Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
164s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
07/01/2024, 16:01
General
-
Target
496d5fc129c98a075ea39863bd8938a2.exe
-
Size
4.2MB
-
MD5
496d5fc129c98a075ea39863bd8938a2
-
SHA1
17ea2c2f785749550044a4fe055163216f47b76c
-
SHA256
a6c9311a9434e428bec6dd1b01e2e4033d4f8685cae164aa14e335ba0a176d09
-
SHA512
567fa49ceced374a4123a7441014c1da325973d763f1222b4631b01c26ac7163330fae7a1ba08d73a9e68b4830e4320a17523d48ccd786f86b087a3d3094a2ad
-
SSDEEP
49152:36PaeNTOyzL4EXgpSTeCrkT04991Gexjmo1G3q99C336nGhl52LQaRV8/qz+qq2E:kagTOb4TGljhFmU/eqq2Ltk/FqqibWT7
Malware Config
Signatures
-
Detect ZGRat V1 34 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\496d5fc129c98a075ea39863bd8938a2.exe"C:\Users\Admin\AppData\Local\Temp\496d5fc129c98a075ea39863bd8938a2.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield1\ErrorAssistant\Sys.pif"C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield1\ErrorAssistant\Sys.pif"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.83⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.83⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield1\ErrorAssistant\BF1PureCracker0.exe"C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield1\ErrorAssistant\BF1PureCracker0.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
383KB
MD5c2a78b5610d2abd529688c420bde478e
SHA17a6b9c6f66f7df7540ecfd633f9735c4828f9b3a
SHA25636c76fcef546a898a0c6f4d811b9106574ac5e82f5354569871be9679091871c
SHA512b000464af649879dc724a9d805601ba9f627e03f28a65bc2a13a946f840d70bd8e6835511701657c795b96fd4521c7f23826b168a0bf2429e9d36bb596797aa2
-
Filesize
470KB
MD519f8591a6baa83af46de41f20224b6f1
SHA1c736799e1936cec37acbf66fdf1df96f4679562f
SHA256a94e2f3c206351503f6c4002585af270880854b4b97b730ea51764ef23b5ba79
SHA512db4798af16452ce7c0e47f59692e1643d2639b0744075b78bb9dc33dbf7de78392bb21f28529b091d54ed0a2185add12f38c256bcb3ba97d34a050e29a19617e
-
Filesize
216KB
MD5d30f6fb490a820dcdd9c7da971036393
SHA1177b1b912fb09efacce8bae24fca35ea514f131b
SHA256be2fe214f8a1515824b523ac85f25c8856370d4ffd90cd22dd78c079f5ea803b
SHA512332508c32d6c5baf16da59c619fb4b55dfdfccea667582d02ccf72e88d0ddc0acaa2df97adba038bbada9d839145a6cd76c4a7ced5346256d868b3bd548d82e2
-
Filesize
260KB
MD56fabeaa1c8ea15e787f2e3b487ab434d
SHA1c2091f69192903676ed6b181bbf8346b819c43a2
SHA25628437b8f6036224b187f6ec324af9cd8f20dc5e363b0341f86869e4172f07909
SHA512076bccbb7ddd4bb7b785bc70dfcaa920c080af30172ce1dcc49594a96f96133d0322db73362c47d8b4d2afa69e0ee0c78a3b423aa4886478080529f864bf1739
-
Filesize
2.2MB
MD576555816c73f34e86608807c7737a593
SHA13c38473581f2c602a25707ee9000634f4b4d033a
SHA25664299aa25ed5fae3be2ac53c376875280bb624a555674bc89f43e58cf06fde6d
SHA512a2a28ef202a332d002cf831c8fb94ef67dc392e543748c8b819fae191829fce038211a905ee08836556a73f9bc4918313c4be6ab9e7ef068503054eedfd3f22b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
496KB
-
Filesize
40KB
-
Filesize
10.8MB
-
Filesize
288KB
-
Filesize
96KB
-
Filesize
240KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
216KB
-
Filesize
6.2MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
488KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
488KB
-
Filesize
64KB
-
Filesize
488KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
2.1MB
-
Filesize
2.3MB
-
Filesize
512KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
64KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
120KB
-
Filesize
64KB
-
Filesize
7.7MB