Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
11/01/2024, 20:09
General
-
Target
53d9dc9fa9cc34f33fe03b7c5f5fce6b.js
-
Size
1.1MB
-
MD5
53d9dc9fa9cc34f33fe03b7c5f5fce6b
-
SHA1
8d906ed4bfd58c0220765721298ce2e75256b568
-
SHA256
2501e01c4f196967e005c2969f1d692ca8adcb24a23c5d6fb13f9a0b71f2d8c8
-
SHA512
baa55aa8cad643bf63ef21b6413d4bd3fb92c702588f95b650187b06189ae2a191945a777856662fd5d0801115700e4c7a6de3143b1e03a5bb666040bfdb1ca7
-
SSDEEP
24576:VnnSnOBVKSjE0WomnrAXLjEYwbsC6fwC1prbsHn0NO2IOU:lcnraeWHrAg0J
Malware Config
Signatures
-
Detect ZGRat V1 10 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\53d9dc9fa9cc34f33fe03b7c5f5fce6b.js1⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\FXdRinYHQL.js"2⤵
-
-
C:\Users\Admin\AppData\Roaming\NEW COPY DOC_SCANNED ORDER_AUG_IMG_6210332111_CIF_EXW.exe"C:\Users\Admin\AppData\Roaming\NEW COPY DOC_SCANNED ORDER_AUG_IMG_6210332111_CIF_EXW.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\RegAsm.exe3⤵
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Wbgaudpiceqjoa.vbs"3⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\200chrome.exe'1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5553ecbf87f18653de3b9978e7ceeb20c
SHA188f5ed0ad85a66980b628ae720cfaf288c59ea00
SHA256e6c7c52dcb4b14f2af02291eaa0c3282bd9617cf221fbb8411e85040b8f9ad07
SHA5127daedce04d6b1da7efbed562b59a633fde9d919472284c14eda2225242576ab2a705d883016056b52da82067ee714ed9013002e07ca2528d54bd174039ef3d48
-
Filesize
177B
MD5bcc3b867bb0c9c09b3fd8ae278b884b6
SHA1b5fe9dad81f92ee435ca9c7c4b9e9072e2849190
SHA25657aa202b554994ab30f3a59b47e7b8044f716eb4a9d1c7ced6b9f79d26de7ad8
SHA512f30f88b89e505f02529b645f5df7e7c77a540115229c93b42b9e87e3189c3d999f0ad7bc4661c5d487bc6e72650f5e06be1223e8092a9afd0d5482a16e554985
-
Filesize
5KB
MD5a91b9d93780a40804247ad3f0808b05d
SHA11e9a4f8a54630ddda3d0f5af04bfe4a022cde583
SHA256f7f108cd530c91102d39f3c0005e5a4e32a86c17c0a32c15a73dc2482f02b319
SHA5129660631a4ad6a64460203cc657eecac8e6769746b4534c33d20512e1ff8bff72dac82a503b0a0a45c2335d090971234f5a5085c7f13ea07563203d6a1a383b6e
-
Filesize
7KB
MD500289ce20d78c2b17af8029573877a7b
SHA1401b543a9603eebd4cc1a4939323e641c1a14992
SHA25674c1c8a752d7ac5ea8a4147d688973daa7d6297632d2faf67e210adc10f22c4b
SHA512d01a030772f5a6eb8a6d4f2cd1a78b7748841476fe80fea12b76da2c7adaa3a9140ba753dfd1badcae5eca614f26381b87bfd3030035c78e666bf9e62f8dfac9
-
Filesize
5KB
MD5c778e8209494d369bd84bdac7ca81b3a
SHA1e07041a7c5abf8a8721a712e9a26fe6bcea13cb8
SHA256e352682e700635e149b7217ad1f49f6b814d2edbd6c151b8d25604dfae20b255
SHA51282642fe90933291e5ac86fb7681f88f64206e2731abbf7b13aa48ffe83f53719f62ec524ac2be4c9f780ed026207c607400e4f24f33dbff252e2bacb0e2dc112
-
Filesize
47KB
MD5a9d12917678def9c0a081a649ea1da60
SHA1662d55c16877dbcea53eb5051024ec6b576a60a2
SHA2569c1dd90cd201f598910358f40e513db1b8a2fde01cd664d0fc29b6770025486c
SHA5128c38fc9a894570f224dab5fbaa556d2d7d10361f631aff90dad5b3efc28a7b5d5ae2b08c5fbf6e222531db97c8699842ff311b460b0d53de680878f1464083b8
-
Filesize
14KB
MD528c3030ec392c9db429a9374575a8a50
SHA18fd1878a3b15824d9798c2d3da2afa37c484448d
SHA256806e62f07c9de33199122455713d5304336bc7974c6484903004e8c38d478905
SHA5127102ee4cdc795bd1ad3e6a72d82fdb8e8d37229969f5e429ba6b3f41efd63d06ec7645dc045fc28d1cd3930bc97489ef01a515de0b70820f97aef5ffcdd032d0
-
Filesize
15KB
MD5ad8c5ef8c4f6e74d2341eea74a464d23
SHA18ba65d8c09c610215d83fe059d35c1a6d37be2a1
SHA25640d7c116074a379ceac74b23a142a38e4fe68586443facb5797c9348c0972c97
SHA5120aa1813c2c4e60e12c774477f0d20a433e34dac54c2739b7f6991772a37bee07f66ddd4022538ab9439e93d8e71788f0d3d43468d9d9d1ea26aaa8782eb5524f
-
Filesize
1KB
MD5ac89f5979b9107f597aa2f781133f806
SHA1072eae4ad2f53a895ce235dc2acaccc18abcb4be
SHA256930f8868fcb6729cd8b8ddbb5ff81276b234cf90bded05e16b28168fbc070727
SHA512de530d6fa95af93a4766e0dcd41ef88736b97b6a1f6470a1c74a8416be5805f4eb71c7054cb58030654512da0c4867a34a5ae2e13850180acdf773fb9989295e
-
Filesize
40KB
MD56751274c85a5000bb2237b45915681c1
SHA135fb0d82cd50022b314508b42518a55c38c1d471
SHA256413846b9bd42127228421b688dafeabc4e0a8aaa83511e297260d1d03014ec53
SHA512d24a7ce7f58e0e366eed255766de695ce9242ad641a3362eedb705c824baf21134839517e63fce98663ccb14447a125543ec27d28c402dcdfc21801a39783a30
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
256KB
-
Filesize
640KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
504KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
256KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB