Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
46s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 04:50
Behavioral task
behavioral1
Sample
67b29069068075b7818ec84bf5382e9f.exe
Resource
win7-20231215-en
General
-
Target
67b29069068075b7818ec84bf5382e9f.exe
-
Size
1.5MB
-
MD5
67b29069068075b7818ec84bf5382e9f
-
SHA1
c169882de30bc7e31a6b8c0454aa19eaa46ecf62
-
SHA256
091302a18e1bf85de2cdede03e15bb0c8f8ea01568a72745df2e0fabc5b74efd
-
SHA512
bad15bfef43137c2054c3407a488db890648e42406f70b28eb06886fcf62bc4e6e49270f86bfd893a18c899560663c04ec7a4861cc913d76cc1e655dd9505916
-
SSDEEP
24576:puoKwKdYObCAqkBktLtNsaFujWi+0YlfMg3xvWRUMn0Vj75CFtBrpBkS05i7XxVW:pujdYhmuWsHiHgdEKHMtrfd0k7XbWFt
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
resource yara_rule behavioral2/memory/3964-2-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/3964-12-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/4420-14-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/4420-21-0x00000000055A0000-0x0000000005733000-memory.dmp xmrig behavioral2/memory/4420-30-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/4420-20-0x0000000000400000-0x0000000000587000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 4420 67b29069068075b7818ec84bf5382e9f.exe -
Executes dropped EXE 1 IoCs
pid Process 4420 67b29069068075b7818ec84bf5382e9f.exe -
resource yara_rule behavioral2/memory/3964-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral2/memory/4420-13-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral2/files/0x000700000002321b-11.dat upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3964 67b29069068075b7818ec84bf5382e9f.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3964 67b29069068075b7818ec84bf5382e9f.exe 4420 67b29069068075b7818ec84bf5382e9f.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3964 wrote to memory of 4420 3964 67b29069068075b7818ec84bf5382e9f.exe 18 PID 3964 wrote to memory of 4420 3964 67b29069068075b7818ec84bf5382e9f.exe 18 PID 3964 wrote to memory of 4420 3964 67b29069068075b7818ec84bf5382e9f.exe 18
Processes
-
C:\Users\Admin\AppData\Local\Temp\67b29069068075b7818ec84bf5382e9f.exe"C:\Users\Admin\AppData\Local\Temp\67b29069068075b7818ec84bf5382e9f.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\67b29069068075b7818ec84bf5382e9f.exeC:\Users\Admin\AppData\Local\Temp\67b29069068075b7818ec84bf5382e9f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:4420
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5f7ab5ae84e9c5aab991987218ad48149
SHA1da958c310d01f5e6619aba04e314236cafcf692a
SHA256ff84f702b23be7cc0be97eb26147de5d95d6fd12ccba330b780d962fc82c8d43
SHA5121f551ecd4c5c1e9e7fb225f65917d8dad11c915c8830161bddd6f732ad85088aba1be3d5f199363dabc6247a186783c341fd04ff3f2e1b8e076697f0f832f207