Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    166s
  • platform
    windows10-1703_x64
  • resource
    win10-20230915-en
  • resource tags

    arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12/10/2023, 01:27

General

  • Target

    696dba35ecabffa21188d3717683a9206d13adf25d2b0fa4330787fd1b5de768.exe

  • Size

    5.2MB

  • MD5

    1c03c03c559f45cd292ebfd073201dd5

  • SHA1

    f90581a94254d7957c8672994a8c636b33236f75

  • SHA256

    696dba35ecabffa21188d3717683a9206d13adf25d2b0fa4330787fd1b5de768

  • SHA512

    41066db969cafd24508f7cc75c4a60bbba3772546e6c255b767130556294abe805d649272f48e739f4d56132c48970d47d5e18488fd9ebabe10ece048ec450f0

  • SSDEEP

    98304:/fBrF6F59tdDZRL19sH6Gk5W5DPios5bWpm8E0TCMc+geQf8n0+iAORP/:3xF6L9tdDZRZeHVk5g1MbWpm8E0G9+Pu

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 12 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 10 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 47 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2296
      • C:\Users\Admin\AppData\Local\Temp\696dba35ecabffa21188d3717683a9206d13adf25d2b0fa4330787fd1b5de768.exe
        "C:\Users\Admin\AppData\Local\Temp\696dba35ecabffa21188d3717683a9206d13adf25d2b0fa4330787fd1b5de768.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in Drivers directory
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        PID:4372
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3292
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4464
        • C:\Windows\System32\sc.exe
          sc stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:3688
        • C:\Windows\System32\sc.exe
          sc stop WaaSMedicSvc
          3⤵
          • Launches sc.exe
          PID:4680
        • C:\Windows\System32\sc.exe
          sc stop wuauserv
          3⤵
          • Launches sc.exe
          PID:2948
        • C:\Windows\System32\sc.exe
          sc stop bits
          3⤵
          • Launches sc.exe
          PID:2860
        • C:\Windows\System32\sc.exe
          sc stop dosvc
          3⤵
          • Launches sc.exe
          PID:3908
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4808
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4408
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4360
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4724
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3956
      • C:\Windows\System32\schtasks.exe
        C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
        2⤵
          PID:4028
        • C:\Windows\System32\schtasks.exe
          C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\qdckzafhhrqu.xml"
          2⤵
          • Creates scheduled task(s)
          PID:4424
        • C:\Windows\System32\schtasks.exe
          C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
          2⤵
            PID:1244
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
            2⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:208
          • C:\Windows\System32\cmd.exe
            C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1196
            • C:\Windows\System32\sc.exe
              sc stop UsoSvc
              3⤵
              • Launches sc.exe
              PID:4156
            • C:\Windows\System32\sc.exe
              sc stop WaaSMedicSvc
              3⤵
              • Launches sc.exe
              PID:4116
            • C:\Windows\System32\sc.exe
              sc stop wuauserv
              3⤵
              • Launches sc.exe
              PID:3544
            • C:\Windows\System32\sc.exe
              sc stop bits
              3⤵
              • Launches sc.exe
              PID:2620
            • C:\Windows\System32\sc.exe
              sc stop dosvc
              3⤵
              • Launches sc.exe
              PID:2624
          • C:\Windows\System32\cmd.exe
            C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4860
            • C:\Windows\System32\powercfg.exe
              powercfg /x -hibernate-timeout-ac 0
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3660
            • C:\Windows\System32\powercfg.exe
              powercfg /x -hibernate-timeout-dc 0
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4624
            • C:\Windows\System32\powercfg.exe
              powercfg /x -standby-timeout-ac 0
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2464
            • C:\Windows\System32\powercfg.exe
              powercfg /x -standby-timeout-dc 0
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4052
          • C:\Windows\System32\schtasks.exe
            C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\qdckzafhhrqu.xml"
            2⤵
            • Creates scheduled task(s)
            PID:2724
          • C:\Windows\System32\conhost.exe
            C:\Windows\System32\conhost.exe
            2⤵
              PID:4044
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3332
          • C:\Program Files\Google\Chrome\updater.exe
            "C:\Program Files\Google\Chrome\updater.exe"
            1⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3752

