Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
03/01/2024, 11:37
General
-
Target
Debug.exe
-
Size
631KB
-
MD5
eec03d362a4c66fe6ac8064ae68bda50
-
SHA1
8aa051b9c7f201eb9504fb7023bbc5ffa2458293
-
SHA256
cd2cc1403cb829e7d7454a3a80d9875834bd3b0837e56493369f2d842bf3f569
-
SHA512
e6f07b5171fee9fa534f57376aaf6061e541da4ad9cee2e50b3d2ee3eed7cd2d0ed2942a479e8887dc7e4247e969b081b5ebef758854e7c62be35e2af49a8f2d
-
SSDEEP
12288:vEZR29MfzdOwMI5F09MyMeWR+KSS2g/Pd35/K9TGH4CaxJDua:MZR29Mfzdu6LyZTIdJ/K98n6u
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Debug.exe"C:\Users\Admin\AppData\Local\Temp\Debug.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {876E6D15-A210-4373-A460-BC00E0501E94} S-1-5-21-1603059206-2004189698-4139800220-1000:AILVMYUM\Admin:Interactive:[1]1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Default\Name.exeC:\Users\Admin\AppData\Roaming\Default\Name.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
631KB
MD5eec03d362a4c66fe6ac8064ae68bda50
SHA18aa051b9c7f201eb9504fb7023bbc5ffa2458293
SHA256cd2cc1403cb829e7d7454a3a80d9875834bd3b0837e56493369f2d842bf3f569
SHA512e6f07b5171fee9fa534f57376aaf6061e541da4ad9cee2e50b3d2ee3eed7cd2d0ed2942a479e8887dc7e4247e969b081b5ebef758854e7c62be35e2af49a8f2d
-
Filesize
648KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
1.0MB
-
Filesize
344KB
-
Filesize
304KB
-
Filesize
336KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
4KB
-
Filesize
648KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
648KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB