Analysis
-
max time kernel
149s -
max time network
158s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
19/03/2024, 18:54
General
-
Target
86e049daa876c917a7d59c8a0caca8f5d923961757a903b19cba9354030b4cdd.exe
-
Size
528KB
-
MD5
d3081931ae674d28330dc968d1bd8751
-
SHA1
eae6a4c6a3929a1490e876df57ba52069f27f373
-
SHA256
86e049daa876c917a7d59c8a0caca8f5d923961757a903b19cba9354030b4cdd
-
SHA512
4311972df6f9531159545ba7c25943d39c016eccf4e9214ae8d78da9d0ceda3a890f56b41519eca15b424a79be6dc3642dc4c193ad9272926d009ea1b1855b39
-
SSDEEP
12288:jhhaFzdCwByFw2JYqnkWGua2kmIM2koOVq0rM/izQkr:jhha6o2JhGpWX2eZrTr
Malware Config
Signatures
-
Detect ZGRat V1 34 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 52 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\86e049daa876c917a7d59c8a0caca8f5d923961757a903b19cba9354030b4cdd.exe"C:\Users\Admin\AppData\Local\Temp\86e049daa876c917a7d59c8a0caca8f5d923961757a903b19cba9354030b4cdd.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA1AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 5 /tn end2 /tr "powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load((Get-ItemProperty HKCU:\Software\end2\).end2).EntryPoint.Invoke($Null,$Null)"2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
544KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
312KB
-
Filesize
304KB
-
Filesize
336KB
-
Filesize
64KB
-
Filesize
64KB