Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
15-03-2024 03:25
Static task
static1
Behavioral task
behavioral1
Sample
ca5cb50618d8df2b8f67fb562d535a1b.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ca5cb50618d8df2b8f67fb562d535a1b.exe
Resource
win10v2004-20240226-en
General
-
Target
ca5cb50618d8df2b8f67fb562d535a1b.exe
-
Size
2.8MB
-
MD5
ca5cb50618d8df2b8f67fb562d535a1b
-
SHA1
e648d0dc065cd1d017f805dc29e5e26ee65c8273
-
SHA256
cdfe884cee1ae053d17300dfe2ddc89e21371fe4fea96d1102069685a9e71f56
-
SHA512
942467e68ae0f765d72377ef4698c56d9cc2b799894db85ecfe03bd77d0b5df8a3896623d12b6c0862ceb2e236c25d8a1962d4f07a2d7985af57a5f5b37e118c
-
SSDEEP
49152:uE/UJ104hpI+JOK1DCSnpCsVhwie8rqk8T:DT
Malware Config
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral1/memory/3068-4-0x0000000000950000-0x00000000009CC000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-5-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-6-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-8-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-10-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-12-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-14-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-16-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-18-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-26-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-24-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-22-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-28-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-20-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-30-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-34-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-36-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-32-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-38-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-40-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-42-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-57-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-59-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-55-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-67-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-69-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-65-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-63-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-61-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-53-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-51-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-49-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-47-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 behavioral1/memory/3068-45-0x0000000000950000-0x00000000009C5000-memory.dmp family_zgrat_v1 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ca5cb50618d8df2b8f67fb562d535a1b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\jusched = "\"C:\\Users\\Admin\\AppData\\Roaming\\jusched.exe\"" ca5cb50618d8df2b8f67fb562d535a1b.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
ca5cb50618d8df2b8f67fb562d535a1b.exepid process 2332 ca5cb50618d8df2b8f67fb562d535a1b.exe 2332 ca5cb50618d8df2b8f67fb562d535a1b.exe 2332 ca5cb50618d8df2b8f67fb562d535a1b.exe 2332 ca5cb50618d8df2b8f67fb562d535a1b.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ca5cb50618d8df2b8f67fb562d535a1b.exedescription pid process target process PID 3068 set thread context of 2332 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
ca5cb50618d8df2b8f67fb562d535a1b.exepid process 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
ca5cb50618d8df2b8f67fb562d535a1b.execa5cb50618d8df2b8f67fb562d535a1b.exedescription pid process Token: SeDebugPrivilege 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe Token: SeDebugPrivilege 2332 ca5cb50618d8df2b8f67fb562d535a1b.exe Token: SeShutdownPrivilege 2332 ca5cb50618d8df2b8f67fb562d535a1b.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ca5cb50618d8df2b8f67fb562d535a1b.exepid process 2332 ca5cb50618d8df2b8f67fb562d535a1b.exe 2332 ca5cb50618d8df2b8f67fb562d535a1b.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
ca5cb50618d8df2b8f67fb562d535a1b.exeWScript.exedescription pid process target process PID 3068 wrote to memory of 1972 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe WScript.exe PID 3068 wrote to memory of 1972 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe WScript.exe PID 3068 wrote to memory of 1972 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe WScript.exe PID 3068 wrote to memory of 1972 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe WScript.exe PID 1972 wrote to memory of 2912 1972 WScript.exe powershell.exe PID 1972 wrote to memory of 2912 1972 WScript.exe powershell.exe PID 1972 wrote to memory of 2912 1972 WScript.exe powershell.exe PID 1972 wrote to memory of 2912 1972 WScript.exe powershell.exe PID 3068 wrote to memory of 1636 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe PID 3068 wrote to memory of 1636 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe PID 3068 wrote to memory of 1636 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe PID 3068 wrote to memory of 1636 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe PID 3068 wrote to memory of 1636 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe PID 3068 wrote to memory of 1636 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe PID 3068 wrote to memory of 1636 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe PID 3068 wrote to memory of 2332 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe PID 3068 wrote to memory of 2332 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe PID 3068 wrote to memory of 2332 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe PID 3068 wrote to memory of 2332 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe PID 3068 wrote to memory of 2332 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe PID 3068 wrote to memory of 2332 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe PID 3068 wrote to memory of 2332 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe PID 3068 wrote to memory of 2332 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe PID 3068 wrote to memory of 2332 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe PID 3068 wrote to memory of 2332 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe PID 3068 wrote to memory of 2332 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe PID 3068 wrote to memory of 2332 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe PID 3068 wrote to memory of 2332 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe PID 3068 wrote to memory of 2332 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe PID 3068 wrote to memory of 2332 3068 ca5cb50618d8df2b8f67fb562d535a1b.exe ca5cb50618d8df2b8f67fb562d535a1b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca5cb50618d8df2b8f67fb562d535a1b.exe"C:\Users\Admin\AppData\Local\Temp\ca5cb50618d8df2b8f67fb562d535a1b.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Bhvohqh.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\jusched.exe'3⤵
-
C:\Users\Admin\AppData\Local\Temp\ca5cb50618d8df2b8f67fb562d535a1b.exeC:\Users\Admin\AppData\Local\Temp\ca5cb50618d8df2b8f67fb562d535a1b.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\ca5cb50618d8df2b8f67fb562d535a1b.exeC:\Users\Admin\AppData\Local\Temp\ca5cb50618d8df2b8f67fb562d535a1b.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_Bhvohqh.vbsFilesize
137B
MD554dbeebd94ab33ba092390548db30f03
SHA1d08403310ce5c5f36439409d727a9ab74c9b7cdb
SHA256cfa50535cc06ef74329b8b2b3610fcd8d6fe629ae0637b6ecdf3b05b55f723d7
SHA5126b832b2303a0af4fd2e7cd962517d93df47ab6b3ba3b72c464e5d30698c54dbca343cff373649bce064265e0fc35bc10b78d0530f30a90fe382091e60d51b864
-
memory/3068-36-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-10-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-3-0x0000000007E60000-0x0000000008072000-memory.dmpFilesize
2.1MB
-
memory/3068-32-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-5-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-40-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-8-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-38-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-12-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-14-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-16-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-18-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-26-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-24-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-22-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-28-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-20-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-30-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-34-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-0-0x0000000000F60000-0x0000000001234000-memory.dmpFilesize
2.8MB
-
memory/3068-4-0x0000000000950000-0x00000000009CC000-memory.dmpFilesize
496KB
-
memory/3068-2-0x0000000000A90000-0x0000000000AD0000-memory.dmpFilesize
256KB
-
memory/3068-6-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-42-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-57-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-59-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-55-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-67-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-69-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-65-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-63-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-61-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-53-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-51-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-49-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-47-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-45-0x0000000000950000-0x00000000009C5000-memory.dmpFilesize
468KB
-
memory/3068-44-0x00000000745A0000-0x0000000074C8E000-memory.dmpFilesize
6.9MB
-
memory/3068-2336-0x0000000000A90000-0x0000000000AD0000-memory.dmpFilesize
256KB
-
memory/3068-1-0x00000000745A0000-0x0000000074C8E000-memory.dmpFilesize
6.9MB
-
memory/3068-2358-0x00000000745A0000-0x0000000074C8E000-memory.dmpFilesize
6.9MB