Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

61c51c7ab2...34.exe

windows7-x64

10

61c51c7ab2...34.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5446af14bfb2bf63ec1b409a0752f2bb.bin

  • Size

    4.6MB

  • Sample

    240507-bt52qscc2z

  • MD5

    5c4d8c6a0c528b4568ccb1abac8f7254

  • SHA1

    9f6fdb2ca88d1338f42ffe4a980af257a4407014

  • SHA256

    7828b918927842de36e6b7b4155325e08b1b8f8a50c3a6feaee2bac4883c86d7

  • SHA512

    21c147e92a68383f26c0a17c5648399f5ce27605f26c6abff654b59d544d22350dd2416bf88308de0bd133f0acdc83dfad2ae49ce74be1db7ce7dbb9f0a8e897

  • SSDEEP

    98304:xe7mFukVORIZNtj1YN8VugVdkHW/01ZA6rScVmk31FC+klO:c7SfTl2iuYO6018cIk3QlO

Score
10/10
zgratexecutionrat

Malware Config

Targets

    • Target

      61c51c7ab209978d127693a8837c3fb65f16a8315d511aa84e0b8c9129afc434.exe

    • Size

      7.2MB

    • MD5

      5446af14bfb2bf63ec1b409a0752f2bb

    • SHA1

      2d0ed53f2bab261a09e50e35b95f896ddf6dd688

    • SHA256

      61c51c7ab209978d127693a8837c3fb65f16a8315d511aa84e0b8c9129afc434

    • SHA512

      3f96ff6656d7937fe3be66688c5559a238be9e0277373dd8a325f2e36fbd50095285ae8da8db0b59f0706b9514bdf54f2f66da81caf4d2818b9c9d20d5cff436

    • SSDEEP

      49152:OSa5+lvH/3ehlWOU9Hl73KkPjOMVMC21gt9dmFF9KINW1FQr7qrzW+x30rY6yTK4:A0X3IWbXPjObC9CFAArmGm3U0KFK/j

    Score
    10/10
    zgratexecutionrat

    • Detect ZGRat V1

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks