Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/12/2023, 10:33
Static task
static1
Behavioral task
behavioral1
Sample
d92e6b60eecc9c96a1ad74e2d5c9ccba.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
d92e6b60eecc9c96a1ad74e2d5c9ccba.exe
Resource
win10v2004-20231215-en
General
-
Target
d92e6b60eecc9c96a1ad74e2d5c9ccba.exe
-
Size
2.3MB
-
MD5
d92e6b60eecc9c96a1ad74e2d5c9ccba
-
SHA1
d7fcb40fa9a63dfaef531600da64c135d3079bd2
-
SHA256
8efce4180ae0e0f3c75dd2e13e44288c4352223f4b556c43bbb5cb96f8aec3ee
-
SHA512
ef9430611ea5b79108481cfa80961c569f0e2df82503afedff382f4f9bb0ed8227687a46b1c4e14af5692d81031b17c0c2bdb19bfac59cc59f3c3b099a332f37
-
SSDEEP
24576:FD+2lLAnMrJAmvGlBla8SmYU05za8oq9xKG+K/jAnKeL5qTZBHR1k85onek0nn15:FLuMNdGddGxsKrAEZZR1KneNBL2NuW
Malware Config
Extracted
bitrat
1.38
37.0.10.19:5678
-
communication_password
674f3c2c1a8a6f90461e8a66fb5550ba
-
tor_process
tor
Signatures
-
Detect ZGRat V1 34 IoCs
resource yara_rule behavioral1/memory/2068-7-0x0000000000460000-0x00000000004D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-25-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-39-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-47-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-53-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-63-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-67-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-71-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-69-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-65-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-61-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-59-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-57-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-55-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-51-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-49-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-45-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-43-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-41-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-37-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-35-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-33-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-31-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-29-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-27-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-23-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-21-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-19-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-17-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-15-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-13-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-11-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-9-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 behavioral1/memory/2068-8-0x0000000000460000-0x00000000004D2000-memory.dmp family_zgrat_v1 -
Executes dropped EXE 1 IoCs
pid Process 1956 RegAsm.exe -
Loads dropped DLL 2 IoCs
pid Process 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 1956 RegAsm.exe -
resource yara_rule behavioral1/memory/1956-2247-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1956-2264-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Users\\Admin\\AppData\\Roaming\\Programs\\Steam.exe\"" d92e6b60eecc9c96a1ad74e2d5c9ccba.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 1956 RegAsm.exe 1956 RegAsm.exe 1956 RegAsm.exe 1956 RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2068 set thread context of 1956 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 2568 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe Token: SeDebugPrivilege 2568 powershell.exe Token: SeDebugPrivilege 1956 RegAsm.exe Token: SeShutdownPrivilege 1956 RegAsm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1956 RegAsm.exe 1956 RegAsm.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2068 wrote to memory of 1060 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 31 PID 2068 wrote to memory of 1060 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 31 PID 2068 wrote to memory of 1060 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 31 PID 2068 wrote to memory of 1060 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 31 PID 2068 wrote to memory of 1956 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 32 PID 2068 wrote to memory of 1956 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 32 PID 2068 wrote to memory of 1956 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 32 PID 2068 wrote to memory of 1956 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 32 PID 2068 wrote to memory of 1956 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 32 PID 2068 wrote to memory of 1956 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 32 PID 2068 wrote to memory of 1956 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 32 PID 2068 wrote to memory of 1956 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 32 PID 2068 wrote to memory of 1956 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 32 PID 1060 wrote to memory of 2568 1060 WScript.exe 33 PID 1060 wrote to memory of 2568 1060 WScript.exe 33 PID 1060 wrote to memory of 2568 1060 WScript.exe 33 PID 1060 wrote to memory of 2568 1060 WScript.exe 33 PID 2068 wrote to memory of 1956 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 32 PID 2068 wrote to memory of 1956 2068 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\d92e6b60eecc9c96a1ad74e2d5c9ccba.exe"C:\Users\Admin\AppData\Local\Temp\d92e6b60eecc9c96a1ad74e2d5c9ccba.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Rbtqvuqexxqqfvkdqsvr.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Programs\Steam.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\RegAsm.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD53ecf68c532c2878c3e453e4ec5b53014
SHA11198fb13796e31dbfa8d5d624126dc80a5abb26e
SHA25678c0bc46d3ec284c3a551fe7fffc6961eb986d87bcb30e35dc62f303b822c1b3
SHA512ae34c5d5d55d15bae771746b6fc0358f5d9663123a788cd46f632d3d3aee90ec8265b4bb258971fc9e05230a8a4fdaeca309a920b97a2b2ec200c2b533515a3f
-
Filesize
63KB
MD5b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA2566e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab