Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 23:50
Behavioral task
behavioral1
Sample
078dc605c5eb5df44d1105f51060ea9f.exe
Resource
win7-20231215-en
9 signatures
150 seconds
General
-
Target
078dc605c5eb5df44d1105f51060ea9f.exe
-
Size
784KB
-
MD5
078dc605c5eb5df44d1105f51060ea9f
-
SHA1
cd48719056ae6f8411c430c8e4e8bb2e799816ac
-
SHA256
2a8b40dff64b2ed6efb5904e87f5f1e94809bcae2d2d158e3b0ef8e705fa0d98
-
SHA512
8f6501d250ff454416f696a8d3d12a53cee406359bf5fdf29828d4ce95c8d9e188337ffb1b819e055a4c4cf316986936ab0273bc50014caeb86269631ce99a86
-
SSDEEP
12288:dZG81VmxrBQjSC4fu+I/SwJKEPT4WvZhCBY5rc541VDG7VLljmn+PYwt957H0D:y81VmlBQ2bmhSwf4WmSuS1A7DNhU
Malware Config
Signatures
-
XMRig Miner payload 7 IoCs
resource yara_rule behavioral1/memory/2248-1-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/1804-18-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/1804-26-0x0000000003120000-0x00000000032B3000-memory.dmp xmrig behavioral1/memory/1804-35-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/1804-34-0x00000000005A0000-0x000000000071F000-memory.dmp xmrig behavioral1/memory/1804-24-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/2248-14-0x0000000000400000-0x0000000000593000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 1804 078dc605c5eb5df44d1105f51060ea9f.exe -
Executes dropped EXE 1 IoCs
pid Process 1804 078dc605c5eb5df44d1105f51060ea9f.exe -
Loads dropped DLL 1 IoCs
pid Process 2248 078dc605c5eb5df44d1105f51060ea9f.exe -
resource yara_rule behavioral1/memory/2248-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral1/memory/1804-17-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral1/memory/2248-15-0x0000000003220000-0x0000000003532000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2248 078dc605c5eb5df44d1105f51060ea9f.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2248 078dc605c5eb5df44d1105f51060ea9f.exe 1804 078dc605c5eb5df44d1105f51060ea9f.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2248 wrote to memory of 1804 2248 078dc605c5eb5df44d1105f51060ea9f.exe 16 PID 2248 wrote to memory of 1804 2248 078dc605c5eb5df44d1105f51060ea9f.exe 16 PID 2248 wrote to memory of 1804 2248 078dc605c5eb5df44d1105f51060ea9f.exe 16 PID 2248 wrote to memory of 1804 2248 078dc605c5eb5df44d1105f51060ea9f.exe 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\078dc605c5eb5df44d1105f51060ea9f.exe"C:\Users\Admin\AppData\Local\Temp\078dc605c5eb5df44d1105f51060ea9f.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\078dc605c5eb5df44d1105f51060ea9f.exeC:\Users\Admin\AppData\Local\Temp\078dc605c5eb5df44d1105f51060ea9f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1804
-