Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
53s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 03:20
Behavioral task
behavioral1
Sample
PatchGadar.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
PatchGadar.exe
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
PatchGadar.exe
Resource
win10v2004-20240226-en
General
-
Target
PatchGadar.exe
-
Size
293KB
-
MD5
edcfedc1c217b5907f6b69272e5ca98f
-
SHA1
e4bb7f3226e809c7ad1e12193ee26048cfc58790
-
SHA256
114ad98c82f045d81f4b456900e650ea316e7dda7a1d8c5396e585488986d6fe
-
SHA512
c1a9d970e7690f60eb1ad0ea85a57c942b31006db8dbbfcc46e1d0e1036ee2957f67ce205eba93b426d78dd6eb8bcf23fb713b3442ae1ab91f59a24ed6e4e626
-
SSDEEP
3072:e3MK0Jc5YQoIpwg9iO2OaiS40eBwYG3zRrYp2OplMGc8A6uHPMG7CUqkZFI0CADL:u2c5YQoI2gzai9kjJkhpuJvYuH
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule behavioral2/memory/1720-1-0x0000000000980000-0x00000000009D0000-memory.dmp family_zgrat_v1 -
Modifies Windows Firewall 2 TTPs 5 IoCs
pid Process 1836 netsh.exe 2284 netsh.exe 1332 netsh.exe 2644 netsh.exe 2716 netsh.exe -
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral2/memory/1720-1-0x0000000000980000-0x00000000009D0000-memory.dmp net_reactor -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 4 raw.githubusercontent.com 5 raw.githubusercontent.com 6 raw.githubusercontent.com 7 raw.githubusercontent.com -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1720 PatchGadar.exe Token: SeDebugPrivilege 1260 taskmgr.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe -
Suspicious use of SendNotifyMessage 34 IoCs
pid Process 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe 1260 taskmgr.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1720 wrote to memory of 1332 1720 PatchGadar.exe 30 PID 1720 wrote to memory of 1332 1720 PatchGadar.exe 30 PID 1720 wrote to memory of 1332 1720 PatchGadar.exe 30 PID 1720 wrote to memory of 1332 1720 PatchGadar.exe 30 PID 1720 wrote to memory of 2644 1720 PatchGadar.exe 32 PID 1720 wrote to memory of 2644 1720 PatchGadar.exe 32 PID 1720 wrote to memory of 2644 1720 PatchGadar.exe 32 PID 1720 wrote to memory of 2644 1720 PatchGadar.exe 32 PID 1720 wrote to memory of 2716 1720 PatchGadar.exe 34 PID 1720 wrote to memory of 2716 1720 PatchGadar.exe 34 PID 1720 wrote to memory of 2716 1720 PatchGadar.exe 34 PID 1720 wrote to memory of 2716 1720 PatchGadar.exe 34 PID 1720 wrote to memory of 1836 1720 PatchGadar.exe 36 PID 1720 wrote to memory of 1836 1720 PatchGadar.exe 36 PID 1720 wrote to memory of 1836 1720 PatchGadar.exe 36 PID 1720 wrote to memory of 1836 1720 PatchGadar.exe 36 PID 1720 wrote to memory of 2284 1720 PatchGadar.exe 38 PID 1720 wrote to memory of 2284 1720 PatchGadar.exe 38 PID 1720 wrote to memory of 2284 1720 PatchGadar.exe 38 PID 1720 wrote to memory of 2284 1720 PatchGadar.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\PatchGadar.exe"C:\Users\Admin\AppData\Local\Temp\PatchGadar.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall add rule name="BlockIP 107.186.1.15" dir=out action=block remoteip=107.186.1.152⤵
- Modifies Windows Firewall
PID:1332
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall add rule name="BlockIP 107.186.10.31" dir=out action=block remoteip=107.186.10.312⤵
- Modifies Windows Firewall
PID:2644
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall add rule name="BlockIP 107.186.31.222" dir=out action=block remoteip=107.186.31.2222⤵
- Modifies Windows Firewall
PID:2716
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall add rule name="BlockIP 23.226.21.91" dir=out action=block remoteip=23.226.21.912⤵
- Modifies Windows Firewall
PID:1836
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall add rule name="BlockIP 104.26.2.120" dir=out action=block remoteip=104.26.2.1202⤵
- Modifies Windows Firewall
PID:2284
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2852
-
C:\Windows\System32\taskmgr.exe"C:\Windows\System32\taskmgr.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a