Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/09/2023, 13:06

General

  • Target

    Miner.exe

  • Size

    2.0MB

  • MD5

    b286969b55a9dbb7c7fb450772107ac1

  • SHA1

    7d261c2b4201352af43cd88a7219afe3af2b17aa

  • SHA256

    e953bb0c7b8a595c6980f434c2fdd59ca1140df29854dd1c906f9dfcde779c76

  • SHA512

    2239fd8f38f1f213f7082b155598a5893e8f72da547d1bf1718902a3e5a89c79f51ee9190ab53284961191ce00dad8b42cb9721f40f37af414d8114c2d3f20c1

  • SSDEEP

    49152:I/HRfSRKPhC6K9iDR3Zibb/O9m4Ujc2GCdLx9E:I/0KJC6KMd3Ka9nHryz

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 9 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3236
      • C:\Users\Admin\AppData\Local\Temp\Miner.exe
        "C:\Users\Admin\AppData\Local\Temp\Miner.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1032
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Users\Admin\AppData\Roaming\Google\Libs\g.log"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3272
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic PATH Win32_VideoController GET Name, VideoProcessor
          3⤵
          • Detects videocard installed
          • Suspicious use of AdjustPrivilegeToken
          PID:1304
      • C:\Windows\System32\conhost.exe
        C:\Windows\System32\conhost.exe jqztbiqivvvbervh XofLACsdV31j9ZQMDeZoqO8k37CbBufUtbr98a3F0UKq2eHZ6prMKnKeLE1KJ0BmKx3js3nbFmC9nUtmzAI/apEZkdZ/HBqqFwqwjOlGmpbNsgxwfC7UE0KkdYTYXYCX0NItfrQHGfqEeTIBFz/niyr/GY2yQJNDthEVFGAksnMpteqRSSfuBy5TT3XFuD+M9CLsEOUvj0bT3tKW5RE9A6uK7fNH3wNRI5wtZNZvu1jU9NSYZkbIgG6XoSIiV1C+A8yY0ymKYmnK5I8SwcgYj87wrUoWwTeddjZI5qEwkWcYxC/XdoTojXJSdOMSF/uWXaplnOzByFEiHFR07G6o4rq38HZVxXjqHnYk90zEtdnLkiOCtWjMIVDGXJdWtI1kz0qNiDKjxXxjcX1BfCzCNwwimyKF1MpImDHeV3I8zI0URS6X4yVXd+IJkPVBFfkn
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3916
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
      1⤵
        PID:1192
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3400

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Google\Libs\g.log

        Filesize

        226B

        MD5

        fdba80d4081c28c65e32fff246dc46cb

        SHA1

        74f809dedd1fc46a3a63ac9904c80f0b817b3686

        SHA256

        b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

        SHA512

        b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

      • memory/1032-9-0x00007FF64A8B0000-0x00007FF64AAB0000-memory.dmp

        Filesize

        2.0MB

      • memory/1032-0-0x00007FF64A8B0000-0x00007FF64AAB0000-memory.dmp

        Filesize

        2.0MB

      • memory/3400-23-0x000001C695760000-0x000001C695770000-memory.dmp

        Filesize

        64KB

      • memory/3400-59-0x000001C69DD10000-0x000001C69DD11000-memory.dmp

        Filesize

        4KB

      • memory/3400-58-0x000001C69DC00000-0x000001C69DC01000-memory.dmp

        Filesize

        4KB

      • memory/3400-57-0x000001C69DC00000-0x000001C69DC01000-memory.dmp

        Filesize

        4KB

      • memory/3400-55-0x000001C69DBD0000-0x000001C69DBD1000-memory.dmp

        Filesize

        4KB

      • memory/3400-39-0x000001C695860000-0x000001C695870000-memory.dmp

        Filesize

        64KB

      • memory/3916-13-0x00007FF6FD610000-0x00007FF6FDE04000-memory.dmp

        Filesize

        8.0MB

      • memory/3916-22-0x00007FF6FD610000-0x00007FF6FDE04000-memory.dmp

        Filesize

        8.0MB

      • memory/3916-21-0x00007FF6FD610000-0x00007FF6FDE04000-memory.dmp

        Filesize

        8.0MB

      • memory/3916-16-0x00007FF6FD610000-0x00007FF6FDE04000-memory.dmp

        Filesize

        8.0MB

      • memory/3916-15-0x00007FF6FD610000-0x00007FF6FDE04000-memory.dmp

        Filesize

        8.0MB

      • memory/3916-14-0x00007FF6FD610000-0x00007FF6FDE04000-memory.dmp

        Filesize

        8.0MB

      • memory/3916-12-0x00007FF6FD610000-0x00007FF6FDE04000-memory.dmp

        Filesize

        8.0MB

      • memory/3916-11-0x000001CDAD470000-0x000001CDAD490000-memory.dmp

        Filesize

        128KB

      • memory/3916-60-0x00007FF6FD610000-0x00007FF6FDE04000-memory.dmp

        Filesize

        8.0MB

      • memory/3916-61-0x00007FF6FD610000-0x00007FF6FDE04000-memory.dmp

        Filesize

        8.0MB

      • memory/3916-62-0x00007FF6FD610000-0x00007FF6FDE04000-memory.dmp

        Filesize

        8.0MB