Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
07/01/2024, 19:46
General
-
Target
496d5fc129c98a075ea39863bd8938a2.exe
-
Size
4.2MB
-
MD5
496d5fc129c98a075ea39863bd8938a2
-
SHA1
17ea2c2f785749550044a4fe055163216f47b76c
-
SHA256
a6c9311a9434e428bec6dd1b01e2e4033d4f8685cae164aa14e335ba0a176d09
-
SHA512
567fa49ceced374a4123a7441014c1da325973d763f1222b4631b01c26ac7163330fae7a1ba08d73a9e68b4830e4320a17523d48ccd786f86b087a3d3094a2ad
-
SSDEEP
49152:36PaeNTOyzL4EXgpSTeCrkT04991Gexjmo1G3q99C336nGhl52LQaRV8/qz+qq2E:kagTOb4TGljhFmU/eqq2Ltk/FqqibWT7
Malware Config
Extracted
bitrat
1.38
firewall.publicvm.com:25874
-
communication_password
a20ba4fb329f7dc66c0dd3562e9f9984
-
tor_process
tor
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
Detect ZGRat V1 29 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
Processes
-
C:\Users\Admin\AppData\Local\Temp\496d5fc129c98a075ea39863bd8938a2.exe"C:\Users\Admin\AppData\Local\Temp\496d5fc129c98a075ea39863bd8938a2.exe"1⤵
-
C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield1\ErrorAssistant\BF1PureCracker0.exe"C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield1\ErrorAssistant\BF1PureCracker0.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield1\ErrorAssistant\Sys.pif"C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield1\ErrorAssistant\Sys.pif"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.83⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Sys.pifC:\Users\Admin\AppData\Local\Temp\Sys.pif3⤵
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Cughlqhdqdvxnicuaztmvn.vbs"3⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.81⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NVIDIA\nvcontainer.exe'1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD50774a05ce5ee4c1af7097353c9296c62
SHA1658ff96b111c21c39d7ad5f510fb72f9762114bb
SHA256d9c5347ed06755feeb0615f1671f6b91e2718703da0dbc4b0bd205cbd2896dd4
SHA512104d69fc4f4aaa5070b78ada130228939c7e01436351166fe51fe2da8a02f9948e6d92dd676f62820da1813872b91411e2f863c9a98a760581ec34d4aa354994
-
Filesize
20KB
MD53208d49ba6636842bd1fbf160895f03a
SHA10b467dba6f9c2d4ba92b8316305c268f66091542
SHA25642be444d765ccf981588d0178c87e27f6e4779159c2801ac5686273f5b9fb32b
SHA512fc0701993fb6670fe548fae0d079213c32adfa0012106a9606bab10895ad25c5e67faf26fdd55a07a12ab3d53155169c8a8b6cbf7ec1a269ed97be8eceba1182
-
Filesize
92KB
MD5db839c59eee092b7aadaf7c429e45c32
SHA1e8be58417dfd4ed4dd110776de843084302f43df
SHA256e495c5fc9eb8073157995929503522403f160fcf4f3519770185539784bd3684
SHA51264242febb1bc8941ef4b2fdced4bfa914c06fc7ab96b9e9ffce9aa1913404380999e20f8b0eca3320feecbb9eb37e040339a832915ffa195beb5de9e65b4a56f
-
Filesize
381KB
MD57c6ae5039d34ef48cb0ba0fdc51f8488
SHA181078d459d6f1c6dd69564f0d3c1731bf4a2128a
SHA256a02b1cb427385a59c2afc7cd7d0301836bd3e2118cfa58f3a80660e55c82521b
SHA5129c458bf95d94a370877be8cb73768d19ee20b4f1cb1e90283cbc95c066f68e30bdaeb35516160e3728c930ad73dbbe5ace076cf9e51924a627a83a20a780e6bc
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
104KB
-
Filesize
600KB
-
Filesize
216KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
6.5MB
-
Filesize
64KB
-
Filesize
6.2MB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
408KB
-
Filesize
496KB
-
Filesize
96KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
240KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
288KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
80KB
-
Filesize
652KB
-
Filesize
104KB
-
Filesize
68KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
120KB
-
Filesize
32KB
-
Filesize
200KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
488KB
-
Filesize
7.7MB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
512KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
40KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
584KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
2.1MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
2.3MB