Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
108s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
10/09/2024, 12:56
General
-
Target
ProjectZen.rar
-
Size
66.3MB
-
MD5
5ddbbeebbc483509361579fc6b7d4136
-
SHA1
5415cf6b36315b8766a9201c81b84d82f9c2214f
-
SHA256
bb6e918af5bfb3f822303ecb08b16fcf901f0a98aad04e7a3fe77fe971e53fe6
-
SHA512
49b898351e686eddc45b21c420270ea5f466914d8324898329c727aeeedd35b8ae2a1c18611f33c7519f8c6e76cbca66d4ebf61263be1fef7e83963fb924d311
-
SSDEEP
1572864:spaaPwUGKpmuPWacLoXKNLd8Yq8i5JYfgAuxAgsC:zaPw5OzaLoaNLG8i5agAcj3
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 64 IoCs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 36 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ProjectZen.rar1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap23940:78:7zEvent186341⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\ProjectZen\ProjectZEN.exe"C:\Users\Admin\Desktop\ProjectZen\ProjectZEN.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\ProjectZen\Final loaderr.exe"C:\Users\Admin\Desktop\ProjectZen\Final loaderr.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\ProjectZen\dnSpy-net-win32\dnspy.exe"C:\Users\Admin\Desktop\ProjectZen\dnSpy-net-win32\dnspy.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5634d5dcbfa799dcc787e43491a0f872a
SHA1e8e6c8a5592ff4e623e8480b3d8a746ca1c1e371
SHA2566adc8fcada4d158f9338fd16ff0432cf70eb9f94aacbf5689f926873a04ed106
SHA512c739cc7af24a909a933525543296cc9ed9f7d880b622e77aeaaadfd62fe63ed34a5f6bc1a438602ae75ccb6fbc5095f84af9d271a6fc14415350d10a916f6fa7
-
Filesize
345KB
MD534ea7f7d66563f724318e322ff08f4db
SHA1d0aa8038a92eb43def2fffbbf4114b02636117c5
SHA256c2c12d31b4844e29de31594fc9632a372a553631de0a0a04c8af91668e37cf49
SHA512dceb1f9435b9479f6aea9b0644ba8c46338a7f458c313822a9d9b3266d79af395b9b2797ed3217c7048db8b22955ec6fe8b0b1778077fa1de587123ad9e6b148
-
Filesize
228KB
MD53400212d17a0cbcfad04421b50287012
SHA131f8ed25dfacbd0f4586afdcc4c56644586a41e0
SHA256590ed00ce04f13b51e33a135edd713ce0ef34f20e5394940a5d77b35f637b10f
SHA512ddcd0a1d2a33f1fbcb153009c415e96c0d3e5063b6b931414dcf94bf550aca51bdc6b6318a109495a3a0fd744b61c0bb1ae8c51f4b7f62f27a949e6c7cdd652a
-
Filesize
2.2MB
MD5bcbbe8fae3606a93dda5a928d0854b80
SHA1fe7eb458ec8f757004aeeff72597a99f6d039f26
SHA256b6fac24c66e387282d3ebc9e7fd2127ef781863237dd37249844f4cd80c203cd
SHA5122ceb87596406d398f9147e4533561fe7dadded9cd5a4459f8184634d9265e4d947def593cde879027bb8e7bc624c062bc166964bb181c41b35f082778ae549e3
-
Filesize
463KB
MD59efdf7e3043bedac1def2e1fb35d8d47
SHA133129887e03d39a55c743bca284d5f8fb7c958f0
SHA256f8974f43e3253f023240d5f08ca762fb48d91ae01049ee58485e269db60c5ed8
SHA512f19590dff98cbba08bce9d50e5942158af1c85c2e644f942495ffdc57babae8305f6d0b447e3f178be535784927d8b213e8669c0004629a27daa95e1833b37bc
