Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2024, 16:28
Static task
static1
Behavioral task
behavioral1
Sample
68192cd81726cf9ea4a4187ec0111113.exe
Resource
win7-20231215-en
General
-
Target
68192cd81726cf9ea4a4187ec0111113.exe
-
Size
6.5MB
-
MD5
68192cd81726cf9ea4a4187ec0111113
-
SHA1
46d0eb7842be68a5f625ed927fa6a91715af416b
-
SHA256
fec4a46308f73f3e49401fa24256a58fdd596f57eee6f29d3336c2b072abda6d
-
SHA512
bb176584a61b334673e457a1b5c598149ead38785e827d4b2f0348c8f4138a60dceeb9e4a7f7724a50fd32a3440e49e80d97575d091cfb9c991bf8bca576e156
-
SSDEEP
196608:LoWCHVU8Bi7PPbLAi80f/TiCjPTpPF2bzH0D1:Mz2Pgipr8bQp
Malware Config
Signatures
-
Detect ZGRat V1 35 IoCs
resource yara_rule behavioral2/memory/4616-5-0x000000001DE20000-0x000000001DE92000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-7-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-17-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-33-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-43-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-41-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-57-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-69-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-67-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-65-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-63-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-61-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-59-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-55-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-53-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-51-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-49-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-47-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-45-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-39-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-37-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-35-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-31-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-29-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-27-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-25-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-23-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-21-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-19-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-15-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-13-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-11-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-9-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/4616-6-0x000000001DE20000-0x000000001DE8C000-memory.dmp family_zgrat_v1 behavioral2/memory/3624-2184-0x000000001E350000-0x000000001E990000-memory.dmp family_zgrat_v1 -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation 68192cd81726cf9ea4a4187ec0111113.exe Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation 68192cd81726cf9ea4a4187ec0111113.exe Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation WScript.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4616 set thread context of 3624 4616 68192cd81726cf9ea4a4187ec0111113.exe 99 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000_Classes\Local Settings 68192cd81726cf9ea4a4187ec0111113.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4616 68192cd81726cf9ea4a4187ec0111113.exe 4616 68192cd81726cf9ea4a4187ec0111113.exe 4932 powershell.exe 4932 powershell.exe 4064 powershell.exe 4064 powershell.exe 2608 powershell.exe 2608 powershell.exe 5748 powershell.exe 5748 powershell.exe 5380 powershell.exe 5380 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4616 68192cd81726cf9ea4a4187ec0111113.exe Token: SeDebugPrivilege 4932 powershell.exe Token: SeDebugPrivilege 4064 powershell.exe Token: SeIncreaseQuotaPrivilege 4064 powershell.exe Token: SeSecurityPrivilege 4064 powershell.exe Token: SeTakeOwnershipPrivilege 4064 powershell.exe Token: SeLoadDriverPrivilege 4064 powershell.exe Token: SeSystemProfilePrivilege 4064 powershell.exe Token: SeSystemtimePrivilege 4064 powershell.exe Token: SeProfSingleProcessPrivilege 4064 powershell.exe Token: SeIncBasePriorityPrivilege 4064 powershell.exe Token: SeCreatePagefilePrivilege 4064 powershell.exe Token: SeBackupPrivilege 4064 powershell.exe Token: SeRestorePrivilege 4064 powershell.exe Token: SeShutdownPrivilege 4064 powershell.exe Token: SeDebugPrivilege 4064 powershell.exe Token: SeSystemEnvironmentPrivilege 4064 powershell.exe Token: SeRemoteShutdownPrivilege 4064 powershell.exe Token: SeUndockPrivilege 4064 powershell.exe Token: SeManageVolumePrivilege 4064 powershell.exe Token: 33 4064 powershell.exe Token: 34 4064 powershell.exe Token: 35 4064 powershell.exe Token: 36 4064 powershell.exe Token: SeIncreaseQuotaPrivilege 4064 powershell.exe Token: SeSecurityPrivilege 4064 powershell.exe Token: SeTakeOwnershipPrivilege 4064 powershell.exe Token: SeLoadDriverPrivilege 4064 powershell.exe Token: SeSystemProfilePrivilege 4064 powershell.exe Token: SeSystemtimePrivilege 