Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
29/03/2024, 02:00
General
-
Target
0412820e4dacf521808629f37fff8e32aa554c0d9096b7800921c8ae1cfcb0c5.exe
-
Size
5.1MB
-
MD5
71ee7a0d612a6530ccfd22c79bbf0695
-
SHA1
0e7413e80de750d661c132a0dd88c014dbfd2398
-
SHA256
0412820e4dacf521808629f37fff8e32aa554c0d9096b7800921c8ae1cfcb0c5
-
SHA512
0cf425fcb5468f16cf79b080e48de65918608842c38a194ce847f7624e66a5b2ede586dc5246ce4460ed006ec5058d4e659079a393914a6adee0e5e643347e0a
-
SSDEEP
98304:2rHq3FSVIErWayHeVd0q2rVMPMKhV83eZe/LFx:2jqVSVKH0d0q2rfP3lr
Malware Config
Signatures
-
Detect ZGRat V1 35 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0412820e4dacf521808629f37fff8e32aa554c0d9096b7800921c8ae1cfcb0c5.exe"C:\Users\Admin\AppData\Local\Temp\0412820e4dacf521808629f37fff8e32aa554c0d9096b7800921c8ae1cfcb0c5.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Vbcmzog.exe"C:\Users\Admin\AppData\Local\Temp\Vbcmzog.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {CC120FE5-F5FC-48AA-B0D6-038DAEA1C03C} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:S4U:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAQwB1AHIAcgBlAG4AdABcAEEAYwB0AGkAdgBhAHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuAGUAeABlACwAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAgAC0ARgBvAHIAYwBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAsAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAQwB1AHIAcgBlAG4AdABcAEEAYwB0AGkAdgBhAHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuAGUAeABlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {9370C1F4-7E1A-47A5-BF2E-3BEEAEAF2C80} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Current\ActivationContext.exeC:\Users\Admin\AppData\Roaming\Current\ActivationContext.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
837KB
MD5ec0362e81436b8e7cccb93fa43220fdb
SHA1f4d7b2d844f995c8466aa13ff2f17aab052e14bc
SHA2563e4d82399a8774a79b23814dcae1ce2e38ac565241f0d78e6473269705d2d96c
SHA512cdd02d02cab7fc9ba7c7fab35cc35cbb29b2a40dbbf999dc2222c6449bb70522d91132c7476cb867e7320266d630b1f9d0541d11a076a64f00e426cb342e5700
-
Filesize
5.1MB
MD571ee7a0d612a6530ccfd22c79bbf0695
SHA10e7413e80de750d661c132a0dd88c014dbfd2398
SHA2560412820e4dacf521808629f37fff8e32aa554c0d9096b7800921c8ae1cfcb0c5
SHA5120cf425fcb5468f16cf79b080e48de65918608842c38a194ce847f7624e66a5b2ede586dc5246ce4460ed006ec5058d4e659079a393914a6adee0e5e643347e0a
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
5.1MB
-
Filesize
3.6MB
-
Filesize
1.9MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
9.9MB
-
Filesize
3.6MB
-
Filesize
512KB
-
Filesize
3.6MB
-
Filesize
304KB
-
Filesize
336KB
-
Filesize
512KB
-
Filesize
720KB
-
Filesize
512KB
-
Filesize
5.1MB
-
Filesize
512KB
-
Filesize
1.0MB
-
Filesize
344KB
-
Filesize
32KB
-
Filesize
336KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
864KB
-
Filesize
1.1MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
2.9MB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB