Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    29/10/2023, 01:44

General

  • Target

    666f5ad3c6b29636a24011639ccc771da5e964ed4d0a22e253febeed53978681.exe

  • Size

    6.9MB

  • MD5

    d2f32b3bf5e7c07ac6ee4918f93c4da3

  • SHA1

    8035c6f1214d806a6f2181c41ae24c21ef1c4913

  • SHA256

    666f5ad3c6b29636a24011639ccc771da5e964ed4d0a22e253febeed53978681

  • SHA512

    5622ae6a36b3fcfc4560ecebfc0bdc446976c6e262322d345888b65e5ead956ff455771fb7ee736b5f1cd8134d2753e6cc6641c39c30b5e787256c23fa3927b0

  • SSDEEP

    98304:bBax0HTtGRoXuo73LIDUae0OEHtpKMbaqALvQIIxNiRo2Zo/AE9aF55FP4elzQH+:AmttF3EDv3p/baqCI3V2W/eL9QL9w

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 12 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 6 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1268
      • C:\Users\Admin\AppData\Local\Temp\666f5ad3c6b29636a24011639ccc771da5e964ed4d0a22e253febeed53978681.exe
        "C:\Users\Admin\AppData\Local\Temp\666f5ad3c6b29636a24011639ccc771da5e964ed4d0a22e253febeed53978681.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in Drivers directory
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        PID:2188
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2788
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1732
        • C:\Windows\System32\sc.exe
          sc stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:2592
        • C:\Windows\System32\sc.exe
          sc stop WaaSMedicSvc
          3⤵
          • Launches sc.exe
          PID:2604
        • C:\Windows\System32\sc.exe
          sc stop wuauserv
          3⤵
          • Launches sc.exe
          PID:2632
        • C:\Windows\System32\sc.exe
          sc stop bits
          3⤵
          • Launches sc.exe
          PID:2664
        • C:\Windows\System32\sc.exe
          sc stop dosvc
          3⤵
          • Launches sc.exe
          PID:1288
      • C:\Windows\System32\schtasks.exe
        C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
        2⤵
          PID:2408
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2640
          • C:\Windows\System32\powercfg.exe
            powercfg /x -hibernate-timeout-ac 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1200
          • C:\Windows\System32\powercfg.exe
            powercfg /x -hibernate-timeout-dc 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2952
          • C:\Windows\System32\powercfg.exe
            powercfg /x -standby-timeout-ac 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2968
          • C:\Windows\System32\powercfg.exe
            powercfg /x -standby-timeout-dc 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2984
        • C:\Windows\System32\schtasks.exe
          C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\ecuijhvxegrk.xml"
          2⤵
          • Creates scheduled task(s)
          PID:2888
        • C:\Windows\System32\schtasks.exe
          C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
          2⤵
            PID:2964
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
            2⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:792
          • C:\Windows\System32\cmd.exe
            C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:516
            • C:\Windows\System32\sc.exe
              sc stop UsoSvc
              3⤵
              • Launches sc.exe
              PID:1196
            • C:\Windows\System32\sc.exe
              sc stop WaaSMedicSvc
              3⤵
              • Launches sc.exe
              PID:1520
            • C:\Windows\System32\sc.exe
              sc stop wuauserv
              3⤵
              • Launches sc.exe
              PID:1648
            • C:\Windows\System32\sc.exe
              sc stop bits
              3⤵
              • Launches sc.exe
              PID:1552
            • C:\Windows\System32\sc.exe
              sc stop dosvc
              3⤵
              • Launches sc.exe
              PID:1604
          • C:\Windows\System32\cmd.exe
            C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1504
            • C:\Windows\System32\powercfg.exe
              powercfg /x -hibernate-timeout-ac 0
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2044
            • C:\Windows\System32\powercfg.exe
              powercfg /x -hibernate-timeout-dc 0
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2084
            • C:\Windows\System32\powercfg.exe
              powercfg /x -standby-timeout-ac 0
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2328
            • C:\Windows\System32\powercfg.exe
              powercfg /x -standby-timeout-dc 0
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1052
          • C:\Windows\System32\schtasks.exe
            C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\ecuijhvxegrk.xml"
            2⤵
            • Creates scheduled task(s)
            PID:2460
          • C:\Windows\System32\conhost.exe
            C:\Windows\System32\conhost.exe
            2⤵
              PID:1628
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1248
          • C:\Program Files\Google\Chrome\updater.exe
            "C:\Program Files\Google\Chrome\updater.exe"
            1⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:332

