Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
116s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 07:23
Behavioral task
behavioral1
Sample
78ecee4dc4157d64a3abb64c57a08b63.exe
Resource
win7-20231215-en
General
-
Target
78ecee4dc4157d64a3abb64c57a08b63.exe
-
Size
784KB
-
MD5
78ecee4dc4157d64a3abb64c57a08b63
-
SHA1
9a39c2f03fa4076d8a51ef0f2434c536551d56b9
-
SHA256
5e286da2f213145ceaab951c1d3b69791d7aa1f07e5be7ffde278835cc38144e
-
SHA512
c624fe40a2a1ba676d6a784327aa83588fc5d5cc0c8a140ff0bcffb4774ee62452b281e8fc8cc74fecb3127c98caa29ec18ba707a486466654cfec88b5bb1eda
-
SSDEEP
12288:CHO6t6Ii/AVl6hj/Pjvu7yyoGvfBR8rGfZZDESjeYFc8++60eG6yQKimdFFwkE:2iFzyoGvJRsGf7DDd+VrVADbwkE
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
resource yara_rule behavioral2/memory/3744-2-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/3744-12-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/3224-14-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/3224-21-0x0000000005450000-0x00000000055E3000-memory.dmp xmrig behavioral2/memory/3224-30-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/3224-20-0x0000000000400000-0x0000000000587000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 3224 78ecee4dc4157d64a3abb64c57a08b63.exe -
Executes dropped EXE 1 IoCs
pid Process 3224 78ecee4dc4157d64a3abb64c57a08b63.exe -
resource yara_rule behavioral2/memory/3744-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral2/files/0x000c00000002315b-11.dat upx behavioral2/memory/3224-13-0x0000000000400000-0x0000000000712000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3744 78ecee4dc4157d64a3abb64c57a08b63.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3744 78ecee4dc4157d64a3abb64c57a08b63.exe 3224 78ecee4dc4157d64a3abb64c57a08b63.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3744 wrote to memory of 3224 3744 78ecee4dc4157d64a3abb64c57a08b63.exe 90 PID 3744 wrote to memory of 3224 3744 78ecee4dc4157d64a3abb64c57a08b63.exe 90 PID 3744 wrote to memory of 3224 3744 78ecee4dc4157d64a3abb64c57a08b63.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\78ecee4dc4157d64a3abb64c57a08b63.exe"C:\Users\Admin\AppData\Local\Temp\78ecee4dc4157d64a3abb64c57a08b63.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\78ecee4dc4157d64a3abb64c57a08b63.exeC:\Users\Admin\AppData\Local\Temp\78ecee4dc4157d64a3abb64c57a08b63.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:3224
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
173KB
MD504348ad6f9c93d942e82173abf293781
SHA1a5ab8aa0c702476e7a55ab21f9d6f75148c734aa
SHA25602ffc441b884034fc44fa72fe276a4f9e871ec0186812f66be612d84b898c269
SHA5120ac1462ee6b572a34a7f60c26e920cb2c1a7cbf8d9af9cdb8d7d1036c9cc4609932e3e6e9f7050e9f864dbbac1c2530cf8ccd74f4859ec95477b84cbed096787