Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12/01/2024, 13:26

General

  • Target

    90761d7a9ac41a9602b7094663921f42.exe

  • Size

    5.0MB

  • MD5

    90761d7a9ac41a9602b7094663921f42

  • SHA1

    eb2357f00f922719f261a97ca1f4350a7c3d168a

  • SHA256

    29f281cac20928673a516da70a1495cf217aea2dc386d7719de2df7c2053fb9d

  • SHA512

    2e5981e6a38b2b2b4f036f3056c818834160018d97a9393f7d461890fe51f0030ac2c3322c2421abc707e20ee01392bbf3058d9bba77e95ab7facfbed55cdda0

  • SSDEEP

    49152:bWgm+tevgmkSG2srQHYNGFF0v9AUKoXjuqqn0F2TmoGwHP2px3V:bWgmsevgm+QQFvDXFqXRDOrV

Score
10/10

Malware Config

Signatures

  • Detect Vidar Stealer 8 IoCs
  • Detect ZGRat V1 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\90761d7a9ac41a9602b7094663921f42.exe
    "C:\Users\Admin\AppData\Local\Temp\90761d7a9ac41a9602b7094663921f42.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2336
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      2⤵
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:2704
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 1464
        3⤵
        • Program crash
        PID:2440

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CabE8CB.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\TarE90D.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • \Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

    Filesize

    742KB

    MD5

    544cd51a596619b78e9b54b70088307d

    SHA1

    4769ddd2dbc1dc44b758964ed0bd231b85880b65

    SHA256

    dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

    SHA512

    f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

  • memory/2336-17-0x0000000000A90000-0x0000000000AD0000-memory.dmp

    Filesize

    256KB

  • memory/2336-13-0x0000000000A90000-0x0000000000AD0000-memory.dmp

    Filesize

    256KB

  • memory/2336-5-0x0000000006AB0000-0x0000000006C42000-memory.dmp

    Filesize

    1.6MB

  • memory/2336-3-0x0000000000A90000-0x0000000000AD0000-memory.dmp

    Filesize

    256KB

  • memory/2336-10-0x0000000000A90000-0x0000000000AD0000-memory.dmp

    Filesize

    256KB

  • memory/2336-11-0x0000000000A90000-0x0000000000AD0000-memory.dmp

    Filesize

    256KB

  • memory/2336-12-0x0000000000980000-0x0000000000990000-memory.dmp

    Filesize

    64KB

  • memory/2336-35-0x00000000743D0000-0x0000000074ABE000-memory.dmp

    Filesize

    6.9MB

  • memory/2336-14-0x0000000000A90000-0x0000000000AD0000-memory.dmp

    Filesize

    256KB

  • memory/2336-15-0x0000000000A90000-0x0000000000AD0000-memory.dmp

    Filesize

    256KB

  • memory/2336-16-0x0000000006F20000-0x0000000007020000-memory.dmp

    Filesize

    1024KB

  • memory/2336-1-0x00000000743D0000-0x0000000074ABE000-memory.dmp

    Filesize

    6.9MB

  • memory/2336-18-0x0000000000A90000-0x0000000000AD0000-memory.dmp

    Filesize

    256KB

  • memory/2336-4-0x0000000005470000-0x0000000005696000-memory.dmp

    Filesize

    2.1MB

  • memory/2336-0-0x00000000003D0000-0x00000000008CE000-memory.dmp

    Filesize

    5.0MB

  • memory/2336-2-0x00000000743D0000-0x0000000074ABE000-memory.dmp

    Filesize

    6.9MB

  • memory/2704-19-0x0000000000400000-0x000000000065E000-memory.dmp

    Filesize

    2.4MB

  • memory/2704-27-0x0000000000400000-0x000000000065E000-memory.dmp

    Filesize

    2.4MB

  • memory/2704-29-0x0000000000400000-0x000000000065E000-memory.dmp

    Filesize

    2.4MB

  • memory/2704-33-0x0000000000400000-0x000000000065E000-memory.dmp

    Filesize

    2.4MB

  • memory/2704-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2704-36-0x0000000000400000-0x000000000065E000-memory.dmp

    Filesize

    2.4MB

  • memory/2704-25-0x0000000000400000-0x000000000065E000-memory.dmp

    Filesize

    2.4MB

  • memory/2704-38-0x0000000000400000-0x000000000065E000-memory.dmp

    Filesize

    2.4MB

  • memory/2704-39-0x0000000000400000-0x000000000065E000-memory.dmp

    Filesize

    2.4MB

  • memory/2704-23-0x0000000000400000-0x000000000065E000-memory.dmp

    Filesize

    2.4MB

  • memory/2704-21-0x0000000000400000-0x000000000065E000-memory.dmp

    Filesize

    2.4MB

  • memory/2704-165-0x0000000000400000-0x000000000065E000-memory.dmp

    Filesize

    2.4MB