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\Google\Chrome\updater.exe

            Filesize

            5.2MB

            MD5

            1c03c03c559f45cd292ebfd073201dd5

            SHA1

            f90581a94254d7957c8672994a8c636b33236f75

            SHA256

            696dba35ecabffa21188d3717683a9206d13adf25d2b0fa4330787fd1b5de768

            SHA512

            41066db969cafd24508f7cc75c4a60bbba3772546e6c255b767130556294abe805d649272f48e739f4d56132c48970d47d5e18488fd9ebabe10ece048ec450f0

          • C:\Program Files\Google\Chrome\updater.exe

            Filesize

            5.2MB

            MD5

            1c03c03c559f45cd292ebfd073201dd5

            SHA1

            f90581a94254d7957c8672994a8c636b33236f75

            SHA256

            696dba35ecabffa21188d3717683a9206d13adf25d2b0fa4330787fd1b5de768

            SHA512

            41066db969cafd24508f7cc75c4a60bbba3772546e6c255b767130556294abe805d649272f48e739f4d56132c48970d47d5e18488fd9ebabe10ece048ec450f0

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s2it5e4q.1tt.ps1

            Filesize

            1B

            MD5

            c4ca4238a0b923820dcc509a6f75849b

            SHA1

            356a192b7913b04c54574d18c28d46e6395428ab

            SHA256

            6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

            SHA512

            4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

          • C:\Users\Admin\AppData\Local\Temp\qdckzafhhrqu.xml

            Filesize

            1KB

            MD5

            546d67a48ff2bf7682cea9fac07b942e

            SHA1

            a2cb3a9a97fd935b5e62d4c29b3e2c5ab7d5fc90

            SHA256

            eff7edc19e6c430aaeca7ea8a77251c74d1e9abb79b183a9ee1f58c2934b4b6a

            SHA512

            10d90edf31c0955bcec52219d854952fd38768bd97e8e50d32a1237bccaf1a5eb9f824da0f81a7812e0ce62c0464168dd0201d1c0eb61b9fe253fe7c89de05fe

          • C:\Windows\System32\drivers\etc\hosts

            Filesize

            3KB

            MD5

            00930b40cba79465b7a38ed0449d1449

            SHA1

            4b25a89ee28b20ba162f23772ddaf017669092a5

            SHA256

            eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

            SHA512

            cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

          • C:\Windows\TEMP\qdckzafhhrqu.xml

            Filesize

            1KB

            MD5

            546d67a48ff2bf7682cea9fac07b942e

            SHA1

            a2cb3a9a97fd935b5e62d4c29b3e2c5ab7d5fc90

            SHA256

            eff7edc19e6c430aaeca7ea8a77251c74d1e9abb79b183a9ee1f58c2934b4b6a

            SHA512

            10d90edf31c0955bcec52219d854952fd38768bd97e8e50d32a1237bccaf1a5eb9f824da0f81a7812e0ce62c0464168dd0201d1c0eb61b9fe253fe7c89de05fe

