Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    15-05-2024 12:45

General

  • Target

    15052024_1245_Cognex 3512C Doc.js

  • Size

    7KB

  • MD5

    c8b4efbf7ede4e5741be5e2ae2462b3b

  • SHA1

    dc077b682365eef97c0ced977916fcb117743cf6

  • SHA256

    deec2bd866af640bcaecd5357f54da87dd045c8017a8f8a76ac0068ce43eebaa

  • SHA512

    eb98175eb0486b17ac217e5380ec771666d176fde50a3ecf416aafb2cef7b0e91ec8386417519b51f69fa381834571fbaae1f92a9baec0dc53d80515da5446d6

  • SSDEEP

    192:pRn5hokWxcYy0AkSsDX5VF30Ver0O86+ISMquF4dOryL:fnckWx2kSsDX5P3L7+ISMq24dOryL

Score
10/10

Malware Config

Signatures

  • Detect ZGRat V1 34 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Blocklisted process makes network request 5 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\15052024_1245_Cognex 3512C Doc.js"
    1⤵
    • Blocklisted process makes network request
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Users\Admin\AppData\Roaming\windows.exe
      "C:\Users\Admin\AppData\Roaming\windows.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2832
      • C:\Users\Admin\AppData\Roaming\windows.exe
        "C:\Users\Admin\AppData\Roaming\windows.exe"
        3⤵
        • Executes dropped EXE
        PID:3352

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • \Users\Admin\AppData\Roaming\windows.exe

    Filesize

    4.5MB

    MD5

    ef0124f238734460752a0de9e85501bc

    SHA1

    8dcbd7b8c753329ffc4a68a4bac8c3ab5ba62dfb

    SHA256

    4a299f5b0de81d51e75d45e9b49e830e4230346329d9ed15197ddf1ac2853644

    SHA512

    6aa0476b378bf34eb274ef2b62d8cb12f2c5014cae0e02a6ffea55e4c0fd009e07f8816b23bb6ad2ed57a0a8173668ae3c24f94bcecd131348c5347510fcac3c

  • memory/2832-90-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-4928-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

    Filesize

    9.9MB

  • memory/2832-42-0x000000001C630000-0x000000001C86E000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-48-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-44-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-56-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-60-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-66-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-68-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-72-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-76-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-78-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-82-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-88-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-92-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-98-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-106-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-104-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-102-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-100-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-96-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-94-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-4946-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

    Filesize

    9.9MB

  • memory/2832-41-0x0000000001130000-0x00000000015B0000-memory.dmp

    Filesize

    4.5MB

  • memory/2832-70-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-80-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-74-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-84-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-64-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-62-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-58-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-54-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-52-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-50-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-43-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-46-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-4923-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

    Filesize

    9.9MB

  • memory/2832-4924-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

    Filesize

    9.9MB

  • memory/2832-4925-0x0000000000E30000-0x0000000000EAA000-memory.dmp

    Filesize

    488KB

  • memory/2832-4926-0x0000000000CC0000-0x0000000000D0C000-memory.dmp

    Filesize

    304KB

  • memory/2832-4927-0x000007FEF5A13000-0x000007FEF5A14000-memory.dmp

    Filesize

    4KB

  • memory/2832-86-0x000000001C630000-0x000000001C867000-memory.dmp

    Filesize

    2.2MB

  • memory/2832-4929-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

    Filesize

    9.9MB

  • memory/2832-4930-0x0000000000A60000-0x0000000000AB4000-memory.dmp

    Filesize

    336KB

  • memory/2832-40-0x000007FEF5A13000-0x000007FEF5A14000-memory.dmp

    Filesize

    4KB

  • memory/3352-4944-0x0000000140000000-0x000000014006B000-memory.dmp

    Filesize

    428KB

  • memory/3352-4945-0x0000000140000000-0x000000014006B000-memory.dmp

    Filesize

    428KB