Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

CashRansomware.exe

windows7-x64

10

CashRansomware.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    135s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    07/05/2024, 01:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    CashRansomware.exe

  • Size

    2.6MB

  • MD5

    33559005506dae5967c8ddeaa8a65f5b

  • SHA1

    0d3c40848c443d4c7dbada45fe976cb9f616c9c2

  • SHA256

    5525d297a346b80912c4f5ec0ac4875e9d49f96d01e52c10df5c064bd803bd79

  • SHA512

    1591fe81d82b18b854299b0ccc72ec2f31208a9ab11afd75047a3d2e3b2ae7931bd412a8401eff57790348ddb5463c31dfc3f870a6c9eef8ef86006b55be7e55

  • SSDEEP

    49152:xDmflSXRl/s9YcuT/s9YEQtQRTMYIMi7ztf33cSywWyFoEgn9u:xDmflEVsGfzsG1tQRjdih8rwc

Score
10/10
zgratransomwareratspywarestealer

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CashRansomware.exe
    "C:\Users\Admin\AppData\Local\Temp\CashRansomware.exe"
    1⤵
    • Drops startup file
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2372

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\CURRENT.CashRansomware
    Filesize

    32B

    MD5

    fb1ac9d53481d47484288c304984240a

    SHA1

    053f2dcbd00d71d929a4fb110815a8724e4a4f8d

    SHA256

    789e2df9d1933f9f81d00e0f7df436bee7013a97581de78644d8391c599f2b99

    SHA512

    41e13822d2e7e7a8c8ac51fdafbabc7d951c163de5b1b12759c2ffb7318ff779068f3b892343c94dfbd129062a7c5bd4755634b0c0f4ea0e028174342370618e

    Download Submit

  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1.CashRansomware
    Filesize

    264KB

    MD5

    5f763bccd80b276d3df7907a62bc7d07

    SHA1

    a73150d122b30996d4a2646e5420daa073419573

    SHA256

    dc40c6543e522d316811e205fae363eff2d9a9f754685ae826f9293ec90d30bb

    SHA512

    1ad08347ababc6678176ff7d053ca5ae50356a03d5f7c0fa403bd7125f40ab42f2cefbe60063d1da46db380182f7a7e5bed560fa3671bcf3b83735c106ae8835

    Download Submit

  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_2.CashRansomware
    Filesize

    8KB

    MD5

    871182b8e71bda4cb0f7586a884b69e0

    SHA1

    4f3fb761c47bbdaa60b37d2eb33f587bca8a4a56

    SHA256

    f1e6b8e3d9e3fbabfa7505b6c4f054683dd80c88694bf2294e850f9a19553ab4

    SHA512

    56dbe0355f6e131e9c1dc7124d11655a0d76cc83f0d9a59cba2dc1d8bf9196e512de14351516f8809272f705039a6ced909896218257c8d0862d2105064caa81

    Download Submit

  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_3.CashRansomware
    Filesize

    8KB

    MD5

    2188b8910b2ca5f14f5724de51412618

    SHA1

    71260ff5207a016995fbaae17feba87ebd599801

    SHA256

    e7ff2f1b25fd4f9c7e27b9f426195fa5a9c44c5686eb1c9d95103f354d1f645c

    SHA512

    32484947b1d5ac1c6f28932d131abfc75328d6a17619884bcec24fadf6933dd43844129360c95c5621b672d2960259a54d1ad7948ca0db25e3c49c6ed5575791

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\FW0P2MZH\desktop.ini.CashRansomware
    Filesize

    80B

    MD5

    af8eda7201c2a07bde9209956f141166

    SHA1

    bcbdcc4ecff45321cffd8e9629779304da2d2054

    SHA256

    cad4697c085224fab3f047239ce5652177af0c008e942eb29ffd0a7933aca22a

    SHA512

    ed84a03fa19d2fe63ce016a4720a4ba81e7bc1e263b61d9df38f2dad0542d2c3310ad36b600ae4715c5ebbd1c1f2c8a72f758172352102fe2a100651c51bf299

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.CashRansomware
    Filesize

    28KB

    MD5

    428daf68921dc29228b32f5bcd53b305

    SHA1

    7fe349a8936302ee9a1b90de6fb1c41d8781f248

    SHA256

    0004db1eb84e2897c14ecd1fa207a485de99936bda408ebb9626b510adde2f1c

    SHA512

    e67a11be6d6e4cc4548377938df34b68674a7763f04129f4c641998995b8b76c6ae30239717acfd951c05aa03a25c4e77d0da3b81c535356c85979a9f3dfea1b

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEDownloadHistory\container.dat.CashRansomware
    Filesize

    16B

    MD5

    ecd0706641c223dbe0f32566f2e7ef48

    SHA1

    0138e7f7237f038ea7e49180c40d050772e99312

    SHA256

    272f2a0517a9896a6bae1c7d680f7ceb7961b270bfacf4cc40378fdd72025310

    SHA512

    d98fd1b272ad668df37863891f136bd09966e9b9769c48c921dac3f6f56b3992e1219a0b562c86428ac44c990f2a307f6f33e88b570ce9f92b259a2081422375

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lf4jobx9.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.CashRansomware
    Filesize

    48KB

    MD5

    48010f51231bf7b00799fe2d8226a822

    SHA1

    1b63245a6dbf99d8a2620f2f1d8bef3f67d7748e

    SHA256

    378ea6c930f523ce9118619ebb1fb6bb58be3aa0df3cfeb51357c1b6bc9805aa

    SHA512

    cf4883641abd2a5505223258313a97ddcf229bf708773a49c8bbbb12267c4792efcf0854b5071e18b5f4ca15aa8233a88f2348625ad17bf7546ee75176516430

    Download Submit

  • memory/2372-0-0x000007FEF5533000-0x000007FEF5534000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2372-2-0x000007FEF5530000-0x000007FEF5F1C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2372-1-0x0000000000AC0000-0x0000000000D5A000-memory.dmp

    Filesize

    2.6MB

    Download

  • memory/2372-1175-0x000007FEF5530000-0x000007FEF5F1C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2372-1176-0x000007FEF5530000-0x000007FEF5F1C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2372-1177-0x000007FEF5533000-0x000007FEF5534000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2372-1178-0x000007FEF5530000-0x000007FEF5F1C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2372-1179-0x000007FEF5530000-0x000007FEF5F1C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2372-1180-0x000007FEF5530000-0x000007FEF5F1C000-memory.dmp

    Filesize

    9.9MB

    Download