Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/04/2024, 01:08

General

  • Target

    1f36770f712ddc39232583723f0c43d4f11d680fae143f79a8158d6a0f015702.exe

  • Size

    1.9MB

  • MD5

    2f12651489989cc02775433ade30799c

  • SHA1

    e07f6c5cddc29edce812fa42724f07f565a7728f

  • SHA256

    1f36770f712ddc39232583723f0c43d4f11d680fae143f79a8158d6a0f015702

  • SHA512

    ac42fbdf5425a4cfe37af4931a0fcb3733f74e7869b45fff7ba1bf1e8b33ffa8fe2b93980fc0a0d5b3b59e38e33a7cbc597fc28a22b9aa5afac7e29b14f2cd49

  • SSDEEP

    49152:IBJunqwC2ZpjeWCeemRYiEtOCTpdBAeeAY:yOGqdeWx6iMOCTpded

Score
10/10

Malware Config

Signatures

  • Detect ZGRat V1 2 IoCs
  • Process spawned unexpected child process 15 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Detects executables packed with unregistered version of .NET Reactor 2 IoCs
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 15 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 6 IoCs
  • Runs ping.exe 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f36770f712ddc39232583723f0c43d4f11d680fae143f79a8158d6a0f015702.exe
    "C:\Users\Admin\AppData\Local\Temp\1f36770f712ddc39232583723f0c43d4f11d680fae143f79a8158d6a0f015702.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4440
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\perfNet\3avxEvz443e8fK5hO0euPJUAURE3dMdoo4.vbe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4468
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\perfNet\2Ry7Kk5ZsbIxjy4EHSdRm6lA5qf0cEB8qgrvpCqSPa.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3068
        • C:\perfNet\mscom.exe
          "C:\perfNet/mscom.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2820
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zjvdTUSaeH.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1600
            • C:\Windows\system32\chcp.com
              chcp 65001
              6⤵
                PID:3232
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                6⤵
                  PID:1772
                • C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe
                  "C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe"
                  6⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1940
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b9Anfm3pCF.bat"
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4536
                    • C:\Windows\system32\chcp.com
                      chcp 65001
                      8⤵
                        PID:3648
                      • C:\Windows\system32\PING.EXE
                        ping -n 10 localhost
                        8⤵
                        • Runs ping.exe
                        PID:4356
                      • C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe
                        "C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe"
                        8⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1592
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2ERwRXGzbm.bat"
                          9⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1400
                          • C:\Windows\system32\chcp.com
                            chcp 65001
                            10⤵
                              PID:2896
                            • C:\Windows\system32\PING.EXE
                              ping -n 10 localhost
                              10⤵
                              • Runs ping.exe
                              PID:4568
                            • C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe
                              "C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe"
                              10⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:4572
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FbfnFz5COU.bat"
                                11⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4560
                                • C:\Windows\system32\chcp.com
                                  chcp 65001
                                  12⤵
                                    PID:4656
                                  • C:\Windows\system32\PING.EXE
                                    ping -n 10 localhost
                                    12⤵
                                    • Runs ping.exe
                                    PID:1180
                                  • C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe
                                    "C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe"
                                    12⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Modifies registry class
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:1608
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cO0v9X3fOA.bat"
                                      13⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3468
                                      • C:\Windows\system32\chcp.com
                                        chcp 65001
                                        14⤵
                                          PID:752
                                        • C:\Windows\system32\PING.EXE
                                          ping -n 10 localhost
                                          14⤵
                                          • Runs ping.exe
                                          PID:2892
                                        • C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe
                                          "C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe"
                                          14⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:768
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\perfNet\lsass.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:2244
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\perfNet\lsass.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:3364
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\perfNet\lsass.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:2800
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "mscomm" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:1624
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "mscom" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:2884
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "mscomm" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:4060
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\fontdrvhost.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:4236
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\fontdrvhost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:2332
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\fontdrvhost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:3376
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:4176
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:4164
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:3200
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\perfNet\csrss.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:1760
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\perfNet\csrss.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:748
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\perfNet\csrss.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:4896

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mscom.exe.log

                Filesize

                1KB

                MD5

                9c46a6a79f6f8d9a9a8efa72b5cb18d3

                SHA1

                4f012a8af24f3959ecc97d4134d3bc2e91075d4a

                SHA256

                6fa59f5ba5e96afeb43feaf27ca49b6c250e38fb0a9dfbbb26857f8c787803cc

                SHA512

                4d691be464f14c1b8055cb2b53e84e0c3921e8419548df30d11550146672cd91764587b89169b5ed5c8d507163495b82d587c56386cc4a3e3465dde1d7ff598a

              • C:\Users\Admin\AppData\Local\Temp\2ERwRXGzbm.bat

                Filesize

                181B

                MD5

                14cea83da1f50d5b2b48f0b57271e26d

                SHA1

                b334f2bbb2a4eefe61e9d2034213ddd34fe67c20

                SHA256

                b6b2ee9bc4a27a36d2b64466ba7bda338d60741e7a2a0d88b8af8786377f9ef9

                SHA512

                235a9a9b0f9d4e3eb43e3d73ef78dc010b3c3cf4f768d104cf29a7af9b8f4c6842aedc1fd730f5febe1747a9d8bbdfcff22451da7f1d96f7215d874fc3b21c46

              • C:\Users\Admin\AppData\Local\Temp\FbfnFz5COU.bat

                Filesize

                181B

                MD5

                ebb2128ddd93edc8a4c29004c6d00229

                SHA1

                5ed6cf8d9b86dd4a5f9f6c07046c11185213385c

                SHA256

                5414dfae3f9a4f4ff1b9207f755c661f7484ad77c1015b546b64127be1d10d0f

                SHA512

                a22a2aca6fadf622a4c8a89f1ea66dc94b874cf015bcb8eaa7a28465996edcfce74fba1845b5899b750faab16783ff11da87a5210f8e39e17b44e012ba1b5aaa

