Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 14:44
Behavioral task
behavioral1
Sample
c9a15efa1f9da7cbb6b4f531f37af160.exe
Resource
win7-20231129-en
General
-
Target
c9a15efa1f9da7cbb6b4f531f37af160.exe
-
Size
784KB
-
MD5
c9a15efa1f9da7cbb6b4f531f37af160
-
SHA1
fed972de2a8ed8022c801a632442b9c979dea855
-
SHA256
e1e742a21d7da7a3f213789a2000d3d6a3be02f4bcf42d9e41bfa17eb7540167
-
SHA512
1d555730e08a4a2de345497bb6651d9fe9db1aff5acb2fd6aff0b8df2771bce45cebdd94a83dac20e6282c068fbc6718b9c7c18bdb2013df20a63e49a93d13ee
-
SSDEEP
24576:0rJ9LVrg3hceOZcN9P6vgrPvRi1n1l7pow/RYfX:03dMyeOSmgbpi9/7Vo
Malware Config
Signatures
-
XMRig Miner payload 8 IoCs
resource yara_rule behavioral1/memory/2396-1-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2544-17-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2544-18-0x0000000000400000-0x0000000000712000-memory.dmp xmrig behavioral1/memory/2544-27-0x0000000003220000-0x00000000033B3000-memory.dmp xmrig behavioral1/memory/2544-34-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/2544-24-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/2396-16-0x00000000031F0000-0x0000000003502000-memory.dmp xmrig behavioral1/memory/2396-15-0x0000000000400000-0x0000000000593000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 2544 c9a15efa1f9da7cbb6b4f531f37af160.exe -
Executes dropped EXE 1 IoCs
pid Process 2544 c9a15efa1f9da7cbb6b4f531f37af160.exe -
Loads dropped DLL 1 IoCs
pid Process 2396 c9a15efa1f9da7cbb6b4f531f37af160.exe -
resource yara_rule behavioral1/memory/2396-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral1/files/0x000a0000000133a9-10.dat upx behavioral1/files/0x000a0000000133a9-14.dat upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2396 c9a15efa1f9da7cbb6b4f531f37af160.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2396 c9a15efa1f9da7cbb6b4f531f37af160.exe 2544 c9a15efa1f9da7cbb6b4f531f37af160.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2396 wrote to memory of 2544 2396 c9a15efa1f9da7cbb6b4f531f37af160.exe 17 PID 2396 wrote to memory of 2544 2396 c9a15efa1f9da7cbb6b4f531f37af160.exe 17 PID 2396 wrote to memory of 2544 2396 c9a15efa1f9da7cbb6b4f531f37af160.exe 17 PID 2396 wrote to memory of 2544 2396 c9a15efa1f9da7cbb6b4f531f37af160.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9a15efa1f9da7cbb6b4f531f37af160.exe"C:\Users\Admin\AppData\Local\Temp\c9a15efa1f9da7cbb6b4f531f37af160.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\c9a15efa1f9da7cbb6b4f531f37af160.exeC:\Users\Admin\AppData\Local\Temp\c9a15efa1f9da7cbb6b4f531f37af160.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2544
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD517e795dcf4fac0738702b1e43f897780
SHA10da7c47543e85722a60995ab468fbca70ffe596a
SHA256547406b86e2b0f6a01deed5e1e26229c30074fdffb767c48e67917fd3d028999
SHA512ee3d4cb4fee5fa35ce50ab305aa1872a52f68a2cac2cabc521dbbc96977aa203e634b9c0b7d224c57c9f4317e83177e25a2b6b4a2813e97d455fec171d3cb5a2
-
Filesize
23KB
MD54bc708392c05c3de9826f0a8feaacc97
SHA1e52da810abe99b645f02eca26ac42d17dd14bdf3
SHA256b1b1d5be416c6a3e88ccbceb53cf67db82aecf00cfb2e392c5ed27aa30274b73
SHA5123809296285aaff47674dbc26cc32ed93a731535952032b50e6e7dc3137e2899a8d0f339e1e8b39ffd1e500b6354317532771b2293cde43b7e859553f20ad84a3