Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    13/02/2024, 05:19

General

  • Target

    ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe

  • Size

    2.2MB

  • MD5

    7dffee2932057f4ab49f2fb16fc19800

  • SHA1

    f0c4d840fcbb6c7f44d496f4c04bfc8ba88a0b1e

  • SHA256

    ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068

  • SHA512

    cffc028320cef6cefd52cc1260ae1210edafe2fed1873160e8812fd87ecaaf7183c0d0b7c8142704803de5acf9d49b18d58ccb51e1fcc0238f8bf2ee36a9c410

  • SSDEEP

    24576:DfY0lWREGo9z03OivlvI4so5YSY/aQlVqbN5pZMUqJzHKUuRZIhLvHN7oX//j5kp:jbvFZsm18YSYRgrqUqwZIfoX//j5k5h

Malware Config

Signatures

  • Detect ZGRat V1 35 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe
    "C:\Users\Admin\AppData\Local\Temp\ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2324
    • C:\Users\Admin\AppData\Local\Temp\ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe
      C:\Users\Admin\AppData\Local\Temp\ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe
      2⤵
      • Loads dropped DLL
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:2136

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Mvyzfwvwxa.tmp

    Filesize

    148KB

    MD5

    90a1d4b55edf36fa8b4cc6974ed7d4c4

    SHA1

    aba1b8d0e05421e7df5982899f626211c3c4b5c1

    SHA256

    7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

    SHA512

    ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

  • \Users\Admin\AppData\Local\Temp\Costura\1485B29524EF63EB83DF771D39CCA767\64\sqlite.interop.dll

    Filesize

    63KB

    MD5

    f2b304d42c9982ce4b7460b8c93562fa

    SHA1

    c3db56432079650040965e7bacae8f557f31e493

    SHA256

    3864d56892aca3aafdc92962fa43bccfba7cd38715086ed6e14388fcfcd338ef

    SHA512

    70e6859184be8d88fb57a317508e7baa46d08ef50acdec586c9891c18bcf168b650d250f729c2b740d4654ffd8ed0580444929a7663ec5a7066757ad539263ea

  • memory/2136-3435-0x00000000004C0000-0x0000000000540000-memory.dmp

    Filesize

    512KB

  • memory/2136-1130-0x0000000140000000-0x00000001400D6000-memory.dmp

    Filesize

    856KB

  • memory/2136-3404-0x0000000000B30000-0x0000000000BCE000-memory.dmp

    Filesize

    632KB

  • memory/2136-3436-0x000007FEF4D90000-0x000007FEF577C000-memory.dmp

    Filesize

    9.9MB

  • memory/2136-1131-0x000000001AE40000-0x000000001AF54000-memory.dmp

    Filesize

    1.1MB

  • memory/2136-1134-0x00000000004C0000-0x0000000000540000-memory.dmp

    Filesize

    512KB

  • memory/2136-3415-0x000000001AF50000-0x000000001AF75000-memory.dmp

    Filesize

    148KB

  • memory/2136-3411-0x000000001A9D0000-0x000000001AA4A000-memory.dmp

    Filesize

    488KB

  • memory/2136-3412-0x000000001C180000-0x000000001C1EC000-memory.dmp

    Filesize

    432KB

  • memory/2136-3410-0x000007FEF4D90000-0x000007FEF577C000-memory.dmp

    Filesize

    9.9MB

  • memory/2136-3405-0x000000001B940000-0x000000001BB50000-memory.dmp

    Filesize

    2.1MB

  • memory/2136-1132-0x000007FEF4D90000-0x000007FEF577C000-memory.dmp

    Filesize

    9.9MB

  • memory/2324-56-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-20-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-40-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-42-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-46-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-52-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-54-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-58-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-60-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-66-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-64-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-62-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-34-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-50-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-48-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-44-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-36-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-32-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-30-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-26-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-24-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-38-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-14-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-10-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-8-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-4-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-3-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-28-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-22-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-18-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-16-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-12-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-6-0x000000001ADA0000-0x000000001AF0E000-memory.dmp

    Filesize

    1.4MB

  • memory/2324-2-0x000000001ADA0000-0x000000001AF14000-memory.dmp

    Filesize

    1.5MB

  • memory/2324-1-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

    Filesize

    9.9MB

  • memory/2324-0-0x0000000001390000-0x00000000015C8000-memory.dmp

    Filesize

    2.2MB

  • memory/2324-1118-0x0000000000540000-0x0000000000541000-memory.dmp

    Filesize

    4KB

  • memory/2324-1117-0x0000000001100000-0x0000000001180000-memory.dmp

    Filesize

    512KB

  • memory/2324-1120-0x0000000000940000-0x000000000098C000-memory.dmp

    Filesize

    304KB

  • memory/2324-1119-0x000000001B1F0000-0x000000001B2EC000-memory.dmp

    Filesize

    1008KB

  • memory/2324-1128-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

    Filesize

    9.9MB