Overview

overview

10

Static

static

10

b8f5067418...23.exe

windows7-x64

10

b8f5067418...23.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    13-05-2024 18:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b8f506741843e2c76fb207b41d205530236f4a263a9a5902146cd71a13fdfd23.exe

  • Size

    2.6MB

  • MD5

    31c7ee1961e277551ca3015cc963cf9d

  • SHA1

    b1a229fdbdc901f22e5464909c6b285e4374294d

  • SHA256

    b8f506741843e2c76fb207b41d205530236f4a263a9a5902146cd71a13fdfd23

  • SHA512

    07d3697b2327c7f1f20af496df467ca2970d566ece51e232e1a7e1f7eecd4571aa35a911f40842ca2cd0a3e4f8c3fce90631bf0fe0dd5a6ba22650e72dbc1aaa

  • SSDEEP

    49152:mLl/s9YWfNHuT/s9YEQtQRTMYIMi7ztf33cSywWyFoEgn9uE:CVsGWfczsG1tQRjdih8rwc

Score
10/10
zgratransomwareratspywarestealer

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\b8f506741843e2c76fb207b41d205530236f4a263a9a5902146cd71a13fdfd23.exe
    "C:\Users\Admin\AppData\Local\Temp\b8f506741843e2c76fb207b41d205530236f4a263a9a5902146cd71a13fdfd23.exe"
    1⤵
    • Drops startup file
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1280
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\CURRENT.CashRansomware
    Filesize

    32B

    MD5

    dd5a367c42cbaf40d6673af2bcbc22c7

    SHA1

    c152f7ace75521c168a0a1b9080fa8bdb0c3144a

    SHA256

    7fc4c04cc361f0dbde84f1fd84ea5e9718121040393012b384f81f1fcdc25232

    SHA512

    00dcb6c4de12c630181f29f089ee1fe2b28324a879ff56970e660ad276be68ca321cef7bc1acb32d03d29643d7d0126e4aeab749c3de8409280515c05348616f

    Download Submit

  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_2.CashRansomware
    Filesize

    8KB

    MD5

    1fe4cc81e9ce385009e2a13e9554b9ac

    SHA1

    fce32c759fca4b5abc08336925cb8ff8f68c4f1a

    SHA256

    cabc5a88bd0853fbfd8a8bec1f487a099298a89e5ecd74eda63c6a5faf797858

    SHA512

    6ae9e8c951f4f6fa042dd1df62a24231cf0171fe3707b6327eaeafff6ca808cd84d0b63df1e780b9f8c9d0dc9e1d2e8535d6ce8d6a601fc3175b411f9cfa091f

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RI1YAXDZ\desktop.ini.CashRansomware
    Filesize

    80B

    MD5

    89f85c8e2f79a015e621d0bdd7620525

    SHA1

    5271a7b46327ce96a91dea7fc85547cb1af7bb4d

    SHA256

    2f099ba2265b8f452565081469814e453c6229fa3acb600c86db59496d53c9eb

    SHA512

    df2136761cbb3488f3dc1cdf555bf2f71cd62d2824f4e08159b40dab98a81efb25de0bccde6ce320f09eaefb1609810387eab99c7d2fad7fb3a64f9fe3311f5f

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.CashRansomware
    Filesize

    28KB

    MD5

    7471e253d8a2b06258e7b3a84a0b39b5

    SHA1

    81ef18ca49f57b3ddad1baeda2d7e35a9facad6b

    SHA256

    968407afb06793b642c06fd417a4a9e16ea2abe18ce062ced8f7192c42fc1faa

    SHA512

    b65c93c9443262460a9b30dab5ec4d64e18cc6572568af6e061b7617092847d64dd5a4c4decc4567de16de5d7a7fa7ba98e96aab7a6c53e90b8786d2df6185f0

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEDownloadHistory\container.dat.CashRansomware
    Filesize

    16B

    MD5

    0cc3243149571698454cd9934e3a0e6d

    SHA1

    f65f96bd3634700b2b829bf87977661cf2fc83ce

    SHA256

    cbab407202c42e9ef44b03a91c6245d0ade91a5aeaa9647eecc872abd882dbfc

    SHA512

    ea6d04d0399e2d0a92bf87f891b8602aa7386b099fc9169310528645a2686eec04eb576b37b4fd0f4924a1cd327114ff3c1cc3f1bc6984887994ef76d058f9cc

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uu0g08su.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.CashRansomware
    Filesize

    48KB

    MD5

    08eb9b33104e601ea9bac752a6f70ddc

    SHA1

    8e3c2616a28b95cb6c271023416cc9570e1df2da

    SHA256

    e55d68772a80e6ecd52c71146067fa9c0c19cfa1c656ae8bd420d00b25d62899

    SHA512

    bb73994f9c402a8496f787af39929474c342f3d74f953e3825bb56ce1825155689dff62eef1c9e1c82f8b84cc7925595d6395d2ed84c8a92a929681597aeddd2

    Download Submit

  • memory/1280-0-0x000007FEF5A63000-0x000007FEF5A64000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1280-2-0x000007FEF5A60000-0x000007FEF644C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1280-1-0x0000000000DD0000-0x000000000107C000-memory.dmp

    Filesize

    2.7MB

    Download

  • memory/1280-1234-0x000007FEF5A60000-0x000007FEF644C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1280-1235-0x000007FEF5A60000-0x000007FEF644C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1280-1236-0x000007FEF5A63000-0x000007FEF5A64000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1280-1237-0x000007FEF5A60000-0x000007FEF644C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1280-1238-0x000007FEF5A60000-0x000007FEF644C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1280-1239-0x000007FEF5A60000-0x000007FEF644C000-memory.dmp

    Filesize

    9.9MB

    Download