4064 powershell.exe Token: SeProfSingleProcessPrivilege 4064 powershell.exe Token: SeIncBasePriorityPrivilege 4064 powershell.exe Token: SeCreatePagefilePrivilege 4064 powershell.exe Token: SeBackupPrivilege 4064 powershell.exe Token: SeRestorePrivilege 4064 powershell.exe Token: SeShutdownPrivilege 4064 powershell.exe Token: SeDebugPrivilege 4064 powershell.exe Token: SeSystemEnvironmentPrivilege 4064 powershell.exe Token: SeRemoteShutdownPrivilege 4064 powershell.exe Token: SeUndockPrivilege 4064 powershell.exe Token: SeManageVolumePrivilege 4064 powershell.exe Token: 33 4064 powershell.exe Token: 34 4064 powershell.exe Token: 35 4064 powershell.exe Token: 36 4064 powershell.exe Token: SeDebugPrivilege 2608 powershell.exe Token: SeIncreaseQuotaPrivilege 2608 powershell.exe Token: SeSecurityPrivilege 2608 powershell.exe Token: SeTakeOwnershipPrivilege 2608 powershell.exe Token: SeLoadDriverPrivilege 2608 powershell.exe Token: SeSystemProfilePrivilege 2608 powershell.exe Token: SeSystemtimePrivilege 2608 powershell.exe Token: SeProfSingleProcessPrivilege 2608 powershell.exe Token: SeIncBasePriorityPrivilege 2608 powershell.exe Token: SeCreatePagefilePrivilege 2608 powershell.exe Token: SeBackupPrivilege 2608 powershell.exe Token: SeRestorePrivilege 2608 powershell.exe Token: SeShutdownPrivilege 2608 powershell.exe Token: SeDebugPrivilege 2608 powershell.exe Token: SeSystemEnvironmentPrivilege 2608 powershell.exe Token: SeRemoteShutdownPrivilege 2608 powershell.exe Token: SeUndockPrivilege 2608 powershell.exe Token: SeManageVolumePrivilege 2608 powershell.exe Token: 33 2608 powershell.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4616 wrote to memory of 2992 4616 68192cd81726cf9ea4a4187ec0111113.exe 98 PID 4616 wrote to memory of 2992 4616 68192cd81726cf9ea4a4187ec0111113.exe 98 PID 4616 wrote to memory of 3624 4616 68192cd81726cf9ea4a4187ec0111113.exe 99 PID 4616 wrote to memory of 3624 4616 68192cd81726cf9ea4a4187ec0111113.exe 99 PID 4616 wrote to memory of 3624 4616 68192cd81726cf9ea4a4187ec0111113.exe 99 PID 4616 wrote to memory of 3624 4616 68192cd81726cf9ea4a4187ec0111113.exe 99 PID 4616 wrote to memory of 3624 4616 68192cd81726cf9ea4a4187ec0111113.exe 99 PID 4616 wrote to memory of 3624 4616 68192cd81726cf9ea4a4187ec0111113.exe 99 PID 2992 wrote to memory of 4932 2992 WScript.exe 100 PID 2992 wrote to memory of 4932 2992 WScript.exe 100 PID 3624 wrote to memory of 4064 3624 68192cd81726cf9ea4a4187ec0111113.exe 103 PID 3624 wrote to memory of 4064 3624 68192cd81726cf9ea4a4187ec0111113.exe 103 PID 3624 wrote to memory of 2608 3624 68192cd81726cf9ea4a4187ec0111113.exe 105 PID 3624 wrote to memory of 2608 3624 68192cd81726cf9ea4a4187ec0111113.exe 105 PID 3624 wrote to memory of 5748 3624 68192cd81726cf9ea4a4187ec0111113.exe 107 PID 3624 wrote to memory of 5748 3624 68192cd81726cf9ea4a4187ec0111113.exe 107 PID 3624 wrote to memory of 5380 3624 68192cd81726cf9ea4a4187ec0111113.exe 109 PID 3624 wrote to memory of 5380 3624 68192cd81726cf9ea4a4187ec0111113.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\68192cd81726cf9ea4a4187ec0111113.exe"C:\Users\Admin\AppData\Local\Temp\68192cd81726cf9ea4a4187ec0111113.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Tahnlcisc.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Adobe\Photoshop.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4932
-
-
-
C:\Users\Admin\AppData\Local\Temp\68192cd81726cf9ea4a4187ec0111113.exeC:\Users\Admin\AppData\Local\Temp\68192cd81726cf9ea4a4187ec0111113.exe2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com -Count 2 -BufferSize 128 -Delay 13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4064
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com -Count 2 -BufferSize 128 -Delay 13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com -Count 2 -BufferSize 128 -Delay 13⤵
- Suspicious behavior: EnumeratesProcesses
PID:5748
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com -Count 2 -BufferSize 128 -Delay 13⤵
- Suspicious behavior: EnumeratesProcesses
PID:5380
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
1KB
MD5001b5ca3131838b946bf3b18f9a37fc6
SHA12cdc06a3072cbd8b16d1e2419badef6e2ee9ef13
SHA2563288a17c0827bcd300cd704130ff72c56d31a23d1759eeebe2f1139425fe747a
SHA5128985764d7a99d7fe87ca34623debe5772c25df0cb3b19be0a484864dddd816d940e90f15d35bcaa79abe23bc6bf88f23ed3fadd816091a9f0f4389dc56c885af
-
Filesize
1KB
MD5d096831023867930e62e6d8b3d4d8ca6
SHA1404a1e73dc1590f1c8b9327c396591567dac7365
SHA256167f75b42ae614a8d6b0497779ff12f09605328533487f235b029e0db03ad23b
SHA51231333100ddd8e04bf730118ea800843720c0f3fb69e27b89dda7fa4d717d25e838ad55a0919d47a44dd8a78d724ef8c105cfa230987cc46ba94a2b790ff91b75
-
Filesize
183B
MD5596240d6e4b9636d4ff251f7d88d2fbc
SHA133a51f0eaed1b0ab24463d88a32a44bb343eea92
SHA256ac3eca9ee79b5494e2099ac1f7a6e6d018352c615a871aa1ff43d0ace2c1dad9
SHA51287a8313d20cbc9b5cff506d260c718fec9586f4f9d4ed421058cb3d386fe6e28b52fc106717d1afc0306bf4f2d2ee763fe461121f62d70213b30b08016610ce6
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82