Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
13-12-2023 01:17
General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.15152.2326.exe
-
Size
703KB
-
MD5
d39bc082d7c96e1f278218a4a928f135
-
SHA1
8246c4f087ed74204590c605225c6b041fadb92b
-
SHA256
56c37c9c86a5ee6ee007a087502b7068ae2917f90bba5c0d6cd639087164da77
-
SHA512
a632a4cba2c17c43a34b473444790c8fea658dde766e5ce7a1aeac0b7cc3729ab13d8bdce7c871785894ce13323c6716ccf0f6e23662d846ece212b31a4aa174
-
SSDEEP
12288:AMCAr4SFhIZwVAuPhthmjFtft5tYbDgdzvcHrr3eg4Etwk2B4qcYE/66KXaCVUaK:LH9hta/+bcd7aOLDk2BX+hKXaw
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 32 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15152.2326.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15152.2326.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15152.2326.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PsFeveFsX.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PsFeveFsX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9991.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15152.2326.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15152.2326.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15152.2326.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15152.2326.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15152.2326.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15152.2326.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15152.2326.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15152.2326.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15152.2326.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15152.2326.exe"2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d3017725eb461430493499de2c40a393
SHA1c52f6342edfe72549b1f1c610fb3a37988626488
SHA25661d92a77355ed2495dce490d1355654af8e95652ad8372b64310abdbf7b9b8f7
SHA5121c5a37867ca36b75538ceba8809641f0a33b374757629e723bc2b7071ba7eada887f46a64e30745512e01e8bdad1bd1628e569fe5973d6ef59d3ad18ae111fef
-
Filesize
7KB
MD5de42458f12cedffd7c0d7afd0a444474
SHA10c3a797d667d689a23de031f46a949769ea569f3
SHA25641d27e0a4c54f58f43b086536424f1e778c91d9a9f14774b128241e99cc95736
SHA51294c746d24aa435ae05d7c6e51c8e0619f629245133d1d7055cb390a96b766e0e16e31d673d4422c2c7ca25c026b4a00676cffd50e85d1fdbaf77e5d050c7f5f8
-
Filesize
488KB
-
Filesize
96KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
728KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB