Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2023, 10:40
Behavioral task
behavioral1
Sample
0aa37ab18bc6dcfb45b32b7047097884.exe
Resource
win7-20231215-en
General
-
Target
0aa37ab18bc6dcfb45b32b7047097884.exe
-
Size
784KB
-
MD5
0aa37ab18bc6dcfb45b32b7047097884
-
SHA1
6acbd188621580c44fa96ebc03b1a67a8c914163
-
SHA256
713be6d900c555cbd5b338109ea64d99aa2801b9ec51646c73eeeeb74145d61b
-
SHA512
eb6748d3d207d004719694bf46dbab8def1d256609677a66a688435cef10e304b30482ee5a0a9b2d774efca300c3ff2b31c6bcaf95212dbe784b92f4fc531c66
-
SSDEEP
24576:r9kq38MC1m7G+2+sw+MS0NsA1Umazx7v7:rM1mgbnM5scUFzlv
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
resource yara_rule behavioral2/memory/3688-2-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/3688-12-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/1844-14-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/1844-21-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/1844-20-0x0000000005580000-0x0000000005713000-memory.dmp xmrig behavioral2/memory/1844-30-0x0000000000400000-0x0000000000587000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 1844 0aa37ab18bc6dcfb45b32b7047097884.exe -
Executes dropped EXE 1 IoCs
pid Process 1844 0aa37ab18bc6dcfb45b32b7047097884.exe -
resource yara_rule behavioral2/memory/3688-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral2/files/0x0009000000023221-11.dat upx behavioral2/memory/1844-13-0x0000000000400000-0x0000000000712000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3688 0aa37ab18bc6dcfb45b32b7047097884.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3688 0aa37ab18bc6dcfb45b32b7047097884.exe 1844 0aa37ab18bc6dcfb45b32b7047097884.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3688 wrote to memory of 1844 3688 0aa37ab18bc6dcfb45b32b7047097884.exe 93 PID 3688 wrote to memory of 1844 3688 0aa37ab18bc6dcfb45b32b7047097884.exe 93 PID 3688 wrote to memory of 1844 3688 0aa37ab18bc6dcfb45b32b7047097884.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\0aa37ab18bc6dcfb45b32b7047097884.exe"C:\Users\Admin\AppData\Local\Temp\0aa37ab18bc6dcfb45b32b7047097884.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\0aa37ab18bc6dcfb45b32b7047097884.exeC:\Users\Admin\AppData\Local\Temp\0aa37ab18bc6dcfb45b32b7047097884.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1844
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD520879acf2e3658cfba1874f88efaafb3
SHA1d8dc39decbf95d02796bf55eb1f5802d31427938
SHA25678bf761629835c160a81e95b9fd7ee641aebe236e7f16deb2a628155dba8a99c
SHA512bff7aee9a981c885d3fe84e7b3db37888db8e69fbf0a15cb1cf06ef81bf1030eac84f1aa6c9a6682d5d01913c6534d95dbd2a3bd314454778041b85739891755