Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 04:08
Behavioral task
behavioral1
Sample
278d03dd830f700e87f75f932ace2f42.exe
Resource
win7-20231215-en
General
-
Target
278d03dd830f700e87f75f932ace2f42.exe
-
Size
784KB
-
MD5
278d03dd830f700e87f75f932ace2f42
-
SHA1
05e49ee27f66528f9e32dd14e4b35b64d5229a12
-
SHA256
e63a46b9e23fc7c78ea1103a716b802a4898a0643f119c56f35ecee000a08a01
-
SHA512
1a0856365b7108d65dbfd692cafe53741c0d3143ef0258f80a99b55400412576b1526160c80c41ec624bcc717079566e3010dc53a52b9aad061bc30be6184160
-
SSDEEP
12288:abTIU0f7GoRRn8D97oEPqgzb6SU0cTl+MtgXO9aP0Znkw6aRu6dZW:+TCqo3n8D97oEPrb6gckHOyXw6X6
Malware Config
Signatures
-
XMRig Miner payload 8 IoCs
resource yara_rule behavioral1/memory/2832-1-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2832-15-0x0000000003140000-0x0000000003452000-memory.dmp xmrig behavioral1/memory/2832-14-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2780-18-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2780-25-0x00000000030C0000-0x0000000003253000-memory.dmp xmrig behavioral1/memory/2780-24-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/2780-35-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/2780-34-0x00000000005A0000-0x000000000071F000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 2780 278d03dd830f700e87f75f932ace2f42.exe -
Executes dropped EXE 1 IoCs
pid Process 2780 278d03dd830f700e87f75f932ace2f42.exe -
Loads dropped DLL 1 IoCs
pid Process 2832 278d03dd830f700e87f75f932ace2f42.exe -
resource yara_rule behavioral1/memory/2832-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral1/files/0x000c00000001492c-10.dat upx behavioral1/files/0x000c00000001492c-16.dat upx behavioral1/memory/2832-15-0x0000000003140000-0x0000000003452000-memory.dmp upx behavioral1/memory/2780-17-0x0000000000400000-0x0000000000712000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2832 278d03dd830f700e87f75f932ace2f42.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2832 278d03dd830f700e87f75f932ace2f42.exe 2780 278d03dd830f700e87f75f932ace2f42.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2832 wrote to memory of 2780 2832 278d03dd830f700e87f75f932ace2f42.exe 30 PID 2832 wrote to memory of 2780 2832 278d03dd830f700e87f75f932ace2f42.exe 30 PID 2832 wrote to memory of 2780 2832 278d03dd830f700e87f75f932ace2f42.exe 30 PID 2832 wrote to memory of 2780 2832 278d03dd830f700e87f75f932ace2f42.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\278d03dd830f700e87f75f932ace2f42.exe"C:\Users\Admin\AppData\Local\Temp\278d03dd830f700e87f75f932ace2f42.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\278d03dd830f700e87f75f932ace2f42.exeC:\Users\Admin\AppData\Local\Temp\278d03dd830f700e87f75f932ace2f42.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2780
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
517KB
MD51779ab81fda14a475645a01fa5e1c28b
SHA1475dc4aa6d2f290166ab58d5692c108387956106
SHA256d15f34db94b29a2a610410fe17bc0482fa0b52b0c42124e5803a136bbaeda6cd
SHA5122465ba11df75708391ea55e645fc4b822c9a1f528b846e87b1ded0c50341defb8e654ff15f1d386738f682e5f7525afa4c2020433fef48278cc4b1db61b857af