Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/10/2023, 05:08

General

  • Target

    tmp.exe

  • Size

    5.2MB

  • MD5

    feadc2cb66640296a34b414114a76c23

  • SHA1

    fa88695d6fffd93fcdd14a2a3ae25fcde3a67942

  • SHA256

    fdbb6e0a160bc94da37c53e26298f29cce2b834f1e24a8ad3dd3f8f176823fc2

  • SHA512

    d53d923b8ea45d5b23a3c1318320bfc467531e00357baa7f6e1559c547415242aa4d100e36012f3aad098cf5a750af4db1fee01da73ae67413d2ef45b1345812

  • SSDEEP

    98304:6YA9ucCHqBvLYwZDgO0bLPrrIRff5eysAGGtzDWJJWAyFwkokfkjWl5auwKrjPff:6RCHqNMwEjAeJJxMokfkjWl5auwKrjPH

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 12 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 11 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 46 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3160
      • C:\Users\Admin\AppData\Local\Temp\tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in Drivers directory
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        PID:680
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4200
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3216
        • C:\Windows\System32\sc.exe
          sc stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:3584
        • C:\Windows\System32\sc.exe
          sc stop WaaSMedicSvc
          3⤵
          • Launches sc.exe
          PID:3136
        • C:\Windows\System32\sc.exe
          sc stop wuauserv
          3⤵
          • Launches sc.exe
          PID:5036
        • C:\Windows\System32\sc.exe
          sc stop bits
          3⤵
          • Launches sc.exe
          PID:1788
        • C:\Windows\System32\sc.exe
          sc stop dosvc
          3⤵
          • Launches sc.exe
          PID:4552
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4640
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1020
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1840
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1148
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5096
      • C:\Windows\System32\schtasks.exe
        C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
        2⤵
          PID:2616
        • C:\Windows\System32\schtasks.exe
          C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\ixagdlgsjvbo.xml"
          2⤵
          • Creates scheduled task(s)
          PID:2796
        • C:\Windows\System32\schtasks.exe
          C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
          2⤵
            PID:3324
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
            2⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2712
          • C:\Windows\System32\cmd.exe
            C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:628
            • C:\Windows\System32\sc.exe
              sc stop UsoSvc
              3⤵
              • Launches sc.exe
              PID:2700
            • C:\Windows\System32\sc.exe
              sc stop WaaSMedicSvc
              3⤵
              • Launches sc.exe
              PID:4992
            • C:\Windows\System32\sc.exe
              sc stop wuauserv
              3⤵
              • Launches sc.exe
              PID:2684
            • C:\Windows\System32\sc.exe
              sc stop bits
              3⤵
              • Launches sc.exe
              PID:4060
            • C:\Windows\System32\sc.exe
              sc stop dosvc
              3⤵
              • Launches sc.exe
              PID:3680
          • C:\Windows\System32\cmd.exe
            C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4616
            • C:\Windows\System32\powercfg.exe
              powercfg /x -hibernate-timeout-ac 0
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1560
            • C:\Windows\System32\powercfg.exe
              powercfg /x -hibernate-timeout-dc 0
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4112
            • C:\Windows\System32\powercfg.exe
              powercfg /x -standby-timeout-ac 0
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2344
            • C:\Windows\System32\powercfg.exe
              powercfg /x -standby-timeout-dc 0
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3260
          • C:\Windows\System32\schtasks.exe
            C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\ixagdlgsjvbo.xml"
            2⤵
            • Creates scheduled task(s)
            PID:832
          • C:\Windows\System32\conhost.exe
            C:\Windows\System32\conhost.exe
            2⤵
              PID:5008
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:756
          • C:\Program Files\Google\Chrome\updater.exe
            "C:\Program Files\Google\Chrome\updater.exe"
            1⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2212

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\Google\Chrome\updater.exe

            Filesize

            5.2MB

            MD5

            feadc2cb66640296a34b414114a76c23

            SHA1

            fa88695d6fffd93fcdd14a2a3ae25fcde3a67942

            SHA256

            fdbb6e0a160bc94da37c53e26298f29cce2b834f1e24a8ad3dd3f8f176823fc2

            SHA512

            d53d923b8ea45d5b23a3c1318320bfc467531e00357baa7f6e1559c547415242aa4d100e36012f3aad098cf5a750af4db1fee01da73ae67413d2ef45b1345812

          • C:\Program Files\Google\Chrome\updater.exe

            Filesize

            5.2MB

            MD5

            feadc2cb66640296a34b414114a76c23

            SHA1

            fa88695d6fffd93fcdd14a2a3ae25fcde3a67942

            SHA256

            fdbb6e0a160bc94da37c53e26298f29cce2b834f1e24a8ad3dd3f8f176823fc2

            SHA512

            d53d923b8ea45d5b23a3c1318320bfc467531e00357baa7f6e1559c547415242aa4d100e36012f3aad098cf5a750af4db1fee01da73ae67413d2ef45b1345812

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zvhebr5o.nxz.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\ixagdlgsjvbo.xml

            Filesize

            1KB

            MD5

            546d67a48ff2bf7682cea9fac07b942e

            SHA1

            a2cb3a9a97fd935b5e62d4c29b3e2c5ab7d5fc90

            SHA256

            eff7edc19e6c430aaeca7ea8a77251c74d1e9abb79b183a9ee1f58c2934b4b6a

            SHA512

            10d90edf31c0955bcec52219d854952fd38768bd97e8e50d32a1237bccaf1a5eb9f824da0f81a7812e0ce62c0464168dd0201d1c0eb61b9fe253fe7c89de05fe

          • C:\Windows\System32\drivers\etc\hosts

            Filesize

            3KB

            MD5

            00930b40cba79465b7a38ed0449d1449

            SHA1

            4b25a89ee28b20ba162f23772ddaf017669092a5

            SHA256

            eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

            SHA512

            cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

          • C:\Windows\TEMP\ixagdlgsjvbo.xml

            Filesize

            1KB

            MD5

            546d67a48ff2bf7682cea9fac07b942e

            SHA1

            a2cb3a9a97fd935b5e62d4c29b3e2c5ab7d5fc90

            SHA256

            eff7edc19e6c430aaeca7ea8a77251c74d1e9abb79b183a9ee1f58c2934b4b6a

            SHA512

            10d90edf31c0955bcec52219d854952fd38768bd97e8e50d32a1237bccaf1a5eb9f824da0f81a7812e0ce62c0464168dd0201d1c0eb61b9fe253fe7c89de05fe

          • memory/680-21-0x00007FF6CB310000-0x00007FF6CB853000-memory.dmp

            Filesize

            5.3MB

          • memory/680-0-0x00007FF6CB310000-0x00007FF6CB853000-memory.dmp

            Filesize

            5.3MB

          • memory/756-87-0x00007FF65A410000-0x00007FF65AC50000-memory.dmp

            Filesize

            8.2MB

          • memory/756-76-0x0000000001D90000-0x0000000001DB0000-memory.dmp

            Filesize

            128KB

          • memory/756-95-0x00007FF65A410000-0x00007FF65AC50000-memory.dmp

            Filesize

            8.2MB

          • memory/756-85-0x00007FF65A410000-0x00007FF65AC50000-memory.dmp

            Filesize

            8.2MB

          • memory/756-91-0x00007FF65A410000-0x00007FF65AC50000-memory.dmp

            Filesize

            8.2MB

          • memory/756-83-0x00007FF65A410000-0x00007FF65AC50000-memory.dmp

            Filesize

            8.2MB

          • memory/756-81-0x00007FF65A410000-0x00007FF65AC50000-memory.dmp

            Filesize

            8.2MB

          • memory/756-79-0x00007FF65A410000-0x00007FF65AC50000-memory.dmp

            Filesize

            8.2MB

          • memory/756-77-0x0000000001DB0000-0x0000000001DD0000-memory.dmp

            Filesize

            128KB

          • memory/756-89-0x00007FF65A410000-0x00007FF65AC50000-memory.dmp

            Filesize

            8.2MB

          • memory/756-75-0x00007FF65A410000-0x00007FF65AC50000-memory.dmp

            Filesize

            8.2MB

          • memory/756-73-0x0000000001DB0000-0x0000000001DD0000-memory.dmp

            Filesize

            128KB

          • memory/756-72-0x0000000001D90000-0x0000000001DB0000-memory.dmp

            Filesize

            128KB

          • memory/756-71-0x00007FF65A410000-0x00007FF65AC50000-memory.dmp

            Filesize

            8.2MB

          • memory/756-69-0x0000000001640000-0x0000000001680000-memory.dmp

            Filesize

            256KB

          • memory/756-93-0x00007FF65A410000-0x00007FF65AC50000-memory.dmp

            Filesize

            8.2MB

          • memory/756-67-0x0000000000BE0000-0x0000000000C00000-memory.dmp

            Filesize

            128KB

          • memory/2212-68-0x00007FF71A240000-0x00007FF71A783000-memory.dmp

            Filesize

            5.3MB

          • memory/2212-23-0x00007FF71A240000-0x00007FF71A783000-memory.dmp

            Filesize

            5.3MB

          • memory/2712-33-0x00007FFF54E30000-0x00007FFF558F1000-memory.dmp

            Filesize

            10.8MB

          • memory/2712-47-0x000002D5F2EB0000-0x000002D5F2F65000-memory.dmp

            Filesize

            724KB

          • memory/2712-55-0x000002D5F0B30000-0x000002D5F0B40000-memory.dmp

            Filesize

            64KB

          • memory/2712-54-0x000002D5F3110000-0x000002D5F311A000-memory.dmp

            Filesize

            40KB

          • memory/2712-53-0x000002D5F3100000-0x000002D5F3106000-memory.dmp

            Filesize

            24KB

          • memory/2712-34-0x000002D5F0B30000-0x000002D5F0B40000-memory.dmp

            Filesize

            64KB

          • memory/2712-52-0x000002D5F30D0000-0x000002D5F30D8000-memory.dmp

            Filesize

            32KB

          • memory/2712-51-0x000002D5F3120000-0x000002D5F313A000-memory.dmp

            Filesize

            104KB

          • memory/2712-50-0x000002D5F30C0000-0x000002D5F30CA000-memory.dmp

            Filesize

            40KB

          • memory/2712-49-0x000002D5F30E0000-0x000002D5F30FC000-memory.dmp

            Filesize

            112KB

          • memory/2712-48-0x000002D5F2F70000-0x000002D5F2F7A000-memory.dmp

            Filesize

            40KB

          • memory/2712-58-0x00007FFF54E30000-0x00007FFF558F1000-memory.dmp

            Filesize

            10.8MB

          • memory/2712-36-0x00007FF4EC990000-0x00007FF4EC9A0000-memory.dmp

            Filesize

            64KB

          • memory/2712-46-0x000002D5F0B10000-0x000002D5F0B2C000-memory.dmp

            Filesize

            112KB

          • memory/2712-35-0x000002D5F0B30000-0x000002D5F0B40000-memory.dmp

            Filesize

            64KB

          • memory/4200-16-0x00007FFF54E30000-0x00007FFF558F1000-memory.dmp

            Filesize

            10.8MB

          • memory/4200-12-0x000001DCFC000000-0x000001DCFC010000-memory.dmp

            Filesize

            64KB

          • memory/4200-13-0x000001DCFC000000-0x000001DCFC010000-memory.dmp

            Filesize

            64KB

          • memory/4200-11-0x00007FFF54E30000-0x00007FFF558F1000-memory.dmp

            Filesize

            10.8MB

          • memory/4200-10-0x000001DCFE2D0000-0x000001DCFE2F2000-memory.dmp

            Filesize

            136KB

          • memory/5008-70-0x00007FF7D19A0000-0x00007FF7D19B3000-memory.dmp

            Filesize

            76KB