Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 04:08
Behavioral task
behavioral1
Sample
cb49adf3033abe1d446541a2b216b7cc9f50cd74494ec7d78dd365c952d3487b.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
cb49adf3033abe1d446541a2b216b7cc9f50cd74494ec7d78dd365c952d3487b.exe
-
Size
5.9MB
-
MD5
d21ebfa5e971bb5293c9de7a404792a1
-
SHA1
850cae6b28d100738547f8a86889d71ff5289073
-
SHA256
cb49adf3033abe1d446541a2b216b7cc9f50cd74494ec7d78dd365c952d3487b
-
SHA512
2fe8f296117e70a05fa24f0be9250fff84af339eed1bfe46d1c218a0210324b9e0f77ddaf6ad518eca8370fc3023238f7fa13f483f30c545c10fc2e02f973a6f
-
SSDEEP
49152:VdFCDWU2GG8XKQ3/cdt4osAZo5+cSAsAUSNlLOg/L1Jf2jTiQ/VoJu4E9/+j9Z29:VnCDL2uKecbO4ihsAUoDjj233NmmcPK7
Malware Config
Extracted
Family
gozi
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule behavioral1/memory/2240-1-0x00000000002F0000-0x00000000008D2000-memory.dmp family_zgrat_v1 -
Program crash 1 IoCs
pid pid_target Process procid_target 2644 2240 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2644 2240 cb49adf3033abe1d446541a2b216b7cc9f50cd74494ec7d78dd365c952d3487b.exe 28 PID 2240 wrote to memory of 2644 2240 cb49adf3033abe1d446541a2b216b7cc9f50cd74494ec7d78dd365c952d3487b.exe 28 PID 2240 wrote to memory of 2644 2240 cb49adf3033abe1d446541a2b216b7cc9f50cd74494ec7d78dd365c952d3487b.exe 28 PID 2240 wrote to memory of 2644 2240 cb49adf3033abe1d446541a2b216b7cc9f50cd74494ec7d78dd365c952d3487b.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb49adf3033abe1d446541a2b216b7cc9f50cd74494ec7d78dd365c952d3487b.exe"C:\Users\Admin\AppData\Local\Temp\cb49adf3033abe1d446541a2b216b7cc9f50cd74494ec7d78dd365c952d3487b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 5802⤵
- Program crash
PID:2644
-