Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    300s
  • max time network
    303s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-en
  • resource tags

    arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
  • submitted
    07/01/2024, 22:20

General

  • Target

    5c4d929f90342a1c19f11253e884490ed5cf14fc4f31f772c92097dc62169792.exe

  • Size

    4.9MB

  • MD5

    128336fc5848c43484a2d28800a7ab39

  • SHA1

    7f986fa0926c17166dfc69c1bca76d6bb52a07c2

  • SHA256

    5c4d929f90342a1c19f11253e884490ed5cf14fc4f31f772c92097dc62169792

  • SHA512

    7a3702c3452c994403e3da938a8486191d68f9417ec1d0fb2d29e0260d0cd3cfecfa4f14f1ccb81be7bf283b4dbe54df4c551a0ac84c57f7aa5699d8feaf52f9

  • SSDEEP

    49152:JLSOMmC3NTiA/vtm228spvc5kY7ZPR6cYuBe52I+Dh/aTjr9N3/AdylBzLFlp05m:JLSOygA/TmiW5RPr9iktlp0T+R0TL2

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • Detects Arechclient2 RAT 1 IoCs

    Arechclient2.

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 3 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Drops startup file 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c4d929f90342a1c19f11253e884490ed5cf14fc4f31f772c92097dc62169792.exe
    "C:\Users\Admin\AppData\Local\Temp\5c4d929f90342a1c19f11253e884490ed5cf14fc4f31f772c92097dc62169792.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3312
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpF772.tmp

    Filesize

    1KB

    MD5

    8da37ed9237689b55cdb9445b7e64397

    SHA1

    1add2a793e94ee2878f8b811ec959ac6d308e115

    SHA256

    c1492255b0c79ee639ac39ed22cc9ff119c5b81cc16300134077517cc24c40ce

    SHA512

    b07cb0821f0324e7d96c2277e93ca6b56e15879818d7d4698bd9c11debf40d9fd41be01c0583776e631efdfc84969609b0e4cddab3b66e7af194b8a9ce76caaf

  • \Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

    Filesize

    52KB

    MD5

    4f1d1f799d0eff934129e89ae82ecd16

    SHA1

    eff96e03146e661fc5ed33dd6f06846eeb806820

    SHA256

    1ec9063da530e64262a1fea8b6ea0fae51c5b3e79dda8e49c15737b064167e0b

    SHA512

    31e0d480623532f461e6972cdf825782210e4cfcbaa1ee11456dcd7db83ac696bb00c04bc9f47483a6658e49278e6cde252c6a13149b33c0df804fbd6345ca5a

  • memory/3312-14-0x0000000005270000-0x0000000005280000-memory.dmp

    Filesize

    64KB

  • memory/3312-1-0x00000000737A0000-0x0000000073E8E000-memory.dmp

    Filesize

    6.9MB

  • memory/3312-4-0x0000000005270000-0x0000000005280000-memory.dmp

    Filesize

    64KB

  • memory/3312-5-0x0000000006580000-0x00000000068F6000-memory.dmp

    Filesize

    3.5MB

  • memory/3312-6-0x0000000007C50000-0x0000000007DE2000-memory.dmp

    Filesize

    1.6MB

  • memory/3312-16-0x0000000005270000-0x0000000005280000-memory.dmp

    Filesize

    64KB

  • memory/3312-17-0x0000000005270000-0x0000000005280000-memory.dmp

    Filesize

    64KB

  • memory/3312-48-0x00000000737A0000-0x0000000073E8E000-memory.dmp

    Filesize

    6.9MB

  • memory/3312-42-0x0000000005270000-0x0000000005280000-memory.dmp

    Filesize

    64KB

  • memory/3312-41-0x0000000005270000-0x0000000005280000-memory.dmp

    Filesize

    64KB

  • memory/3312-0-0x00000000003F0000-0x00000000008D8000-memory.dmp

    Filesize

    4.9MB

  • memory/3312-2-0x00000000052B0000-0x000000000534C000-memory.dmp

    Filesize

    624KB

  • memory/3312-12-0x0000000005270000-0x0000000005280000-memory.dmp

    Filesize

    64KB

  • memory/3312-13-0x0000000002B90000-0x0000000002BA0000-memory.dmp

    Filesize

    64KB

  • memory/3312-3-0x00000000737A0000-0x0000000073E8E000-memory.dmp

    Filesize

    6.9MB

  • memory/3312-19-0x00000000081D0000-0x00000000082D0000-memory.dmp

    Filesize

    1024KB

  • memory/3312-20-0x00000000081D0000-0x00000000082D0000-memory.dmp

    Filesize

    1024KB

  • memory/3312-15-0x0000000005270000-0x0000000005280000-memory.dmp

    Filesize

    64KB

  • memory/3312-18-0x00000000081D0000-0x00000000082D0000-memory.dmp

    Filesize

    1024KB

  • memory/3744-49-0x00000000737A0000-0x0000000073E8E000-memory.dmp

    Filesize

    6.9MB

  • memory/3744-31-0x00000000060A0000-0x0000000006106000-memory.dmp

    Filesize

    408KB

  • memory/3744-28-0x0000000006C80000-0x00000000071AC000-memory.dmp

    Filesize

    5.2MB

  • memory/3744-22-0x00000000057A0000-0x0000000005832000-memory.dmp

    Filesize

    584KB

  • memory/3744-27-0x0000000006250000-0x000000000674E000-memory.dmp

    Filesize

    5.0MB

  • memory/3744-26-0x0000000005840000-0x00000000058B6000-memory.dmp

    Filesize

    472KB

  • memory/3744-23-0x00000000737A0000-0x0000000073E8E000-memory.dmp

    Filesize

    6.9MB

  • memory/3744-30-0x0000000005FA0000-0x0000000005FF0000-memory.dmp

    Filesize

    320KB

  • memory/3744-24-0x00000000059A0000-0x00000000059B0000-memory.dmp

    Filesize

    64KB

  • memory/3744-29-0x0000000005F00000-0x0000000005F1E000-memory.dmp

    Filesize

    120KB

  • memory/3744-21-0x0000000000400000-0x00000000004D2000-memory.dmp

    Filesize

    840KB

  • memory/3744-25-0x0000000005B80000-0x0000000005D42000-memory.dmp

    Filesize

    1.8MB

  • memory/3744-50-0x00000000059A0000-0x00000000059B0000-memory.dmp

    Filesize

    64KB