Analysis
-
max time kernel
69s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29/12/2023, 21:24
General
-
Target
045f4cea4f863d9def6967fe35303066.exe
-
Size
6.4MB
-
MD5
045f4cea4f863d9def6967fe35303066
-
SHA1
e40b4393ac099688bee151c475c71a4354c69654
-
SHA256
7f172d780a290e00ba180bab8e5fcec4d1a8f6d8512310794d7e5e9cd45e829d
-
SHA512
4779aa92792799d9e5dd6cce3a05c5f06959cdc8213e2fb5c5127733ff1d5c9108f7a13e926ea36f1661bda133b574ac484c5a3bfeed18fdf16f17d03509788f
-
SSDEEP
98304:Vi3w/4GrQBeQZ1P/by87heRw6+vllYmTDv7GQ6pwoTxFI:VCw/+eMy8te2dlYEDGQT6
Malware Config
Signatures
-
Detect ZGRat V1 35 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\045f4cea4f863d9def6967fe35303066.exe"C:\Users\Admin\AppData\Local\Temp\045f4cea4f863d9def6967fe35303066.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Jgjfitkqfhlmfojonqa.vbs"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\webfind.exe'3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\045f4cea4f863d9def6967fe35303066.exeC:\Users\Admin\AppData\Local\Temp\045f4cea4f863d9def6967fe35303066.exe2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com -Count 2 -BufferSize 128 -Delay 13⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com -Count 2 -BufferSize 128 -Delay 13⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com -Count 2 -BufferSize 128 -Delay 13⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com -Count 2 -BufferSize 128 -Delay 13⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b65ecf27e16c9159164a4f3e4f71a9ca
SHA1775ce345a9eaf954e4833bd25ee2fa4c11fc846a
SHA256adce6dd6ba66e634fe10e7fade4b6de277f3311ee0d82f6c20141520893bf72a
SHA5123927300905ca9f86fcdbc31743e285ee376ebb5b2202a07b0c4897f9a699fa84567a5e5c260d8a397b97ddc7d8e550fceccad3ebdc382556f6017816ab0efa2f
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
1KB
MD54240daff4d0559c94aeeaa69828423fa
SHA14d2cdd4a4f56c4bfdd632a7864249dc0fad7b18d
SHA256ac44b3ec8a2fca634edffe5fcfe888256a4e93adc6cebe554a819680028a3e24
SHA512a8d553a6a3bbf2f45683a6b143cd65e0ce203b4610fc5ff95b813e6fa04629ac4216aa561e4677e70158949ad76c308c8c47af3fcaf48f870b2ba951f3c91ac2
-
Filesize
1KB
MD5d096831023867930e62e6d8b3d4d8ca6
SHA1404a1e73dc1590f1c8b9327c396591567dac7365
SHA256167f75b42ae614a8d6b0497779ff12f09605328533487f235b029e0db03ad23b
SHA51231333100ddd8e04bf730118ea800843720c0f3fb69e27b89dda7fa4d717d25e838ad55a0919d47a44dd8a78d724ef8c105cfa230987cc46ba94a2b790ff91b75
-
Filesize
175B
MD510c2467cd97e13e22bd753be3c09c805
SHA1a4da069e3936b4ab05f06281af76bd05f5d3c9f0
SHA25629851d647c12d23c40a2b6623451052c1903cdc3ae4a44979507c423fcdb1024
SHA5127cfd7c289c014b2307feb330e674db4ac3c74b7a3970f57406e98e3d3a29f027dda20820c00eb6559f58d9eb3b487ab5cfaca5e6d3abe70dea9a88690cae1e26
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
6.2MB
-
Filesize
10.8MB
-
Filesize
6.2MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
64KB
-
Filesize
404KB
-
Filesize
64KB
-
Filesize
404KB
-
Filesize
10.8MB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
64KB
-
Filesize
404KB
-
Filesize
10.8MB
-
Filesize
472KB
-
Filesize
10.8MB
-
Filesize
6.4MB
-
Filesize
120KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
6.4MB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
432KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
136KB