          • memory/208-124-0x000001E223100000-0x000001E22310A000-memory.dmp

            Filesize

            40KB

          • memory/208-215-0x00007FFD4A4F0000-0x00007FFD4AEDC000-memory.dmp

            Filesize

            9.9MB

          • memory/208-182-0x000001E222E60000-0x000001E222E70000-memory.dmp

            Filesize

            64KB

          • memory/208-181-0x000001E222E60000-0x000001E222E70000-memory.dmp

            Filesize

            64KB

          • memory/208-91-0x000001E2235D0000-0x000001E223689000-memory.dmp

            Filesize

            740KB

          • memory/208-85-0x000001E2230E0000-0x000001E2230FC000-memory.dmp

            Filesize

            112KB

          • memory/208-84-0x00007FF70CC00000-0x00007FF70CC10000-memory.dmp

            Filesize

            64KB

          • memory/208-65-0x000001E222E60000-0x000001E222E70000-memory.dmp

            Filesize

            64KB

          • memory/208-62-0x00007FFD4A4F0000-0x00007FFD4AEDC000-memory.dmp

            Filesize

            9.9MB

          • memory/208-64-0x000001E222E60000-0x000001E222E70000-memory.dmp

            Filesize

            64KB

          • memory/3292-9-0x00007FFD4A4F0000-0x00007FFD4AEDC000-memory.dmp

            Filesize

            9.9MB

          • memory/3292-10-0x00000246F6CF0000-0x00000246F6D00000-memory.dmp

            Filesize

            64KB

          • memory/3292-5-0x00000246F6EE0000-0x00000246F6F02000-memory.dmp

            Filesize

            136KB

          • memory/3292-13-0x00000246F6CF0000-0x00000246F6D00000-memory.dmp

            Filesize

            64KB

          • memory/3292-8-0x00000246F7090000-0x00000246F7106000-memory.dmp

            Filesize

            472KB

          • memory/3292-51-0x00007FFD4A4F0000-0x00007FFD4AEDC000-memory.dmp

            Filesize

            9.9MB

          • memory/3292-47-0x00000246F6CF0000-0x00000246F6D00000-memory.dmp

            Filesize

            64KB

          • memory/3292-24-0x00000246F6CF0000-0x00000246F6D00000-memory.dmp

            Filesize

            64KB

          • memory/3332-227-0x0000000000B10000-0x0000000000B30000-memory.dmp

            Filesize

            128KB

          • memory/3332-237-0x00007FF785CE0000-0x00007FF786520000-memory.dmp

            Filesize

            8.2MB

          • memory/3332-247-0x00007FF785CE0000-0x00007FF786520000-memory.dmp

            Filesize

            8.2MB

          • memory/3332-245-0x00007FF785CE0000-0x00007FF786520000-memory.dmp

            Filesize

            8.2MB

          • memory/3332-243-0x00007FF785CE0000-0x00007FF786520000-memory.dmp

            Filesize

            8.2MB

          • memory/3332-241-0x00007FF785CE0000-0x00007FF786520000-memory.dmp

            Filesize

            8.2MB

          • memory/3332-229-0x00007FF785CE0000-0x00007FF786520000-memory.dmp

            Filesize

            8.2MB

          • memory/3332-231-0x00007FF785CE0000-0x00007FF786520000-memory.dmp

            Filesize

            8.2MB

          • memory/3332-233-0x00007FF785CE0000-0x00007FF786520000-memory.dmp

            Filesize

            8.2MB

          • memory/3332-235-0x00007FF785CE0000-0x00007FF786520000-memory.dmp

            Filesize

            8.2MB

          • memory/3332-239-0x00007FF785CE0000-0x00007FF786520000-memory.dmp

            Filesize

            8.2MB

          • memory/3752-58-0x00007FF6CF0A0000-0x00007FF6CF5E3000-memory.dmp

            Filesize

            5.3MB

          • memory/3752-226-0x00007FF6CF0A0000-0x00007FF6CF5E3000-memory.dmp

            Filesize

            5.3MB

          • memory/4044-228-0x00007FF621FF0000-0x00007FF622003000-memory.dmp

            Filesize

            76KB

          • memory/4372-0-0x00007FF7A8EE0000-0x00007FF7A9423000-memory.dmp

            Filesize

            5.3MB

          • memory/4372-56-0x00007FF7A8EE0000-0x00007FF7A9423000-memory.dmp

            Filesize

            5.3MB