Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27/12/2022, 15:13
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
2.7MB
-
MD5
4f62eb4f1a2c1fc46df059120e6e6cef
-
SHA1
bd2fcde45f562ec5b0c741fa102c3dfa0234d511
-
SHA256
6ee27f5f4be9f1cfeb98b5190367ca60d1c81b527b730d808b4b29e30b44931d
-
SHA512
38c9d721302f345a8c1efcf6d40a735e181b67d2fe8e19bf5a20e6347de325f1c974f553ad640553f1fe3546729600a8d485964a36fbb6d76d7c58244ac72dd3
-
SSDEEP
49152:IvEl6mjUImipdKvT6QD66iMVptYC0qs7QVlWSwI9SrxCsU:IamScvPfOCHs8yCs
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
resource yara_rule behavioral2/memory/736-159-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/736-160-0x0000000140343234-mapping.dmp xmrig behavioral2/memory/736-161-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/736-162-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/736-164-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/736-168-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation file.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3152 set thread context of 736 3152 file.exe 92 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3920 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4380 powershell.exe 4380 powershell.exe 3152 file.exe 3152 file.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 648 Process not Found -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3152 file.exe Token: SeDebugPrivilege 4380 powershell.exe Token: SeLockMemoryPrivilege 736 vbc.exe Token: SeLockMemoryPrivilege 736 vbc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 736 vbc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3152 wrote to memory of 4380 3152 file.exe 81 PID 3152 wrote to memory of 4380 3152 file.exe 81 PID 3152 wrote to memory of 1836 3152 file.exe 89 PID 3152 wrote to memory of 1836 3152 file.exe 89 PID 1836 wrote to memory of 3920 1836 cmd.exe 91 PID 1836 wrote to memory of 3920 1836 cmd.exe 91 PID 3152 wrote to memory of 736 3152 file.exe 92 PID 3152 wrote to memory of 736 3152 file.exe 92 PID 3152 wrote to memory of 736 3152 file.exe 92 PID 3152 wrote to memory of 736 3152 file.exe 92 PID 3152 wrote to memory of 736 3152 file.exe 92 PID 3152 wrote to memory of 736 3152 file.exe 92 PID 3152 wrote to memory of 736 3152 file.exe 92 PID 3152 wrote to memory of 736 3152 file.exe 92 PID 3152 wrote to memory of 736 3152 file.exe 92 PID 3152 wrote to memory of 736 3152 file.exe 92 PID 3152 wrote to memory of 736 3152 file.exe 92 PID 3152 wrote to memory of 736 3152 file.exe 92 PID 3152 wrote to memory of 736 3152 file.exe 92 PID 3152 wrote to memory of 736 3152 file.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"3⤵
- Creates scheduled task(s)
PID:3920
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:736
-