Overview

overview

10

Static

static

10

132ef1a933...c3.exe

windows7-x64

10

132ef1a933...c3.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    160s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-05-2024 14:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    132ef1a933f9d26fb0bb46b0a970dbfe05ad8fe0859ece8eb973b5584a580cc3.exe

  • Size

    2.6MB

  • MD5

    71f0e2645d9051c3a8f5cf2dbce9d074

  • SHA1

    a303632965f9fdc3b7cb4c532831c0b38f24df90

  • SHA256

    132ef1a933f9d26fb0bb46b0a970dbfe05ad8fe0859ece8eb973b5584a580cc3

  • SHA512

    14625c8fe238a41c0a45579731a15a705f153681a0f4e212b8315e3f5643542c57e17f82c247552b21417aa92dce36fd40fbcaaf85b4fb462182c2814f4f8077

  • SSDEEP

    49152:Til/s9YkCKuT/s9YEQtQRTMYIMi7ztf33cSywWyFoEgn9u:OVsGkClzsG1tQRjdih8rwc

Score
10/10
zgratransomwareratspywarestealer

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\132ef1a933f9d26fb0bb46b0a970dbfe05ad8fe0859ece8eb973b5584a580cc3.exe
    "C:\Users\Admin\AppData\Local\Temp\132ef1a933f9d26fb0bb46b0a970dbfe05ad8fe0859ece8eb973b5584a580cc3.exe"
    1⤵
    • Sets desktop wallpaper using registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3848
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\Cash Ransomware.html
      2⤵
        PID:1740
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:1860
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5256 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:1
        1⤵
          PID:756
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=5492 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:1
          1⤵
            PID:4508
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4272 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
            1⤵
              PID:3780
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5464 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:1
              1⤵
                PID:2252
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5984 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
                1⤵
                  PID:2296

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/3848-0-0x00007FFDB9F93000-0x00007FFDB9F95000-memory.dmp
                  Filesize

                  8KB

                  Download
                • memory/3848-1-0x000002AAB59E0000-0x000002AAB5C7A000-memory.dmp
                  Filesize

                  2.6MB

                  Download
                • memory/3848-2-0x00007FFDB9F93000-0x00007FFDB9F95000-memory.dmp
                  Filesize

                  8KB

                  Download
                • memory/3848-3-0x00007FFDB9F90000-0x00007FFDBAA51000-memory.dmp
                  Filesize

                  10.8MB

                  Download
                • memory/3848-4-0x00007FFDB9F90000-0x00007FFDBAA51000-memory.dmp
                  Filesize

                  10.8MB

                  Download
                • memory/3848-10-0x00007FFDB9F90000-0x00007FFDBAA51000-memory.dmp
                  Filesize

                  10.8MB

                  Download
                • memory/3848-11-0x00007FFDB9F90000-0x00007FFDBAA51000-memory.dmp
                  Filesize

                  10.8MB

                  Download
                • memory/3848-12-0x000002AAD5C90000-0x000002AAD5E52000-memory.dmp
                  Filesize

                  1.8MB

                  Download
                • memory/3848-13-0x000002AAD6390000-0x000002AAD68B8000-memory.dmp
                  Filesize

                  5.2MB

                  Download
                • memory/3848-17-0x00007FFDB9F90000-0x00007FFDBAA51000-memory.dmp
                  Filesize

                  10.8MB

                  Download
                • memory/3848-18-0x00007FFDB9F90000-0x00007FFDBAA51000-memory.dmp
                  Filesize

                  10.8MB

                  Download
                • memory/3848-19-0x00007FFDB9F90000-0x00007FFDBAA51000-memory.dmp
                  Filesize

                  10.8MB

                  Download