-
Filesize
21KB
MD54d2c915b523026d5abc005b1a72a8bdb
SHA1b5306a105c8f27049d8502580c36c1b7948d9ad4
SHA2562399f3cefd4df7ac452d7ffd106fc9e1c6d14e2888d01c1405d371b29073299e
SHA51262343b50f046fd80d2e7cce13510ca694a714626ea95157127412b2e5eb32e58670fa4fbf6f2c451c86b3902b3f4e7f2f064ce64902336e23e17aa01a4ed4284
-
Filesize
7.6MB
MD55919281fc845c2231ecda3f0a61766bd
SHA181bf250dbea3adcf81e063d72fe07037793f81fd
SHA256eae2aaa6f89e83c3841898be7b3ba94a773138f13943a36ac889d15972aba62c
SHA512baec4cc7241936bbd04a5e91ca92b7b3d87205a8c9c023adca806747ab96d20be679ea45c0e241311724d2f36864aa5ac1ccc33c809686e91e435b7a71ca6732
-
Filesize
84KB
MD5ba890f474a25b8d56b102e5a340d5558
SHA14fa0666e3a85835685fe44e84836b87fca3bab67
SHA256b150f551fe266d81a9cc46d9c98e461ea163023604b5396edd57b10aae38effe
SHA512fdffe9b21c130306ba7d10b9a69b9e20769cf3b0a8108d6a2d99aba69670864a8075aa587dab57366e933af66b645b1ffa54e775bab91f4f17ebf877d0eeb5bd
-
Filesize
14KB
MD56f8736e618b2fe423eb4db806f8cf487
SHA194a58f3855cb4bc60d0203807e40df4abbb6bb5a
SHA2563605170ff9d76a264f2a95c41e62140c55b8da629683b5367aade5791f79175e
SHA512fadfe5cfbdf2d416befcc1fbb6d392ba9156ed85646b5dce06a27e01fac593575a815c8f4b7a707bc0dff23ee8b7f8949d7ea16354052b5493df0b5361deda78
-
Filesize
14KB
MD5662d49d915925d421e8489a78964df12
SHA13cc9397233bd6ffb218ed4d7403537f8ca931f5d
SHA2563ad16ad5d3d760e9b216281f9f67906fbef15a1a3a8c7a7694d2795c8f170e1a
SHA5124ea940cdc7ed7a6d5afd2a5dc43d1ee0598fca7d63cfebad5bafa4fa23cf668c27fe401cafcbb509b5f5b43c10db7465cf5838c55620abafe60f42694ff7ff29
-
Filesize
190KB
MD5232510448ce8e417e01cd10fe78d4932
SHA18ba8aa3a3f74a7cee892aeea44906b67b34e75e5
SHA25698615dfaf418992d36acc335b56268dee1ad18de98f28a7802139210ad61bfc1
SHA512ffbae469553ee824c57a310322164f03fd12953f97d7e863c855889358ab13dd771ef91ff06321775750b202b9a7e04eb9426da1b59e5cd48f00b97671696637
-
Filesize
8.2MB
MD5677daf60c0ef7d4c5e7566d56b63e336
SHA10b9a1d8b16fd84072f214862b19c2b17923792bf
SHA256fc212d3841c81d50518c066333b9ccef9346d86d679bd6cac19771b0d23bb8c9
SHA51292372aa3bcf7a87d93cf61681a5b3acf1b72b065458b49230e88e29d7d9186ace47397240a6d6fadae5a9847dd4b3610693c4f4a516c8be3a8993f8bfdac6cbc
-
Filesize
17KB
MD501b9a8843838629b55b50305af9a9598
SHA16183061dace06a1a9ff7461692b5a7395d15128c
SHA2568f6bcd64e9bdccdc9532aeb2725a2adc21ba944bd1f6b3a7757025af44eaf2a3
SHA512bcf533b1daddbe857f61def987a7e7c45a8864f7d9fac7bc5f9246ecb2bd7ca515b936fbb8e0837203a96da3ac07b28aaf3c8327dbdccd32c254798d01dfe9cd
-
Filesize
16KB
MD5846f1997a38f1cd4c254f2956a7ae561
SHA1dc07b019fec32db20c05bedc24b85cc713979007
SHA256141b0f1c8dce03c86ed052cd09e3c302b1ac4909e3ddeafa10ecb49a3d5484bd
