Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    13/02/2024, 02:24

General

  • Target

    0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe

  • Size

    8.8MB

  • MD5

    0bba32660d3323f8cdf71a4b2ae25738

  • SHA1

    48ad23aa2767d45fd51c00ee165cef4dd1f9e7ae

  • SHA256

    0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad

  • SHA512

    535ad86843a0a1807117e7cd059bc6565fa20685aa0a14ded789e6df42f0467242fbb85cf7b17a5e98eb3c9ba34c46b4b9fa65350c6730092e905bef9f6738c5

  • SSDEEP

    196608:ymfI8mgWLU16Uwg55LasSW4yIK1ni4+YW/3T9xU:ykmlw4mL/SNKdPMbU

Score
10/10

Malware Config

Signatures

  • Detect ZGRat V1 34 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe
    "C:\Users\Admin\AppData\Local\Temp\0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMAA4ADEANwBjAGYAMwA0AGIAMABkAGQANwBiAGUAYwA3ADMAOAA4ADEANQA5AGEAYwA5AGIANgBhADEANgBhAGMANwA4ADkAOABjAGYAMgA0ADMAYwAwADAAOQAwAGQAOQAzADUAYgBmADgAOQAyADQANwAyADkANAAzAGEAZAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAMAA4ADEANwBjAGYAMwA0AGIAMABkAGQANwBiAGUAYwA3ADMAOAA4ADEANQA5AGEAYwA5AGIANgBhADEANgBhAGMANwA4ADkAOABjAGYAMgA0ADMAYwAwADAAOQAwAGQAOQAzADUAYgBmADgAOQAyADQANwAyADkANAAzAGEAZAAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVgBkAHQAaQB5AHQAZABsAHMAZwBqAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABWAGQAdABpAHkAdABkAGwAcwBnAGoALgBlAHgAZQA=
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1416
    • C:\Users\Admin\AppData\Local\Temp\0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe
      C:\Users\Admin\AppData\Local\Temp\0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe
      2⤵
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1628
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        3⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1064
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1992
      • C:\Windows\explorer.exe
        explorer.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1900
  • C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    1⤵
    • Drops file in Windows directory
    PID:2536

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    ddb4898dc5863fa5110b3dd733c4a325

    SHA1

    c16b364d05faad380a1ecda52422b80c70e8eb82

    SHA256

    e44cef2ab5803cd9ecda4c8f16a018a7200ef9f45aae40fbfd1bdf7b1674e837

    SHA512

    1a8d0f0f059e9dd3d368eb5791be7fcb9bf55baf33148082e480735e1fef4d8c96beb2be2f6188a37beb1f9a50cc2e0e8dc0d9845d3a519d043812ee03081347

  • memory/1064-976-0x0000000001D60000-0x0000000001D68000-memory.dmp

    Filesize

    32KB

  • memory/1064-974-0x000000001B410000-0x000000001B6F2000-memory.dmp

    Filesize

    2.9MB

  • memory/1064-977-0x00000000026C0000-0x0000000002740000-memory.dmp

    Filesize

    512KB

  • memory/1064-981-0x000007FEF59E0000-0x000007FEF637D000-memory.dmp

    Filesize

    9.6MB

  • memory/1064-980-0x00000000026C0000-0x0000000002740000-memory.dmp

    Filesize

    512KB

  • memory/1064-975-0x000007FEF59E0000-0x000007FEF637D000-memory.dmp

    Filesize

    9.6MB

  • memory/1064-979-0x00000000026C0000-0x0000000002740000-memory.dmp

    Filesize

    512KB

  • memory/1064-978-0x000007FEF59E0000-0x000007FEF637D000-memory.dmp

    Filesize

    9.6MB

  • memory/1416-952-0x000007FEEED00000-0x000007FEEF69D000-memory.dmp

    Filesize

    9.6MB

  • memory/1416-945-0x000000001B680000-0x000000001B962000-memory.dmp

    Filesize

    2.9MB

  • memory/1416-951-0x0000000002E20000-0x0000000002EA0000-memory.dmp

    Filesize

    512KB

  • memory/1416-950-0x0000000002E20000-0x0000000002EA0000-memory.dmp

    Filesize

    512KB

  • memory/1416-949-0x000007FEEED00000-0x000007FEEF69D000-memory.dmp

    Filesize

    9.6MB

  • memory/1416-948-0x0000000002E20000-0x0000000002EA0000-memory.dmp

    Filesize

    512KB

  • memory/1416-947-0x000007FEEED00000-0x000007FEEF69D000-memory.dmp

    Filesize

    9.6MB

  • memory/1416-946-0x0000000001F50000-0x0000000001F58000-memory.dmp

    Filesize

    32KB

  • memory/1628-968-0x0000000140000000-0x0000000140C9E000-memory.dmp

    Filesize

    12.6MB

  • memory/1628-995-0x0000000140000000-0x0000000140C9E000-memory.dmp

    Filesize

    12.6MB

  • memory/1900-1003-0x00000000003D0000-0x00000000003F0000-memory.dmp

    Filesize

    128KB

  • memory/1900-1004-0x00000000003D0000-0x00000000003F0000-memory.dmp

    Filesize

    128KB

  • memory/2276-27-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-37-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-41-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-43-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-45-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-47-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-49-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-51-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-53-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-55-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-57-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-59-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-61-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-63-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-65-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-67-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-755-0x000007FEF5990000-0x000007FEF637C000-memory.dmp

    Filesize

    9.9MB

  • memory/2276-937-0x000000001C5A0000-0x000000001C620000-memory.dmp

    Filesize

    512KB

  • memory/2276-938-0x00000000005D0000-0x00000000005D1000-memory.dmp

    Filesize

    4KB

  • memory/2276-939-0x000000001E500000-0x000000001ED5A000-memory.dmp

    Filesize

    8.4MB

  • memory/2276-940-0x00000000009F0000-0x0000000000A3C000-memory.dmp

    Filesize

    304KB

  • memory/2276-39-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-35-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-33-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-31-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-29-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-0-0x0000000000E90000-0x000000000175E000-memory.dmp

    Filesize

    8.8MB

  • memory/2276-25-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-23-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-966-0x000007FEF5990000-0x000007FEF637C000-memory.dmp

    Filesize

    9.9MB

  • memory/2276-21-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-19-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-17-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-15-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-13-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-11-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-9-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-7-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-5-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-4-0x000000001CA30000-0x000000001D2EE000-memory.dmp

    Filesize

    8.7MB

  • memory/2276-3-0x000000001CA30000-0x000000001D2F4000-memory.dmp

    Filesize

    8.8MB

  • memory/2276-2-0x000000001C5A0000-0x000000001C620000-memory.dmp

    Filesize

    512KB

  • memory/2276-1-0x000007FEF5990000-0x000007FEF637C000-memory.dmp

    Filesize

    9.9MB