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\Google\Chrome\updater.exe

            Filesize

            6.9MB

            MD5

            d2f32b3bf5e7c07ac6ee4918f93c4da3

            SHA1

            8035c6f1214d806a6f2181c41ae24c21ef1c4913

            SHA256

            666f5ad3c6b29636a24011639ccc771da5e964ed4d0a22e253febeed53978681

            SHA512

            5622ae6a36b3fcfc4560ecebfc0bdc446976c6e262322d345888b65e5ead956ff455771fb7ee736b5f1cd8134d2753e6cc6641c39c30b5e787256c23fa3927b0

          • C:\Program Files\Google\Chrome\updater.exe

            Filesize

            6.9MB

            MD5

            d2f32b3bf5e7c07ac6ee4918f93c4da3

            SHA1

            8035c6f1214d806a6f2181c41ae24c21ef1c4913

            SHA256

            666f5ad3c6b29636a24011639ccc771da5e964ed4d0a22e253febeed53978681

            SHA512

            5622ae6a36b3fcfc4560ecebfc0bdc446976c6e262322d345888b65e5ead956ff455771fb7ee736b5f1cd8134d2753e6cc6641c39c30b5e787256c23fa3927b0

          • C:\Users\Admin\AppData\Local\Temp\ecuijhvxegrk.xml

            Filesize

            1KB

            MD5

            546d67a48ff2bf7682cea9fac07b942e

            SHA1

            a2cb3a9a97fd935b5e62d4c29b3e2c5ab7d5fc90

            SHA256

            eff7edc19e6c430aaeca7ea8a77251c74d1e9abb79b183a9ee1f58c2934b4b6a

            SHA512

            10d90edf31c0955bcec52219d854952fd38768bd97e8e50d32a1237bccaf1a5eb9f824da0f81a7812e0ce62c0464168dd0201d1c0eb61b9fe253fe7c89de05fe

          • C:\Windows\System32\drivers\etc\hosts

            Filesize

            2KB

            MD5

            3e9af076957c5b2f9c9ce5ec994bea05

            SHA1

            a8c7326f6bceffaeed1c2bb8d7165e56497965fe

            SHA256

            e332ebfed27e0bb08b84dfda05acc7f0fa1b6281678e0120c5b7c893a75df47e

            SHA512

            933ba0d69e7b78537348c0dc1bf83fb069f98bb93d31c638dc79c4a48d12d879c474bd61e3cbde44622baef5e20fb92ebf16c66128672e4a6d4ee20afbf9d01f

          • C:\Windows\TEMP\ecuijhvxegrk.xml

            Filesize

            1KB

            MD5

            546d67a48ff2bf7682cea9fac07b942e

            SHA1

            a2cb3a9a97fd935b5e62d4c29b3e2c5ab7d5fc90

            SHA256

            eff7edc19e6c430aaeca7ea8a77251c74d1e9abb79b183a9ee1f58c2934b4b6a

            SHA512

            10d90edf31c0955bcec52219d854952fd38768bd97e8e50d32a1237bccaf1a5eb9f824da0f81a7812e0ce62c0464168dd0201d1c0eb61b9fe253fe7c89de05fe

          • \Program Files\Google\Chrome\updater.exe

            Filesize

            6.9MB

            MD5

            d2f32b3bf5e7c07ac6ee4918f93c4da3

            SHA1

            8035c6f1214d806a6f2181c41ae24c21ef1c4913

            SHA256

            666f5ad3c6b29636a24011639ccc771da5e964ed4d0a22e253febeed53978681

            SHA512

            5622ae6a36b3fcfc4560ecebfc0bdc446976c6e262322d345888b65e5ead956ff455771fb7ee736b5f1cd8134d2753e6cc6641c39c30b5e787256c23fa3927b0

          • memory/332-50-0x000000013F880000-0x000000014022F000-memory.dmp

            Filesize

            9.7MB

          • memory/332-53-0x00000000005A0000-0x00000000005E0000-memory.dmp

            Filesize

            256KB

          • memory/332-73-0x000000013F880000-0x000000014022F000-memory.dmp

            Filesize

            9.7MB

          • memory/332-42-0x000000013F880000-0x000000014022F000-memory.dmp

            Filesize

            9.7MB

          • memory/332-46-0x00000000005A0000-0x00000000005E0000-memory.dmp

            Filesize

            256KB

          • memory/332-39-0x000000013F880000-0x000000014022F000-memory.dmp

            Filesize

            9.7MB

          • memory/332-51-0x000000013F880000-0x000000014022F000-memory.dmp

            Filesize

            9.7MB

          • memory/332-44-0x00000000005A0000-0x00000000005E0000-memory.dmp

            Filesize

            256KB

          • memory/792-59-0x000007FEF4580000-0x000007FEF4F1D000-memory.dmp

            Filesize

            9.6MB

          • memory/792-57-0x00000000009A0000-0x00000000009A8000-memory.dmp

            Filesize

            32KB

          • memory/792-56-0x0000000019CC0000-0x0000000019FA2000-memory.dmp

            Filesize

            2.9MB

          • memory/792-58-0x000007FEF4580000-0x000007FEF4F1D000-memory.dmp

            Filesize

            9.6MB

          • memory/792-60-0x00000000010D0000-0x0000000001150000-memory.dmp

            Filesize

            512KB

          • memory/792-61-0x00000000010D0000-0x0000000001150000-memory.dmp

            Filesize

            512KB

          • memory/792-62-0x00000000010D0000-0x0000000001150000-memory.dmp

            Filesize

            512KB

          • memory/792-63-0x000007FEF4580000-0x000007FEF4F1D000-memory.dmp

            Filesize

            9.6MB

          • memory/1248-72-0x00000000000B0000-0x00000000000D0000-memory.dmp

            Filesize

            128KB

          • memory/1248-74-0x0000000000500000-0x0000000000520000-memory.dmp

            Filesize

            128KB

          • memory/1248-87-0x0000000140000000-0x0000000140840000-memory.dmp

            Filesize

            8.2MB

          • memory/1248-85-0x0000000140000000-0x0000000140840000-memory.dmp

            Filesize

            8.2MB

          • memory/1248-83-0x0000000140000000-0x0000000140840000-memory.dmp

            Filesize

            8.2MB

          • memory/1248-81-0x0000000140000000-0x0000000140840000-memory.dmp

            Filesize

            8.2MB

          • memory/1248-79-0x0000000140000000-0x0000000140840000-memory.dmp

            Filesize

            8.2MB

          • memory/1248-77-0x0000000000500000-0x0000000000520000-memory.dmp

            Filesize

            128KB

          • memory/1248-76-0x0000000140000000-0x0000000140840000-memory.dmp

            Filesize

            8.2MB

          • memory/1628-75-0x0000000140000000-0x0000000140013000-memory.dmp

            Filesize

            76KB

          • memory/2188-5-0x000000013F080000-0x000000013FA2F000-memory.dmp

            Filesize

            9.7MB

          • memory/2188-35-0x000000013F080000-0x000000013FA2F000-memory.dmp

            Filesize

            9.7MB

          • memory/2188-2-0x000000013F080000-0x000000013FA2F000-memory.dmp

            Filesize

            9.7MB

          • memory/2188-7-0x00000000000E0000-0x0000000000120000-memory.dmp

            Filesize

            256KB

          • memory/2188-4-0x00000000000E0000-0x0000000000120000-memory.dmp

            Filesize

            256KB

          • memory/2188-11-0x000000013F080000-0x000000013FA2F000-memory.dmp

            Filesize

            9.7MB

          • memory/2188-12-0x00000000000E0000-0x0000000000120000-memory.dmp

            Filesize

            256KB

          • memory/2788-25-0x000007FEF45F0000-0x000007FEF4F8D000-memory.dmp

            Filesize

            9.6MB

          • memory/2788-26-0x0000000002700000-0x0000000002780000-memory.dmp

            Filesize

            512KB

          • memory/2788-27-0x0000000002700000-0x0000000002780000-memory.dmp

            Filesize

            512KB

          • memory/2788-28-0x000007FEF45F0000-0x000007FEF4F8D000-memory.dmp

            Filesize

            9.6MB

          • memory/2788-20-0x000000001B170000-0x000000001B452000-memory.dmp

            Filesize

            2.9MB

          • memory/2788-21-0x000007FEF45F0000-0x000007FEF4F8D000-memory.dmp

            Filesize

            9.6MB

          • memory/2788-22-0x0000000002700000-0x0000000002780000-memory.dmp

            Filesize

            512KB

          • memory/2788-23-0x0000000002350000-0x0000000002358000-memory.dmp

            Filesize

            32KB

          • memory/2788-24-0x0000000002700000-0x0000000002780000-memory.dmp

            Filesize

            512KB