SHA512bdcd43771cea6dd1d91253f3b739fa1bfa21a3553cbeef632e4a138769fdc6872267e93466579711dfd5d4679b4476386b7202ce8905f78697c690e89906fdca
-
Filesize
44KB
MD5888b666d4c6e049084613552946193e2
SHA10fd85ee9d0b096fd71f98817425b1d9622463b40
SHA2560c086fb84072558569192dbc99cf13f77a9fae2dd0049366f544ee7f41519af9
SHA51246dab991a55d55c2b8ef09627851a88b53026762dcb6092316b83a89eb3c6a07df9aba49ba23550b538767074bbfb0002612bbb49a94b88ddd1a3c76ee263fd6
-
Filesize
41KB
MD51b8e5c63925265e061554c07e88a1d63
SHA168a1acebe957fde02c64f11f689ac833e8e248e7
SHA2563c84a57c7fe42bffc2803d0b49994a796dd4aa479a035de003da006a08eba856
SHA5121d06968f32675756c85b44fc3cb67af8249210754f211b8e896f99fc7d025d4494e9f7aef3ca8d7827ae6399760ca0144fa9b73186e82e621c62267fc7a7d558
-
Filesize
71KB
MD58df5383909f3a0e0c8090f3364035b26
SHA1796e5e051becadbd37c0af27fee9c4846c16bede
SHA256dbc85fb9166f8c25424b1ce95c57113cedd7403a608016a424656f5634c22c29
SHA512c5cd9aa2ce4d53603e93a5deb8d03abb91a06c28c28fcf16d90dd7caa967db45932d05fc776afe41f981f1bfb490f6ba06c3adaa89294d7dee4d29c3e9eec760
-
Filesize
1.9MB
MD56ed75d8809b566c304cf3d0d22ac8b16
SHA1bc49a8bf77c510d922293afb1308fccc464be2a6
SHA2569966d7144cda77f80beaf933d536f6a63fcd91c01abdb3436d784a1299102aec
SHA5120f11b1cb8497f5649dce7d74047ae7e163e47932413de3a11887c517e17447e5c15ad604e98a0a04b13a316cc753a44f3b30f2258d9a3cc08fe08c2c45c8b1a0
-
Filesize
1.1MB
MD54a3121fea51793566df439932cb42069
SHA1c21ef3473818c038313cfdb6208ea73e78556373
SHA2569646326e52db7b28c19269f34d2ca937800deb16b3f97b9bcb634ee9669e5c9b
SHA5125f65c97467c13111a7e88108e999d6b1b26e9c94c8cf5a63d5237080d9936c39dd1ba4c760b190906a841abc41e38d09cb6ca2310a11b510b8a575fa4a86f997
-
Filesize
4.0MB
MD547802bf022d47dd533f9196227c37962
SHA15f289d2cdcf8c98fc0789cbbb34a1b203e4f7c9d
SHA2568d87d4b97ce741746619da01b746caac150000c37bc43ed0e909f71a63c57a09
SHA5129059aa503eb517e440529d81d809e8ed4c97018fc98592bd7fca3a14587b7d93ed323460f31bebb4de21206f28b22a9db3dcb56a1653d040e1bf056eb62991dc
-
Filesize
945KB
MD55897a5f8bb3fdbaea1f5d37f1a0137e5
SHA1ad75c9397106112ae52dd1cb93899d81ea0c2d6b
SHA256a06639a52050f3d0f4644ccd55c7ba1572a7f63b5cf51067f8e9088f7cae2449
SHA5127f6567700efa2b8b01193e58992dbba714c21ba9e67896a39247335886c0f4e6a210d0023b6b7559c509131f83d99e2f16acbd08b0c4ad672b15582bfc234add
-
Filesize
172KB
MD5f7097ba79caf67216ca6396612b5b103
SHA1e789974773f1b71833fa235ad8ef9f840fc8a61e
SHA2568be71d9e9c86ade76e8c938349c0d8a3a7261bc0cd42bcf4539c052a17e2f572
SHA512608e5d89483d6a496580ef4c91e7bec301d1e24f209721c87b67d8ebbc6fa2d1aecdddfd0e15f5cf529d813aac0b1b71e6ca716b83815c3e8bd9b1562c23da8d
-
Filesize
3.5MB
MD55213d9619ca9011f09ed3d0d65b48166
SHA154110aa555a2c74f589909fc464ba265bafa8928
SHA2565c5a4f7e178046ab14282d5c3baf025365e6d1b5225d65c78aa6b5b16ab014a1
SHA51222b1100617a6a027db4e781898fe63942b9a1075b40f55ac91783db082ff6264da65f115b5711a0af73b133fab281ef176689ca58e26a2fb89fcb07894074d43
-
Filesize
274B
MD5c0bbae9a92c0004f0e48a1303834a4f1
SHA16254cc2e4595c272c88200a569ced499f82fb531
SHA256d73d166ed2c36560e74ccd1067673bc17c881d570e09394ddd5ef0ffd3d9e8a4
SHA51229a0025944bc65b708909a18e8d42723de52b5bf9fb191ab7936090f51edc4430791f341229f204e875d0673b046bc71e73842babc72312e19eb9c9019549272
-
Filesize
1.1MB
MD54d0b771879de85137ee7e5f0d4bb4b16
SHA1fc32cccd0cd5c3ebd968bcdf48e32a7ea25e9bd7
SHA256962332e8c8cb459fb2f7dacec5d7a618cc53b1b49bc1740156398c89742f43fd
SHA512bae39862ea07ebc5c9aa07a7333a880471baf4bf52eebedc03536e45584887eecc1075e0c0171229a54900ab93a66db9f666aa631c160912f538666da8c9e980
-
Filesize
380KB
MD5b106c19b77ea09a4e0c4cbdd37fc1d74
SHA181991d5bb96d4a5b404e581b96d8058a7f4d20ed
SHA256fcf198db8f15c3f3d500b7d3c4a3582fe5f3494b02fe773b974b1d65274289f3
SHA512d3a93309337be24c59c62cc69b4aba8d2c9184f5c905a86591873e60b1ee53db9bd4b737fc67ed39b3f7201ba12cf16f894389724cabbd1ffeb9292e8bbc683c
-
Filesize
381KB
MD5d5b36fea86bb8eb0ded938283b41486f
SHA17ac2b915389f9369ae5912229fc0ccd82a7c8c5e
SHA25630581b893bfaf0d0aaba0f4ebe9303425d34b4c03b2a494dbeef2f18aeb1b5e0
SHA5123bf4c6dad439e00c12e649ecb88ce0fe36773d739e7fb695007eea40039edb54582e2bbaacaa919b2cd97ff0aaca0fa601500d02bf1c9f5a7bc915760e4225b3
-
Filesize
55KB
MD5621c0c395426423f52b7b644f024f6ea
SHA1b8a8c55b541cc7a347b8a870363dd96951dafac3
SHA256f1fefb476ca5dd10a254e6a415c17ee916db36af930cdcb169848410cdc48498
SHA512d125394d64ebe929748883ac0828eadf20098a294971f80cab7c535c324ecd26d7126d607efa4c6bca2e3c77455f04570522eafbc769e8e870b86322fa260f1e
-
Filesize
111KB
MD594f395ad732ac095583cab60a17ef73f
SHA1f8ae51901cadbf8b31fc5c7aa467e1658e7394f5
SHA25689e927dfedb268c74e96e9a5016fe201f57344f4b80a145ca7bc24776f2fff40
SHA512dfcb6afa246fa2358da5047e86de0925bdd4e70a368c8901240008a05a12acfe280f67aea561e6ad47f2564ff33f0784b2fa8f72fb2c8d0d9e39b37e60853bdd
-
Filesize
178KB
MD56e2e86e49d9f0faa7107f00d4d856a86
SHA10cb7e7d7482f7316a93dfb490df749517d7a06c2
SHA256937de02ba7a3522404b82fa09acece6a3063c40df760ba4fc6a3344083d5eb12
SHA512468e5f2d70b41dc829a415fe4a6a5c22bc962526d6e0928fe78c2d33c6a6eddd0b5ba6cefaa7457ca242b14c40f7c9750412802dd16ee155b3b33a74b42976bc
-
Filesize
1.1MB
MD5de0069c4097c987bd30ebe8155a8af35
SHA1aced007f4d852d7b84c689a92d9c36e24381d375
SHA25683445595d38a8e33513b33dfc201983af4746e5327c9bed470a6282d91d539b6
SHA51266c45818e5c555e5250f8250ea704bc4ca32ddb4d5824c852ae5dc0f264b009af73c7c1e0db1b74c14ee6b612608d939386da23b56520cac415cd5a8f60a5502
-
Filesize
368KB
-
Filesize
1.1MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
5.6MB
-
Filesize
256KB
-
Filesize
2.1MB
-
Filesize
2.3MB
-
Filesize
240KB
-
Filesize
72KB