Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
164s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2024, 16:01
Static task
static1
Behavioral task
behavioral1
Sample
496d5fc129c98a075ea39863bd8938a2.exe
Resource
win7-20231129-en
General
-
Target
496d5fc129c98a075ea39863bd8938a2.exe
-
Size
4.2MB
-
MD5
496d5fc129c98a075ea39863bd8938a2
-
SHA1
17ea2c2f785749550044a4fe055163216f47b76c
-
SHA256
a6c9311a9434e428bec6dd1b01e2e4033d4f8685cae164aa14e335ba0a176d09
-
SHA512
567fa49ceced374a4123a7441014c1da325973d763f1222b4631b01c26ac7163330fae7a1ba08d73a9e68b4830e4320a17523d48ccd786f86b087a3d3094a2ad
-
SSDEEP
49152:36PaeNTOyzL4EXgpSTeCrkT04991Gexjmo1G3q99C336nGhl52LQaRV8/qz+qq2E:kagTOb4TGljhFmU/eqq2Ltk/FqqibWT7
Malware Config
Signatures
-
Detect ZGRat V1 34 IoCs
resource yara_rule behavioral2/memory/4296-85-0x0000000006170000-0x00000000061F0000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-86-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-87-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-89-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-91-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-93-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-95-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-97-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-99-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-101-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-103-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-105-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-107-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-109-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-111-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-113-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-115-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-117-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-119-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-121-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-123-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-125-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-127-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-129-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-131-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-133-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-135-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-137-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-139-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-141-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-143-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-145-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-147-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 behavioral2/memory/4296-149-0x0000000006170000-0x00000000061EA000-memory.dmp family_zgrat_v1 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation Sys.pif Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 496d5fc129c98a075ea39863bd8938a2.exe -
Executes dropped EXE 2 IoCs
pid Process 4296 Sys.pif 2752 BF1PureCracker0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3908 powershell.exe 3908 powershell.exe 3908 powershell.exe 4548 powershell.exe 4548 powershell.exe 4548 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3908 powershell.exe Token: SeDebugPrivilege 4548 powershell.exe Token: SeDebugPrivilege 4296 Sys.pif -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1044 wrote to memory of 4296 1044 496d5fc129c98a075ea39863bd8938a2.exe 95 PID 1044 wrote to memory of 4296 1044 496d5fc129c98a075ea39863bd8938a2.exe 95 PID 1044 wrote to memory of 4296 1044 496d5fc129c98a075ea39863bd8938a2.exe 95 PID 1044 wrote to memory of 2752 1044 496d5fc129c98a075ea39863bd8938a2.exe 97 PID 1044 wrote to memory of 2752 1044 496d5fc129c98a075ea39863bd8938a2.exe 97 PID 4296 wrote to memory of 3908 4296 Sys.pif 111 PID 4296 wrote to memory of 3908 4296 Sys.pif 111 PID 4296 wrote to memory of 3908 4296 Sys.pif 111 PID 4296 wrote to memory of 4548 4296 Sys.pif 114 PID 4296 wrote to memory of 4548 4296 Sys.pif 114 PID 4296 wrote to memory of 4548 4296 Sys.pif 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\496d5fc129c98a075ea39863bd8938a2.exe"C:\Users\Admin\AppData\Local\Temp\496d5fc129c98a075ea39863bd8938a2.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield1\ErrorAssistant\Sys.pif"C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield1\ErrorAssistant\Sys.pif"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.83⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3908
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.83⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4548
-
-
-
C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield1\ErrorAssistant\BF1PureCracker0.exe"C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield1\ErrorAssistant\BF1PureCracker0.exe"2⤵
- Executes dropped EXE
PID:2752
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
383KB
MD5c2a78b5610d2abd529688c420bde478e
SHA17a6b9c6f66f7df7540ecfd633f9735c4828f9b3a
SHA25636c76fcef546a898a0c6f4d811b9106574ac5e82f5354569871be9679091871c
SHA512b000464af649879dc724a9d805601ba9f627e03f28a65bc2a13a946f840d70bd8e6835511701657c795b96fd4521c7f23826b168a0bf2429e9d36bb596797aa2
-
Filesize
470KB
MD519f8591a6baa83af46de41f20224b6f1
SHA1c736799e1936cec37acbf66fdf1df96f4679562f
SHA256a94e2f3c206351503f6c4002585af270880854b4b97b730ea51764ef23b5ba79
SHA512db4798af16452ce7c0e47f59692e1643d2639b0744075b78bb9dc33dbf7de78392bb21f28529b091d54ed0a2185add12f38c256bcb3ba97d34a050e29a19617e
-
C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield1\ErrorAssistant\SharpDX.Mathematics.dll
Filesize216KB
MD5d30f6fb490a820dcdd9c7da971036393
SHA1177b1b912fb09efacce8bae24fca35ea514f131b
SHA256be2fe214f8a1515824b523ac85f25c8856370d4ffd90cd22dd78c079f5ea803b
SHA512332508c32d6c5baf16da59c619fb4b55dfdfccea667582d02ccf72e88d0ddc0acaa2df97adba038bbada9d839145a6cd76c4a7ced5346256d868b3bd548d82e2
-
Filesize
260KB
MD56fabeaa1c8ea15e787f2e3b487ab434d
SHA1c2091f69192903676ed6b181bbf8346b819c43a2
SHA25628437b8f6036224b187f6ec324af9cd8f20dc5e363b0341f86869e4172f07909
SHA512076bccbb7ddd4bb7b785bc70dfcaa920c080af30172ce1dcc49594a96f96133d0322db73362c47d8b4d2afa69e0ee0c78a3b423aa4886478080529f864bf1739
-
Filesize
2.2MB
MD576555816c73f34e86608807c7737a593
SHA13c38473581f2c602a25707ee9000634f4b4d033a
SHA25664299aa25ed5fae3be2ac53c376875280bb624a555674bc89f43e58cf06fde6d
SHA512a2a28ef202a332d002cf831c8fb94ef67dc392e543748c8b819fae191829fce038211a905ee08836556a73f9bc4918313c4be6ab9e7ef068503054eedfd3f22b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82