Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
29/03/2024, 02:00
General
-
Target
0412820e4dacf521808629f37fff8e32aa554c0d9096b7800921c8ae1cfcb0c5.exe
-
Size
5.1MB
-
MD5
71ee7a0d612a6530ccfd22c79bbf0695
-
SHA1
0e7413e80de750d661c132a0dd88c014dbfd2398
-
SHA256
0412820e4dacf521808629f37fff8e32aa554c0d9096b7800921c8ae1cfcb0c5
-
SHA512
0cf425fcb5468f16cf79b080e48de65918608842c38a194ce847f7624e66a5b2ede586dc5246ce4460ed006ec5058d4e659079a393914a6adee0e5e643347e0a
-
SSDEEP
98304:2rHq3FSVIErWayHeVd0q2rVMPMKhV83eZe/LFx:2jqVSVKH0d0q2rfP3lr
Malware Config
Signatures
-
Detect ZGRat V1 35 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0412820e4dacf521808629f37fff8e32aa554c0d9096b7800921c8ae1cfcb0c5.exe"C:\Users\Admin\AppData\Local\Temp\0412820e4dacf521808629f37fff8e32aa554c0d9096b7800921c8ae1cfcb0c5.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Vbcmzog.exe"C:\Users\Admin\AppData\Local\Temp\Vbcmzog.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAQwB1AHIAcgBlAG4AdABcAEEAYwB0AGkAdgBhAHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuAGUAeABlACwAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAgAC0ARgBvAHIAYwBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAsAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAQwB1AHIAcgBlAG4AdABcAEEAYwB0AGkAdgBhAHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuAGUAeABlAA==1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Current\ActivationContext.exeC:\Users\Admin\AppData\Roaming\Current\ActivationContext.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
837KB
MD5ec0362e81436b8e7cccb93fa43220fdb
SHA1f4d7b2d844f995c8466aa13ff2f17aab052e14bc
SHA2563e4d82399a8774a79b23814dcae1ce2e38ac565241f0d78e6473269705d2d96c
SHA512cdd02d02cab7fc9ba7c7fab35cc35cbb29b2a40dbbf999dc2222c6449bb70522d91132c7476cb867e7320266d630b1f9d0541d11a076a64f00e426cb342e5700
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
5.1MB
MD571ee7a0d612a6530ccfd22c79bbf0695
SHA10e7413e80de750d661c132a0dd88c014dbfd2398
SHA2560412820e4dacf521808629f37fff8e32aa554c0d9096b7800921c8ae1cfcb0c5
SHA5120cf425fcb5468f16cf79b080e48de65918608842c38a194ce847f7624e66a5b2ede586dc5246ce4460ed006ec5058d4e659079a393914a6adee0e5e643347e0a
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
632KB
-
Filesize
64KB
-
Filesize
864KB
-
Filesize
10.8MB
-
Filesize
1.1MB
-
Filesize
10.8MB
-
Filesize
3.6MB
-
Filesize
32KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
304KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
336KB
-
Filesize
720KB
-
Filesize
1.0MB
-
Filesize
64KB
-
Filesize
3.6MB
-
Filesize
344KB
-
Filesize
64KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
5.1MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
64KB
-
Filesize
10.8MB