Overview

overview

10

Static

static

10

5525d297a3...79.exe

windows7-x64

10

5525d297a3...79.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08-05-2024 12:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5525d297a346b80912c4f5ec0ac4875e9d49f96d01e52c10df5c064bd803bd79.exe

  • Size

    2.6MB

  • MD5

    33559005506dae5967c8ddeaa8a65f5b

  • SHA1

    0d3c40848c443d4c7dbada45fe976cb9f616c9c2

  • SHA256

    5525d297a346b80912c4f5ec0ac4875e9d49f96d01e52c10df5c064bd803bd79

  • SHA512

    1591fe81d82b18b854299b0ccc72ec2f31208a9ab11afd75047a3d2e3b2ae7931bd412a8401eff57790348ddb5463c31dfc3f870a6c9eef8ef86006b55be7e55

  • SSDEEP

    49152:xDmflSXRl/s9YcuT/s9YEQtQRTMYIMi7ztf33cSywWyFoEgn9u:xDmflEVsGfzsG1tQRjdih8rwc

Score
10/10
zgratransomwareratspywarestealer

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5525d297a346b80912c4f5ec0ac4875e9d49f96d01e52c10df5c064bd803bd79.exe
    "C:\Users\Admin\AppData\Local\Temp\5525d297a346b80912c4f5ec0ac4875e9d49f96d01e52c10df5c064bd803bd79.exe"
    1⤵
    • Drops startup file
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2176

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\CURRENT.CashRansomware
    Filesize

    32B

    MD5

    093d099d30d59c8e90f916ad2519197f

    SHA1

    0a24235194b859496f4fcb4870c7d7cb2790bac7

    SHA256

    edcafb308c8ec9e2ee973b0f0ce57ea1c085591ca98bb3559f074eb380334935

    SHA512

    2a44228be8d091c1e24bac4aabddce2b22d659bb51da7cb2737a7562f45d156985801065da074dde11a4be0309b10360782698b76ea7f655916b8b90a67307d3

    Download Submit

  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_2.CashRansomware
    Filesize

    8KB

    MD5

    ae951dc84911fa9c9be41aa1cc9bb525

    SHA1

    8c21058569206d5557aabaa1d2b4fe9bb15a6fda

    SHA256

    6815cdb9bf03a3bac8da7b9651d5f376b55b59c5fed41de25ac45c6c26af4a9e

    SHA512

    9de9cfd7b92933974a4658574ae2f9405fb77c2adf57765381ff05aa02f8a014c9f070e395d934e1da167827df6135be24bd5a6674ff66f936647707a8b585d2

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JWM3U1DD\desktop.ini.CashRansomware
    Filesize

    80B

    MD5

    e1f05f86924ef29542022df3a2bd2e37

    SHA1

    2d8f4b9f235c736ed5f4b1f62b6fed204505405a

    SHA256

    f806233001b2a66cd3e07e507f1643edee4df5d9eef34bc77720c989027d2268

    SHA512

    67e72d5ee659f2d385e65f9cae1b07a77bafce76ec2d43c9d4facd710d1613736f770177d1b119889a8debfc94d8e344d1718f1c0f8c901dcf0fc1e11a07a519

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.CashRansomware
    Filesize

    28KB

    MD5

    151265729fd25966657cdc0fceb652f5

    SHA1

    5b2eb16c47ed95cf8c3d2426b856b11bdf425feb

    SHA256

    8e06c4dbdd17104a87e3cb49d7fdd1eb6c0d51ae72cda427ba319cc8581ba8b6

    SHA512

    dc3d921ed9a516cf4b6819742f7e00727fef7676abf1656a3ba843fa61df8f6baf14ae1187cd0e7f6f0ea10235a8e0fdb0fc8ee44b622c2fa6dabfec29003908

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEDownloadHistory\container.dat.CashRansomware
    Filesize

    16B

    MD5

    ddad1041d1c61864ec89eb87f7126a47

    SHA1

    152c990b76dcedad1ea5f26316e328c9325471fe

    SHA256

    6d36da90e5cf5e14024490740032dd4655b296c9f02e43bc3a082b672516a253

    SHA512

    20b1a08ace2e67f6f561d612329761540667f8e235ad82a9a5c2fc7da45ca9b3d49c66381e854126b1ebc16a63979dc9d12afa287e7d0944a8fbe6a6a11e277c

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.CashRansomware
    Filesize

    48KB

    MD5

    ddfb495ff618a2b26e6820647bccf8bd

    SHA1

    816fae31cbd008409f1fdf8c412c3a86fb50b8f2

    SHA256

    1f3946d9bb1e36debdbe74e05c909221f0a2b4aa623da9ddf7d9e80a5e6c4a71

    SHA512

    c5f1e1670c9b7d95baf9e71c79ff6f3eee254a51f004591d7d7d03d4c44c96ee2cca9a06be623a9dab01106c2872db1d81e97d38104a3e269df622ad45c2a94b

    Download Submit

  • memory/2176-0-0x000007FEF5803000-0x000007FEF5804000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2176-2-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2176-1-0x00000000010C0000-0x000000000135A000-memory.dmp

    Filesize

    2.6MB

    Download

  • memory/2176-1242-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2176-1243-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2176-1244-0x000007FEF5803000-0x000007FEF5804000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2176-1245-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2176-1246-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2176-1247-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

    Filesize

    9.9MB

    Download