Overview

overview

10

Static

static

10

958CCD8E8D...24.exe

windows7-x64

10

958CCD8E8D...24.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13-05-2024 11:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    958CCD8E8DCCE5E7BAC5F891E8EDC42AD6C5497D9385C8AE26C328C5F7BEDA24.exe

  • Size

    2.7MB

  • MD5

    69cc2e20ea7a51666b8c14be90441073

  • SHA1

    6a3c7d3267c5c2a679f5f41dff36c091dccfb337

  • SHA256

    958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24

  • SHA512

    de565813d0ddfe491c367e78b2a11891a73859a04efd83d8f35a4a6f6a028a29c873750dc863d1dfca9c40f9b4778cb1882bf8c07b9609f8463db22ac912922a

  • SSDEEP

    49152:nsul/s9YiZYGuT/s9YEQtQRTMYIMi7ztf33cSywWyFoEgn9uw:nJVsG+YRzsG1tQRjdih8rwcr

Score
10/10
zgratransomwareratspywarestealer

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\958CCD8E8DCCE5E7BAC5F891E8EDC42AD6C5497D9385C8AE26C328C5F7BEDA24.exe
    "C:\Users\Admin\AppData\Local\Temp\958CCD8E8DCCE5E7BAC5F891E8EDC42AD6C5497D9385C8AE26C328C5F7BEDA24.exe"
    1⤵
    • Drops startup file
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1728
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2924

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\CURRENT.CashRansomware
    Filesize

    32B

    MD5

    157bbb6155b63871103e6b0fd6e4c3b4

    SHA1

    f082e794b70121d2588d2e4407da2c965f0bff4c

    SHA256

    a85c123d0f066ec0a7ce1fada36931854f8a0b973e0f84789be5f1d5e7001c03

    SHA512

    b148a00b71058bc739f38cd798f611bc7847d8aad4e142d0d1b0f124d88abc0d9334d5514c445729079d4188ba02309a6eccd6294ef4f373af8cf25b96ce76eb

    Download Submit

  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_2.CashRansomware
    Filesize

    8KB

    MD5

    379da2a4de0e2e77ad89ad915e117c43

    SHA1

    879e113dbd23c5b1e9cfd536b44be1f3057f5fb5

    SHA256

    02f3c0cc2c988ec9a82f36cd4979f2b070396ef4dcaa56c979dbf109a18764c2

    SHA512

    5c40bfc1dd4277c7de92dd5fef61195c56f24bace758a422afcc7483ce92e7f8ecde389f85e72fb09b001b4171a4d013064742160d5556c1390a43d90ee9cca9

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JP38OXIN\desktop.ini.CashRansomware
    Filesize

    80B

    MD5

    8bda30cb7b6b2e934a402a588e0f8b45

    SHA1

    dadd4be2c582eb326de40f0a66a9925e5361d82a

    SHA256

    f08b8b75decb1c724946f9b26f339b7e728f031c5c9b760388d3beb04d6e9e8b

    SHA512

    75174fb024ac5a6c2c575a2b6e9723a17db409a24bdd9cfdaaead165d0b65f24d2c4dfdd1f59817655e2b6114a8b5dd3ef716233737fa7d0bec2e44d3d1df7a4

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.CashRansomware
    Filesize

    28KB

    MD5

    44ac5145ee73cdde9c0fab00ecc79b6f

    SHA1

    a2857ef5aab4447e834b4fc65e52da86ed66849a

    SHA256

    7645d9d56bba0f59ce135be7ec359493ec5a05b2b414ad83e348eb41c3cba9d7

    SHA512

    ed58ae5980ac582eb7a5129c2960db2935a76550897d4a04b47f49b54d7deaa09abd6d7520c078dabd527b53cfa307cbe213fdf097a9028a083dc8bd3a9a5d68

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEDownloadHistory\container.dat.CashRansomware
    Filesize

    16B

    MD5

    d9441266eaefad9edf5566736386a68e

    SHA1

    1c9a4bb41035505fec0fe0904f1dd43abf548a8a

    SHA256

    82f4409e2a7771207b31545c26227051df54588049233531564def261dd7a13e

    SHA512

    3559285a538f6357108ace5eadcd4f5877157d1a01613b1052b4ac089c3c94fdad72e2925a399e5474e1497189a61b9e9029ef0a4f07335022126f450769d05a

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.CashRansomware
    Filesize

    48KB

    MD5

    1aabd523b87fd31e5ccd45b7e54521b0

    SHA1

    4f60bf13ebb3619b4e02c08d62127685d9a42688

    SHA256

    7774c48a4da251e90c71354c34521efb165491f0f7ea15711629f7279844cdbb

    SHA512

    1996440ef7a2b893bb2d142bd23b894972a32dec7b274e6f86aa3a63b9e17195d68606b032d4cae25a727d520e8d22874588f71f8736a4aadeb4764e303207d2

    Download Submit

  • memory/1728-0-0x000007FEF50C3000-0x000007FEF50C4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1728-2-0x000007FEF50C0000-0x000007FEF5AAC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1728-1-0x0000000000980000-0x0000000000C2E000-memory.dmp

    Filesize

    2.7MB

    Download

  • memory/1728-1062-0x000007FEF50C3000-0x000007FEF50C4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1728-1063-0x000007FEF50C0000-0x000007FEF5AAC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1728-1199-0x000007FEF50C0000-0x000007FEF5AAC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1728-1200-0x000007FEF50C0000-0x000007FEF5AAC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1728-1201-0x000007FEF50C0000-0x000007FEF5AAC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1728-1202-0x000007FEF50C0000-0x000007FEF5AAC000-memory.dmp

    Filesize

    9.9MB

    Download