Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 07:46
Behavioral task
behavioral1
Sample
7aabdf8557cd7c9d074d1c3e49648b0f.exe
Resource
win7-20231129-en
General
-
Target
7aabdf8557cd7c9d074d1c3e49648b0f.exe
-
Size
784KB
-
MD5
7aabdf8557cd7c9d074d1c3e49648b0f
-
SHA1
540e7cde063f412abd52f6307dc38351aa67f8eb
-
SHA256
0e63be888098618dee0dde46c3605b6d980b3f79f9cfd88819bb80befe770104
-
SHA512
d7220a199165fda1836c932220c1b56573c5f81d70fdaeded85dacb2efab805d211da99bbc5c9123d5bbb0e4ad8f8b07fb33151665cba2da94a538f490736bd6
-
SSDEEP
12288:Wdy55mmJUkmR0YaucLVOEIpF10mWQwAMosWACcwhBLATU3TVR1P7v681Z/ZyibTq:755mmCh565OhpFaQWozPxAIx/uoXTq
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
resource yara_rule behavioral2/memory/2552-2-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/2552-12-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/1940-15-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/1940-20-0x00000000053C0000-0x0000000005553000-memory.dmp xmrig behavioral2/memory/1940-21-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/1940-30-0x0000000000400000-0x0000000000587000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 1940 7aabdf8557cd7c9d074d1c3e49648b0f.exe -
Executes dropped EXE 1 IoCs
pid Process 1940 7aabdf8557cd7c9d074d1c3e49648b0f.exe -
resource yara_rule behavioral2/memory/2552-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral2/files/0x0006000000023249-11.dat upx behavioral2/memory/1940-13-0x0000000000400000-0x0000000000712000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2552 7aabdf8557cd7c9d074d1c3e49648b0f.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2552 7aabdf8557cd7c9d074d1c3e49648b0f.exe 1940 7aabdf8557cd7c9d074d1c3e49648b0f.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2552 wrote to memory of 1940 2552 7aabdf8557cd7c9d074d1c3e49648b0f.exe 90 PID 2552 wrote to memory of 1940 2552 7aabdf8557cd7c9d074d1c3e49648b0f.exe 90 PID 2552 wrote to memory of 1940 2552 7aabdf8557cd7c9d074d1c3e49648b0f.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\7aabdf8557cd7c9d074d1c3e49648b0f.exe"C:\Users\Admin\AppData\Local\Temp\7aabdf8557cd7c9d074d1c3e49648b0f.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\7aabdf8557cd7c9d074d1c3e49648b0f.exeC:\Users\Admin\AppData\Local\Temp\7aabdf8557cd7c9d074d1c3e49648b0f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1940
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD5e8a652025f8faea61aaa1a5f4eccc11f
SHA1eb890c6ba31d3f90804cb6fd2ddb90c754c0b916
SHA2563dc7e76f2ad8a271ebb2ccfcddf07f8f36ad515f426d44c03d1e849711a6c7ce
SHA512c5a42ecd11306fdbc1b3d99895fd1ffe67177e21c4d9164cf39a34a66019571257d1c8dbf19da1e389c591dc25da50d5d2e9251699fe6d687b8f35a593a648a5