Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231201-en
  • resource tags

    arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system
  • submitted
    04/12/2023, 04:46

General

  • Target

    eb71493b8c138d52c8baea7adaae0a22.exe

  • Size

    1018KB

  • MD5

    eb71493b8c138d52c8baea7adaae0a22

  • SHA1

    2ada7d8d3975bae525945b18275f6e7779fbab79

  • SHA256

    3a646773608d252c2b742a0f4f74c061d4d282a090c1d39c973cbfe386f3b478

  • SHA512

    d16b619badc3ebdf2961330bd4fdb6ccf63c16cbec3d8923f701aae82df66d935ff75ca74ecbae2edf6218f4363619bbb2be39a69f5072f589a2e6c16cea3b9c

  • SSDEEP

    24576:b6dl6aVCGlaKNmzxXg6ipHKdyBnnjNd88L:uCa8GUKNmzxQGEd8I

Malware Config

Signatures

  • Detect PureLogs payload 1 IoCs
  • Detect ZGRat V1 28 IoCs
  • PureLogs

    PureLogs is an infostealer written in C#.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb71493b8c138d52c8baea7adaae0a22.exe
    "C:\Users\Admin\AppData\Local\Temp\eb71493b8c138d52c8baea7adaae0a22.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Users\Admin\AppData\Local\Temp\eb71493b8c138d52c8baea7adaae0a22.exe
      C:\Users\Admin\AppData\Local\Temp\eb71493b8c138d52c8baea7adaae0a22.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2316

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1992-17-0x0000000074540000-0x0000000074C2E000-memory.dmp

    Filesize

    6.9MB

  • memory/1992-1-0x0000000074540000-0x0000000074C2E000-memory.dmp

    Filesize

    6.9MB

  • memory/1992-2-0x0000000000290000-0x00000000002D0000-memory.dmp

    Filesize

    256KB

  • memory/1992-3-0x00000000021F0000-0x000000000229C000-memory.dmp

    Filesize

    688KB

  • memory/1992-4-0x00000000044C0000-0x000000000456C000-memory.dmp

    Filesize

    688KB

  • memory/1992-5-0x00000000022A0000-0x0000000002334000-memory.dmp

    Filesize

    592KB

  • memory/1992-6-0x0000000004D30000-0x0000000004DC2000-memory.dmp

    Filesize

    584KB

  • memory/1992-7-0x0000000000710000-0x000000000075C000-memory.dmp

    Filesize

    304KB

  • memory/1992-0-0x0000000000CA0000-0x0000000000DA4000-memory.dmp

    Filesize

    1.0MB

  • memory/2316-31-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-39-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-12-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/2316-15-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/2316-18-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/2316-10-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/2316-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2316-20-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/2316-22-0x00000000744C0000-0x0000000074BAE000-memory.dmp

    Filesize

    6.9MB

  • memory/2316-21-0x0000000000BD0000-0x0000000000CA4000-memory.dmp

    Filesize

    848KB

  • memory/2316-23-0x00000000046E0000-0x0000000004720000-memory.dmp

    Filesize

    256KB

  • memory/2316-24-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-25-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-27-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-29-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-9-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/2316-33-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-35-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-37-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-11-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/2316-41-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-43-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-45-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-47-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-49-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-51-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-53-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-55-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-57-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-59-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-61-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-63-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-67-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-65-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-69-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-71-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-73-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-75-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

    Filesize

    824KB

  • memory/2316-6078-0x00000000744C0000-0x0000000074BAE000-memory.dmp

    Filesize

    6.9MB

  • memory/2316-6079-0x00000000046E0000-0x0000000004720000-memory.dmp

    Filesize

    256KB