              • C:\Users\Admin\AppData\Local\Temp\b9Anfm3pCF.bat

                Filesize

                181B

                MD5

                c29989cd3502a460eb66f0fcc344e3b3

                SHA1

                1ec8bfcc025a93a55112ff3b71b94727c2501774

                SHA256

                88188e4fdaabf13f1f329ff9c1024f7a2669c3a99fe591271fe31f668fc16f53

                SHA512

                aba3765122a818993acbacb213277ebfb2ce854e1617963ebd9b9abec38305c27820b12b314acf379e3169cac876855aae63ca8261a62d219c7ef1f371afa899

              • C:\Users\Admin\AppData\Local\Temp\cO0v9X3fOA.bat

                Filesize

                181B

                MD5

                332cba2795721c9b114749116eb6ce0e

                SHA1

                124532d3053d86d82d05036cefad6b0127012cc9

                SHA256

                2ab92d71021ba1ee9919129f29c09936b026e042c8179df5b033a48cf4870fd2

                SHA512

                4275cade7ca61ccf07ffe7a990eac23585cc08b9ea82ec67b2c8712241e62abc20cf6a4fc3f25a714d43ca4aee0af7623b831dd9d2bf11aa6544154dc085cbca

              • C:\Users\Admin\AppData\Local\Temp\zjvdTUSaeH.bat

                Filesize

                229B

                MD5

                4f8a13b47c90601ea8bdddd78952bed6

                SHA1

                98472e1b7c0edeee8da695af283e129b7adba535

                SHA256

                6657cc07853b8b7ebc8b8d33f20ef7698d36a22363734f38a80ef7a39ae5ff6f

                SHA512

                007f030683d0953ca10af1e06d2fe00ce3e35b890b3a10e88ad01767db0db8f8dc41a5862442da0938e61cb62c9638e3b4f856fcebe4e114e344a60b376e1945

              • C:\perfNet\2Ry7Kk5ZsbIxjy4EHSdRm6lA5qf0cEB8qgrvpCqSPa.bat

                Filesize

                80B

                MD5

                ec8794c7e2e95913910fbd015673af21

                SHA1

                b78fcf173a7c04c6e380f43f46994427ba34facb

                SHA256

                af0e1c35fb89eeb787d8a66e95850e16c3e4101c08bd405429e4818a878b2010

                SHA512

                b99cf41f8b4806397e2a17889b687a7b91366e917aaad00b2dd3fa1819fe0bef68699d01f9b14208ad76d35e9310e79c5137ceed58d9f5a1609ac89e7b36b730

              • C:\perfNet\3avxEvz443e8fK5hO0euPJUAURE3dMdoo4.vbe

                Filesize

                228B

                MD5

                93b1feeffa519c911b37d8f6b71a4365

                SHA1

                d09a173ce2653fe61efd5e35fcbc8ddc10f2218a

                SHA256

                3a47a541817337a14cd5873cf8c1cfb8f229ef192e92a657335cc90a896a738d

                SHA512

                1ddacbbec74946869ec67a1275866096f007443993909499e89b064e3adfee69f77f187578c6d55b86ec0820ecdbe08119b9899317c8e1e5202396240aeaeed2

              • C:\perfNet\mscom.exe

                Filesize

                2.0MB

                MD5

                9de6f58850c3f3e04cd1d7a836cf9094

                SHA1

                cd08f280a6a5b65fa96421b1111ba0e4a01e3ce0

                SHA256

                278b07211495ebf53014aeee5241b246a2aa5273e39150e625d9a6b9c04d419d

                SHA512

                ec5540950c861d5cb0e43d133e4c7376dae04b91afcae791f3fa4489fc8f5e9c65b55d9e34dd196ea8c715a4a72af96a98e93d31f52e63c81539b92fba5935e5

              • memory/2820-24-0x000000001B440000-0x000000001B452000-memory.dmp

                Filesize

                72KB

              • memory/2820-22-0x00000000010B0000-0x00000000010BE000-memory.dmp

                Filesize

                56KB

              • memory/2820-25-0x000000001BC10000-0x000000001C138000-memory.dmp

                Filesize

                5.2MB

              • memory/2820-27-0x00000000028F0000-0x00000000028FC000-memory.dmp

                Filesize

                48KB

              • memory/2820-29-0x0000000002900000-0x000000000290E000-memory.dmp

                Filesize

                56KB

              • memory/2820-31-0x000000001B460000-0x000000001B46C000-memory.dmp

                Filesize

                48KB

              • memory/2820-47-0x00007FFFD0EA0000-0x00007FFFD1961000-memory.dmp

                Filesize

                10.8MB

              • memory/2820-20-0x000000001B420000-0x000000001B438000-memory.dmp

                Filesize

                96KB

              • memory/2820-18-0x000000001B690000-0x000000001B6E0000-memory.dmp

                Filesize

                320KB

              • memory/2820-17-0x000000001B400000-0x000000001B41C000-memory.dmp

                Filesize

                112KB

              • memory/2820-15-0x00000000010A0000-0x00000000010AE000-memory.dmp

                Filesize

                56KB

              • memory/2820-13-0x00007FFFD0EA0000-0x00007FFFD1961000-memory.dmp

                Filesize

                10.8MB

              • memory/2820-12-0x00000000005C0000-0x00000000007CC000-memory.dmp

                Filesize

                2.0MB