
1KB
MD584a01db52ea5a878520e162c80acfcd3
SHA149b7c5c072f6c32e54cc97c1dcbee90de0dd4738
SHA25625ff806b9c85928aee814fa3aebbf45fa9735a7f594a6261f0779e89eb8c3bfe
SHA5120516cbe6b9b7842be7f00ba3159a4df31257fc4e9db8ccb8f9f720801174f3d49327b7881c59ea12a4767c6d3e7c99a3b707c10279dfb39f12f9792134e6248e