Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 08:02
General
-
Target
memez valorant.exe
-
Size
6.0MB
-
MD5
8b79741f93dfe2a98005fcedb8cc9e09
-
SHA1
e5b9ae63c045248ee3e0810e73b80f5f853e8574
-
SHA256
7fdc605f25e5374bad102386657bc0189ffa5ab62c3a9cb0fb35f1cf95befafc
-
SHA512
a3b3831a1993544253ae966b08f6976be286cdfa8d8a26816ea1dda1b2ae22f91018ce0c3772615bf9679c684dadb13a629f4e4dfafaff2f3ebf3a17c1f66bf9
-
SSDEEP
24576:aTbBv5rUleX5BM3YIzE0+l8T8/7Vzy8/PoUNjmo59k1UWAaL511wElDeQpx1Kh:sBnX5BWt8j9hdvKDfucz2
Malware Config
Signatures
-
Detect ZGRat V1 2 IoCs
resource yara_rule behavioral1/files/0x0008000000023454-10.dat family_zgrat_v1 behavioral1/memory/1896-12-0x0000000000EB0000-0x000000000108C000-memory.dmp family_zgrat_v1 -
Process spawned unexpected child process 15 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5092 4588 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2880 4588 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2456 4588 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3336 4588 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4852 4588 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2792 4588 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2392 4588 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4060 4588 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1740 4588 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3644 4588 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1528 4588 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2124 4588 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3808 4588 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1136 4588 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3068 4588 schtasks.exe 94 -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation WebSvc.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation memez valorant.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation WScript.exe -
Executes dropped EXE 2 IoCs
pid Process 1896 WebSvc.exe 1164 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\addins\WebSvc.exe WebSvc.exe File created C:\Windows\addins\bc058969039347 WebSvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 15 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5092 schtasks.exe 2880 schtasks.exe 2792 schtasks.exe 2392 schtasks.exe 1136 schtasks.exe 1528 schtasks.exe 2456 schtasks.exe 3336 schtasks.exe 4852 schtasks.exe 1740 schtasks.exe 3644 schtasks.exe 3808 schtasks.exe 4060 schtasks.exe 2124 schtasks.exe 3068 schtasks.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings memez valorant.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings WebSvc.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2348 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe 1896 WebSvc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1164 cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1896 WebSvc.exe Token: SeDebugPrivilege 1164 cmd.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1512 wrote to memory of 4160 1512 memez valorant.exe 84 PID 1512 wrote to memory of 4160 1512 memez valorant.exe 84 PID 1512 wrote to memory of 4160 1512 memez valorant.exe 84 PID 4160 wrote to memory of 1676 4160 WScript.exe 96 PID 4160 wrote to memory of 1676 4160 WScript.exe 96 PID 4160 wrote to memory of 1676 4160 WScript.exe 96 PID 1676 wrote to memory of 1896 1676 cmd.exe 98 PID 1676 wrote to memory of 1896 1676 cmd.exe 98 PID 1896 wrote to memory of 1936 1896 WebSvc.exe 115 PID 1896 wrote to memory of 1936 1896 WebSvc.exe 115 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\memez valorant.exe"C:\Users\Admin\AppData\Local\Temp\memez valorant.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\MsServerBrokerDhcpSvc\OwAS3ElMz3sl8CiEcBXAKJJu9viU7wMG8nRST90KHZpLy5Zk.vbe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\MsServerBrokerDhcpSvc\seUT6SF2g6LubjHj.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Roaming\MsServerBrokerDhcpSvc\WebSvc.exe"C:\Users\Admin\AppData\Roaming\MsServerBrokerDhcpSvc/WebSvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CnAga65Iu2.bat"5⤵PID:1936
-
C:\Windows\system32\chcp.comchcp 650016⤵PID:1564
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- Runs ping.exe
PID:2348
-
-
C:\Users\Default\cmd.exe"C:\Users\Default\cmd.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1164
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5092
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2880
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WebSvcW" /sc MINUTE /mo 5 /tr "'C:\Windows\addins\WebSvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3336
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WebSvc" /sc ONLOGON /tr "'C:\Windows\addins\WebSvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4852
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WebSvcW" /sc MINUTE /mo 8 /tr "'C:\Windows\addins\WebSvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Searches\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2392
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\Searches\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Searches\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Users\Default\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3644
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Users\Default\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2124
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Users\Default\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3808
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1136
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Users\Default\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\MsServerBrokerDhcpSvc\OwAS3ElMz3sl8CiEcBXAKJJu9viU7wMG8nRST90KHZpLy5Zk.vbe
Filesize222B
MD56a3ee7dcfc0c1f8053c0d24d74dafd90
SHA13bb9d75f6c6628760941e0b3a54810195cc67485
SHA256c48f0935f2db9a7260830834018fd7afebf39c4e9d7c4cad8aa4676008dd7715
SHA51262b36d115ece66b8aa107c1befe78d1707cb2e80ca03288d9f62c3cbb7925d472cf479a89aec4bb29068c376629f119cfb6fdd2c69ed2e249cc16815fdda5496
-
Filesize
5.7MB
MD5f120ba47fc16392df01b1e947c7bd6d9
SHA14bf7e0d57c6aab657a2f93d7c66670b4d0d0ca21
SHA256afa08d81487ba3c82f2b672aa340d78f7841090804de82846e3c6ec5244f239c
SHA512f7ee529db6aca5525626b74cbe2eacc6871f58e6c41742c4d47cbf61ba6a7dc74d828b3b0f039a234f5560e8f53348104e6f182cf61656775f00d73769a9cdb6
-
Filesize
82B
MD5cfb98ea195917bd9644b184e9c25a675
SHA1a29083644d06efd7badb63b4a9f66451b3fa996d
SHA256cdb06f3da2a27af06b3b1376f29899349ddb427d6777e70690c9bc4b9d3f8784
SHA512433e0bbb68d1cbbc7148a77681f255bcb03aae2a41f958f3707e5f7a09878539b5186c8cd008e2c25448e8968f4bfd36eb138fdc8f0b7e56a4ac16e480a83dfc