Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    125s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 04:08

General

  • Target

    278d03dd830f700e87f75f932ace2f42.exe

  • Size

    784KB

  • MD5

    278d03dd830f700e87f75f932ace2f42

  • SHA1

    05e49ee27f66528f9e32dd14e4b35b64d5229a12

  • SHA256

    e63a46b9e23fc7c78ea1103a716b802a4898a0643f119c56f35ecee000a08a01

  • SHA512

    1a0856365b7108d65dbfd692cafe53741c0d3143ef0258f80a99b55400412576b1526160c80c41ec624bcc717079566e3010dc53a52b9aad061bc30be6184160

  • SSDEEP

    12288:abTIU0f7GoRRn8D97oEPqgzb6SU0cTl+MtgXO9aP0Znkw6aRu6dZW:+TCqo3n8D97oEPrb6gckHOyXw6X6

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 8 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\278d03dd830f700e87f75f932ace2f42.exe
    "C:\Users\Admin\AppData\Local\Temp\278d03dd830f700e87f75f932ace2f42.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2832
    • C:\Users\Admin\AppData\Local\Temp\278d03dd830f700e87f75f932ace2f42.exe
      C:\Users\Admin\AppData\Local\Temp\278d03dd830f700e87f75f932ace2f42.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\278d03dd830f700e87f75f932ace2f42.exe

    Filesize

    517KB

    MD5

    1779ab81fda14a475645a01fa5e1c28b

    SHA1

    475dc4aa6d2f290166ab58d5692c108387956106

    SHA256

    d15f34db94b29a2a610410fe17bc0482fa0b52b0c42124e5803a136bbaeda6cd

    SHA512

    2465ba11df75708391ea55e645fc4b822c9a1f528b846e87b1ded0c50341defb8e654ff15f1d386738f682e5f7525afa4c2020433fef48278cc4b1db61b857af

  • memory/2780-18-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/2780-17-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/2780-19-0x00000000018B0000-0x0000000001974000-memory.dmp

    Filesize

    784KB

  • memory/2780-25-0x00000000030C0000-0x0000000003253000-memory.dmp

    Filesize

    1.6MB

  • memory/2780-24-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/2780-35-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/2780-34-0x00000000005A0000-0x000000000071F000-memory.dmp

    Filesize

    1.5MB

  • memory/2832-3-0x0000000001720000-0x00000000017E4000-memory.dmp

    Filesize

    784KB

  • memory/2832-1-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/2832-15-0x0000000003140000-0x0000000003452000-memory.dmp

    Filesize

    3.1MB

  • memory/2832-14-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/2832-0-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB