Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    174s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2023, 07:46

General

  • Target

    7aabdf8557cd7c9d074d1c3e49648b0f.exe

  • Size

    784KB

  • MD5

    7aabdf8557cd7c9d074d1c3e49648b0f

  • SHA1

    540e7cde063f412abd52f6307dc38351aa67f8eb

  • SHA256

    0e63be888098618dee0dde46c3605b6d980b3f79f9cfd88819bb80befe770104

  • SHA512

    d7220a199165fda1836c932220c1b56573c5f81d70fdaeded85dacb2efab805d211da99bbc5c9123d5bbb0e4ad8f8b07fb33151665cba2da94a538f490736bd6

  • SSDEEP

    12288:Wdy55mmJUkmR0YaucLVOEIpF10mWQwAMosWACcwhBLATU3TVR1P7v681Z/ZyibTq:755mmCh565OhpFaQWozPxAIx/uoXTq

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 6 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7aabdf8557cd7c9d074d1c3e49648b0f.exe
    "C:\Users\Admin\AppData\Local\Temp\7aabdf8557cd7c9d074d1c3e49648b0f.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2552
    • C:\Users\Admin\AppData\Local\Temp\7aabdf8557cd7c9d074d1c3e49648b0f.exe
      C:\Users\Admin\AppData\Local\Temp\7aabdf8557cd7c9d074d1c3e49648b0f.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7aabdf8557cd7c9d074d1c3e49648b0f.exe

    Filesize

    784KB

    MD5

    e8a652025f8faea61aaa1a5f4eccc11f

    SHA1

    eb890c6ba31d3f90804cb6fd2ddb90c754c0b916

    SHA256

    3dc7e76f2ad8a271ebb2ccfcddf07f8f36ad515f426d44c03d1e849711a6c7ce

    SHA512

    c5a42ecd11306fdbc1b3d99895fd1ffe67177e21c4d9164cf39a34a66019571257d1c8dbf19da1e389c591dc25da50d5d2e9251699fe6d687b8f35a593a648a5

  • memory/1940-13-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/1940-14-0x00000000019D0000-0x0000000001A94000-memory.dmp

    Filesize

    784KB

  • memory/1940-15-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/1940-20-0x00000000053C0000-0x0000000005553000-memory.dmp

    Filesize

    1.6MB

  • memory/1940-21-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/1940-30-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/2552-0-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/2552-1-0x00000000019C0000-0x0000000001A84000-memory.dmp

    Filesize

    784KB

  • memory/2552-2-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/2552-12-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB