Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13/02/2024, 05:19
Static task
static1
Behavioral task
behavioral1
Sample
ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe
Resource
win10v2004-20231215-en
General
-
Target
ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe
-
Size
2.2MB
-
MD5
7dffee2932057f4ab49f2fb16fc19800
-
SHA1
f0c4d840fcbb6c7f44d496f4c04bfc8ba88a0b1e
-
SHA256
ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068
-
SHA512
cffc028320cef6cefd52cc1260ae1210edafe2fed1873160e8812fd87ecaaf7183c0d0b7c8142704803de5acf9d49b18d58ccb51e1fcc0238f8bf2ee36a9c410
-
SSDEEP
24576:DfY0lWREGo9z03OivlvI4so5YSY/aQlVqbN5pZMUqJzHKUuRZIhLvHN7oX//j5kp:jbvFZsm18YSYRgrqUqwZIfoX//j5k5h
Malware Config
Signatures
-
Detect ZGRat V1 35 IoCs
resource yara_rule behavioral1/memory/2324-2-0x000000001ADA0000-0x000000001AF14000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-6-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-12-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-16-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-18-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-22-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-28-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-34-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-38-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-40-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-42-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-46-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-52-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-54-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-58-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-60-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-66-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-64-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-62-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-56-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-50-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-48-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-44-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-36-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-32-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-30-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-26-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-24-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-20-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-14-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-10-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-8-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-4-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2324-3-0x000000001ADA0000-0x000000001AF0E000-memory.dmp family_zgrat_v1 behavioral1/memory/2136-1134-0x00000000004C0000-0x0000000000540000-memory.dmp family_zgrat_v1 -
Loads dropped DLL 1 IoCs
pid Process 2136 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key queried \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key queried \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key opened \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key queried \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key queried \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key queried \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key queried \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key opened \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key queried \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key queried \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key opened \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key queried \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key opened \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key opened \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key opened \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key queried \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key queried \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key queried \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key queried \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Key opened \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2324 set thread context of 2136 2324 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe 28 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2136 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe 2136 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2324 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe Token: SeDebugPrivilege 2136 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2136 2324 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe 28 PID 2324 wrote to memory of 2136 2324 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe 28 PID 2324 wrote to memory of 2136 2324 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe 28 PID 2324 wrote to memory of 2136 2324 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe 28 PID 2324 wrote to memory of 2136 2324 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe 28 PID 2324 wrote to memory of 2136 2324 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe 28 PID 2324 wrote to memory of 2136 2324 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe 28 -
outlook_office_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe -
outlook_win_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe"C:\Users\Admin\AppData\Local\Temp\ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exeC:\Users\Admin\AppData\Local\Temp\ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe2⤵
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2136
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148KB
MD590a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA2567cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
-
Filesize
63KB
MD5f2b304d42c9982ce4b7460b8c93562fa
SHA1c3db56432079650040965e7bacae8f557f31e493
SHA2563864d56892aca3aafdc92962fa43bccfba7cd38715086ed6e14388fcfcd338ef
SHA51270e6859184be8d88fb57a317508e7baa46d08ef50acdec586c9891c18bcf168b650d250f729c2b740d4654ffd8ed0580444929a7663ec5a7066757ad539263ea