Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2023, 09:20

General

  • Target

    80df06dff255c5ea40bf70ecc0a6abc8.exe

  • Size

    784KB

  • MD5

    80df06dff255c5ea40bf70ecc0a6abc8

  • SHA1

    512d845c800d20dca1f3b80dafe368bcd2bd02d2

  • SHA256

    27942005c57acec1d224a698bf9617b147ebd3d7c4d0bbabe0c492bc443b09cf

  • SHA512

    8ab076e027908c232fff27a2b3d947b38249f841888ede1ad7c81a80802d64ed735056bcaa39d52830f9253b9eb8748eaa592a182cff69252b6fa95a18e8ab02

  • SSDEEP

    24576:QrW+tnf7vfXW8mza33wdnE9rmFykf2HmYyYzFKUthCxYF:SRbX7mza33UWlVz57CSF

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 6 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80df06dff255c5ea40bf70ecc0a6abc8.exe
    "C:\Users\Admin\AppData\Local\Temp\80df06dff255c5ea40bf70ecc0a6abc8.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2756
    • C:\Users\Admin\AppData\Local\Temp\80df06dff255c5ea40bf70ecc0a6abc8.exe
      C:\Users\Admin\AppData\Local\Temp\80df06dff255c5ea40bf70ecc0a6abc8.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:3936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\80df06dff255c5ea40bf70ecc0a6abc8.exe

    Filesize

    439KB

    MD5

    6d6598530bf1db0299cec7e22df43669

    SHA1

    e4bb13898f440b021d1c56dcff70447b0d7a8865

    SHA256

    fa85ec5fa33b0ccea36607fb366e311c6578c6247f21f3028bd130146566ffb8

    SHA512

    fe476934d85f12e6763c658c0e0fe4f66d829596104e34fa423eb677208265536d5e27ba97d75bdcd150134d4a19ef932930cc4f7533cf92943add0cc676fd86

  • memory/2756-0-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/2756-1-0x0000000001B10000-0x0000000001BD4000-memory.dmp

    Filesize

    784KB

  • memory/2756-2-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/2756-12-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/3936-13-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/3936-14-0x0000000001720000-0x00000000017E4000-memory.dmp

    Filesize

    784KB

  • memory/3936-15-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/3936-21-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/3936-20-0x00000000055A0000-0x0000000005733000-memory.dmp

    Filesize

    1.6MB

  • memory/3936-30-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB