Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
13/02/2024, 03:13
General
-
Target
8aec0333a0b42c6a717c8a2dc6a2ce2b76dc806c6e1a4816cb51af9c5af55731.exe
-
Size
1.6MB
-
MD5
a2546c042f4e31597a83d5d0732d4730
-
SHA1
214f01f4ef0c65e17fb3a42e43b1315c55c3f0c3
-
SHA256
8aec0333a0b42c6a717c8a2dc6a2ce2b76dc806c6e1a4816cb51af9c5af55731
-
SHA512
af5c23994c9a174efd1ac694dbc4aa2649eb8bb795701c8531d4b53d23a7d14ec9b1470b5250429771e8788c6fe7bf77bde549ee0655318777dc9b4ac7213215
-
SSDEEP
24576:dpvTQJAutjYcQt3icthumBbD73S8GW1VMuAK/vfgGx7Dxeylmwv4SvOnJxKISR:vkqR7CpW1auAufgGFDxeKv/WKV
Malware Config
Signatures
-
Detect ZGRat V1 4 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Detects executables packed with unregistered version of .NET Reactor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8aec0333a0b42c6a717c8a2dc6a2ce2b76dc806c6e1a4816cb51af9c5af55731.exe"C:\Users\Admin\AppData\Local\Temp\8aec0333a0b42c6a717c8a2dc6a2ce2b76dc806c6e1a4816cb51af9c5af55731.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qtlKrWatFJ.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\CbsTemp\unsecapp.exe"C:\Windows\CbsTemp\unsecapp.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:21⤵
-
C:\Windows\system32\chcp.comchcp 650011⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
158KB
MD58f96a55ce8c8891e6eea3539cbb37849
SHA1f7aeb2b9cb25c6a4354b31a9d30262969ba9a16d
SHA2566cbf0e651bb161cfbfe6fcbe3c84502781997b744b0c84b14c99ecb92ea0d989
SHA5120f83c23241a47f1ee42c7c17bc940122a498ff138517fb9e451da19e620534d4fefe2922c12b62e13a63b787e14b71bcff765efc8f81fd9aa9a1506d314f50e9
-
Filesize
207B
MD580b992c1998dae502fe64427d39824df
SHA1ae721cc61fe23b9453de29ae43ee4a71ff00a01a
SHA256ad56ea6425d1cb6533f8ac33fe234bec956488cf3e89e765b8e9dfe37ee70016
SHA512290051c47821589c0f8b8f8f403461d1a56cda9b1e933616d1364be6f5ddfd0071869810cc11aaaef787d14ff1f18c17b6fbed5e46f4d68cdc1131a7f378796d
-
Filesize
1KB
MD5f2ea0cb13ddd1e9e57376f8079d97c06
SHA19a1bd0a9ecaee75a98da3af4ab0265efccff9736
SHA2563ae987d0dbd0b5c55772d077e1412a122d6a5de441ab490ac4865e0e8476e5a5
SHA512ac6ac99f3628bf8d834f114348188aa98f6506344421a4c18f3bc0de2b45fd408c0d248ed7f1e9a459fa63ab36f69637c8a1d6276faa782df507a2ba567a2b9d
-
Filesize
17KB
MD5c73658bb5200a5ff4ba3658fe668766b
SHA19bce8f59c5a2a279f4677b0fb3ab86a162a11ff5
SHA25646ccd3f60cf5d53b836890993b724c3e45154bc5e9cb7ddb75555d4ddf827b74
SHA512d9f9c6257abdba9f7eb563231a4acc686d2f80035037571e513bde20bd87626cdd9961bb2eec9d12c13c9d94b9be482ce25ce9def9dd94147c5a7ca5f2e81f3d
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1.6MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB