Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2023, 06:18
Static task
static1
Behavioral task
behavioral1
Sample
7660e27373eddbf82fee79ac5838842e96eb27f677a733a3dfc467f221f62c22.exe
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
7660e27373eddbf82fee79ac5838842e96eb27f677a733a3dfc467f221f62c22.exe
Resource
win7-20230220-en
General
-
Target
7660e27373eddbf82fee79ac5838842e96eb27f677a733a3dfc467f221f62c22.exe
-
Size
508KB
-
MD5
223fa5bc526acf4e31c21f1eacf08f23
-
SHA1
0297e7e9934185150f98f20d5c59e481fb01a817
-
SHA256
7660e27373eddbf82fee79ac5838842e96eb27f677a733a3dfc467f221f62c22
-
SHA512
24861dbf9e719b5b67d3fd7a606135fa7daeaa907bbcaf3f670eebbd551da63762588281fdd57e1a9d863efa702fd806defd0a295c258100c90324ae61b3460f
-
SSDEEP
12288:Z8DSlNIUS3uqIUOjtZlPM18xIR0VhhSePmAUbqS2tn5PAhCJgyDX:wwOUSeqOjhi28pNbqSSmsv
Malware Config
Signatures
-
XMRig Miner payload 22 IoCs
resource yara_rule behavioral3/memory/2192-151-0x0000000140000000-0x00000001407C3000-memory.dmp xmrig behavioral3/memory/2192-152-0x0000000140000000-0x00000001407C3000-memory.dmp xmrig behavioral3/memory/2192-153-0x0000000140000000-0x00000001407C3000-memory.dmp xmrig behavioral3/memory/2192-155-0x0000000140000000-0x00000001407C3000-memory.dmp xmrig behavioral3/memory/2192-156-0x0000000140000000-0x00000001407C3000-memory.dmp xmrig behavioral3/memory/2192-157-0x0000000140000000-0x00000001407C3000-memory.dmp xmrig behavioral3/memory/2192-158-0x0000000140000000-0x00000001407C3000-memory.dmp xmrig behavioral3/memory/2192-160-0x0000000140000000-0x00000001407C3000-memory.dmp xmrig behavioral3/memory/2192-161-0x0000000140000000-0x00000001407C3000-memory.dmp xmrig behavioral3/memory/2192-163-0x0000000140000000-0x00000001407C3000-memory.dmp xmrig behavioral3/memory/2192-164-0x0000000140000000-0x00000001407C3000-memory.dmp xmrig behavioral3/memory/2192-165-0x0000000140000000-0x00000001407C3000-memory.dmp xmrig behavioral3/memory/2192-166-0x0000000140000000-0x00000001407C3000-memory.dmp xmrig behavioral3/memory/2192-167-0x0000000140000000-0x00000001407C3000-memory.dmp xmrig behavioral3/memory/2192-168-0x0000000140000000-0x00000001407C3000-memory.dmp xmrig behavioral3/memory/2192-169-0x0000000140000000-0x00000001407C3000-memory.dmp xmrig behavioral3/memory/2192-170-0x0000000140000000-0x00000001407C3000-memory.dmp xmrig behavioral3/memory/2192-172-0x0000000140000000-0x00000001407C3000-memory.dmp xmrig behavioral3/memory/2192-173-0x0000000140000000-0x00000001407C3000-memory.dmp xmrig behavioral3/memory/2192-174-0x0000000140000000-0x00000001407C3000-memory.dmp xmrig behavioral3/memory/2192-175-0x0000000140000000-0x00000001407C3000-memory.dmp xmrig behavioral3/memory/2192-176-0x0000000140000000-0x00000001407C3000-memory.dmp xmrig -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EDGIHJLwAxCE.exe powercfg.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EDGIHJLwAxCE.exe powercfg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3108 set thread context of 1520 3108 7660e27373eddbf82fee79ac5838842e96eb27f677a733a3dfc467f221f62c22.exe 83 PID 1520 set thread context of 2192 1520 powercfg.exe 91 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1520 powercfg.exe 1520 powercfg.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 664 Process not Found -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1520 powercfg.exe Token: SeLockMemoryPrivilege 2192 InputSwitchToastHandler.exe Token: SeLockMemoryPrivilege 2192 InputSwitchToastHandler.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2192 InputSwitchToastHandler.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3108 wrote to memory of 1520 3108 7660e27373eddbf82fee79ac5838842e96eb27f677a733a3dfc467f221f62c22.exe 83 PID 3108 wrote to memory of 1520 3108 7660e27373eddbf82fee79ac5838842e96eb27f677a733a3dfc467f221f62c22.exe 83 PID 3108 wrote to memory of 1520 3108 7660e27373eddbf82fee79ac5838842e96eb27f677a733a3dfc467f221f62c22.exe 83 PID 3108 wrote to memory of 1520 3108 7660e27373eddbf82fee79ac5838842e96eb27f677a733a3dfc467f221f62c22.exe 83 PID 3108 wrote to memory of 1520 3108 7660e27373eddbf82fee79ac5838842e96eb27f677a733a3dfc467f221f62c22.exe 83 PID 3108 wrote to memory of 1520 3108 7660e27373eddbf82fee79ac5838842e96eb27f677a733a3dfc467f221f62c22.exe 83 PID 3108 wrote to memory of 1520 3108 7660e27373eddbf82fee79ac5838842e96eb27f677a733a3dfc467f221f62c22.exe 83 PID 3108 wrote to memory of 1520 3108 7660e27373eddbf82fee79ac5838842e96eb27f677a733a3dfc467f221f62c22.exe 83 PID 3108 wrote to memory of 1520 3108 7660e27373eddbf82fee79ac5838842e96eb27f677a733a3dfc467f221f62c22.exe 83 PID 3108 wrote to memory of 1520 3108 7660e27373eddbf82fee79ac5838842e96eb27f677a733a3dfc467f221f62c22.exe 83 PID 1520 wrote to memory of 2192 1520 powercfg.exe 91 PID 1520 wrote to memory of 2192 1520 powercfg.exe 91 PID 1520 wrote to memory of 2192 1520 powercfg.exe 91 PID 1520 wrote to memory of 2192 1520 powercfg.exe 91 PID 1520 wrote to memory of 2192 1520 powercfg.exe 91 PID 1520 wrote to memory of 2192 1520 powercfg.exe 91 PID 1520 wrote to memory of 2192 1520 powercfg.exe 91 PID 1520 wrote to memory of 2192 1520 powercfg.exe 91 PID 1520 wrote to memory of 2192 1520 powercfg.exe 91 PID 1520 wrote to memory of 2192 1520 powercfg.exe 91 PID 1520 wrote to memory of 2192 1520 powercfg.exe 91 PID 1520 wrote to memory of 2192 1520 powercfg.exe 91 PID 1520 wrote to memory of 2192 1520 powercfg.exe 91 PID 1520 wrote to memory of 2192 1520 powercfg.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\7660e27373eddbf82fee79ac5838842e96eb27f677a733a3dfc467f221f62c22.exe"C:\Users\Admin\AppData\Local\Temp\7660e27373eddbf82fee79ac5838842e96eb27f677a733a3dfc467f221f62c22.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SysWOW64\powercfg.exe"C:\Windows\system32\powercfg.exe"2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\system32\InputSwitchToastHandler.exe"C:\Windows\system32\InputSwitchToastHandler.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2192
-
-