Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 16:46
Behavioral task
behavioral1
Sample
f7cb0e8c6e055469803c76d59a6f77d8.exe
Resource
win7-20231215-en
General
-
Target
f7cb0e8c6e055469803c76d59a6f77d8.exe
-
Size
784KB
-
MD5
f7cb0e8c6e055469803c76d59a6f77d8
-
SHA1
b992e6d9ad0ad93e3ca62a9df09e70e8e08928d0
-
SHA256
d601d3cbae466945df780bf0d48d6800d54ef58ab2330ce866df585cd8e6d063
-
SHA512
9f3cd460ce22b537737633dd27dce4f63fb46608f1cc711444466a2613affcd80cbf24c6bb1b8ab7cafe151b380f3b4b47b6cc0dae85bd5ceff54e2d8df9aeb9
-
SSDEEP
12288:4w9roMj2kwtMus9MjRC+h/6DpfWVqjs/ev2QDFk8V0dG6hwfXlAdGl2nuF56sPo7:4MjSJ9CcwvwTQDaZdG6gknuFlPo5ATq
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
resource yara_rule behavioral2/memory/4388-2-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/4388-12-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/2224-14-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/2224-20-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/2224-21-0x0000000005520000-0x00000000056B3000-memory.dmp xmrig behavioral2/memory/2224-30-0x0000000000400000-0x0000000000587000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 2224 f7cb0e8c6e055469803c76d59a6f77d8.exe -
Executes dropped EXE 1 IoCs
pid Process 2224 f7cb0e8c6e055469803c76d59a6f77d8.exe -
resource yara_rule behavioral2/memory/4388-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral2/files/0x000600000002321d-11.dat upx behavioral2/memory/2224-13-0x0000000000400000-0x0000000000712000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4388 f7cb0e8c6e055469803c76d59a6f77d8.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 4388 f7cb0e8c6e055469803c76d59a6f77d8.exe 2224 f7cb0e8c6e055469803c76d59a6f77d8.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4388 wrote to memory of 2224 4388 f7cb0e8c6e055469803c76d59a6f77d8.exe 92 PID 4388 wrote to memory of 2224 4388 f7cb0e8c6e055469803c76d59a6f77d8.exe 92 PID 4388 wrote to memory of 2224 4388 f7cb0e8c6e055469803c76d59a6f77d8.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7cb0e8c6e055469803c76d59a6f77d8.exe"C:\Users\Admin\AppData\Local\Temp\f7cb0e8c6e055469803c76d59a6f77d8.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\f7cb0e8c6e055469803c76d59a6f77d8.exeC:\Users\Admin\AppData\Local\Temp\f7cb0e8c6e055469803c76d59a6f77d8.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2224
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
181KB
MD5cb0e04470d902d153d6aa45b26c8a45c
SHA1be1041a54ea4592c26197651e643698331a0f0db
SHA256a5f22b6cdfdcf9db6b0dadd19679855c52d75ba46caa82970fef10ef3581925e
SHA512a2a922048010bfaaa92f0495fd417e7f71207420bc4f8144c57f747e94d1b0bc39b657b9b8a3d56e03b971abd15f23e693365537369139b671f1d789da427634