Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
88s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 05:29
Behavioral task
behavioral1
Sample
71843df978d8aca0de1d4ccb7f60d4ed.exe
Resource
win7-20231215-en
9 signatures
150 seconds
General
-
Target
71843df978d8aca0de1d4ccb7f60d4ed.exe
-
Size
784KB
-
MD5
71843df978d8aca0de1d4ccb7f60d4ed
-
SHA1
406df69f52d3e23c7d260b92cde96440dc1d3ddf
-
SHA256
1c0206b20d8d8f70b94163e42cfa121fe5adfc19081125accdee0edd5a6ae1d0
-
SHA512
a7c0f8faa623304da5c0295eded7974d76151a5860195a0c808f5e85246bf0f1a2d0521e2a3af74899884f6dd01afd82b2ae83ee4044084956a0a360db786f03
-
SSDEEP
24576:ZMGQrExrQN+mG4gVw/w2zmkBilUw8vPo/9X:qGQw54NgVwZFBiVUPo/h
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
resource yara_rule behavioral2/memory/1528-12-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/1144-21-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/1144-30-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/1144-20-0x00000000054C0000-0x0000000005653000-memory.dmp xmrig behavioral2/memory/1144-14-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/1528-2-0x0000000000400000-0x0000000000593000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 1144 71843df978d8aca0de1d4ccb7f60d4ed.exe -
Executes dropped EXE 1 IoCs
pid Process 1144 71843df978d8aca0de1d4ccb7f60d4ed.exe -
resource yara_rule behavioral2/memory/1528-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral2/files/0x00070000000231f5-11.dat upx behavioral2/memory/1144-13-0x0000000000400000-0x0000000000712000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1528 71843df978d8aca0de1d4ccb7f60d4ed.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1528 71843df978d8aca0de1d4ccb7f60d4ed.exe 1144 71843df978d8aca0de1d4ccb7f60d4ed.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1528 wrote to memory of 1144 1528 71843df978d8aca0de1d4ccb7f60d4ed.exe 17 PID 1528 wrote to memory of 1144 1528 71843df978d8aca0de1d4ccb7f60d4ed.exe 17 PID 1528 wrote to memory of 1144 1528 71843df978d8aca0de1d4ccb7f60d4ed.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\71843df978d8aca0de1d4ccb7f60d4ed.exe"C:\Users\Admin\AppData\Local\Temp\71843df978d8aca0de1d4ccb7f60d4ed.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\71843df978d8aca0de1d4ccb7f60d4ed.exeC:\Users\Admin\AppData\Local\Temp\71843df978d8aca0de1d4ccb7f60d4ed.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1144
-