Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03/01/2024, 13:12
Behavioral task
behavioral1
Sample
3e8b1fcca33bc94a8026096439746cbe.exe
Resource
win7-20231215-en
General
-
Target
3e8b1fcca33bc94a8026096439746cbe.exe
-
Size
1.5MB
-
MD5
3e8b1fcca33bc94a8026096439746cbe
-
SHA1
58d3a6b5d696aa05b3272650549f3f21fe25e63c
-
SHA256
7f7a17380512ad5f191b8d085c105d2945fadb4a2f3599c2b4ae41e7fb4c2651
-
SHA512
7ac744d26d9f3442f2540196d46c7e8e134fb0a3659abbe86414abdfb0934e2c6aa8547797a9fffbcf6fa19c003627ca80d36aa460e0c4e708a5cc1b3855710a
-
SSDEEP
24576:a27L36cUUNzk7vH768ozm1DFWhK01hTr2MTrpf8uzc6/GCQUjGCCHAnIB/eW02Il:M4Rk72rihFWh3Trlf3V/GbrNwIB/U2
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
resource yara_rule behavioral1/memory/2888-1-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2888-14-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2780-19-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2780-24-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/2780-25-0x00000000033C0000-0x0000000003553000-memory.dmp xmrig behavioral1/memory/2780-34-0x0000000000400000-0x0000000000587000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 2780 3e8b1fcca33bc94a8026096439746cbe.exe -
Executes dropped EXE 1 IoCs
pid Process 2780 3e8b1fcca33bc94a8026096439746cbe.exe -
Loads dropped DLL 1 IoCs
pid Process 2888 3e8b1fcca33bc94a8026096439746cbe.exe -
resource yara_rule behavioral1/memory/2888-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral1/files/0x000b000000012185-10.dat upx behavioral1/memory/2888-15-0x0000000003460000-0x0000000003772000-memory.dmp upx behavioral1/memory/2780-17-0x0000000000400000-0x0000000000712000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2888 3e8b1fcca33bc94a8026096439746cbe.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2888 3e8b1fcca33bc94a8026096439746cbe.exe 2780 3e8b1fcca33bc94a8026096439746cbe.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2780 2888 3e8b1fcca33bc94a8026096439746cbe.exe 29 PID 2888 wrote to memory of 2780 2888 3e8b1fcca33bc94a8026096439746cbe.exe 29 PID 2888 wrote to memory of 2780 2888 3e8b1fcca33bc94a8026096439746cbe.exe 29 PID 2888 wrote to memory of 2780 2888 3e8b1fcca33bc94a8026096439746cbe.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e8b1fcca33bc94a8026096439746cbe.exe"C:\Users\Admin\AppData\Local\Temp\3e8b1fcca33bc94a8026096439746cbe.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\3e8b1fcca33bc94a8026096439746cbe.exeC:\Users\Admin\AppData\Local\Temp\3e8b1fcca33bc94a8026096439746cbe.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2780
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD5f34e0083668bdb99034c6d9c15e156b9
SHA14d30991bebd0e1d88b6c435d4b7bc22069123c1d
SHA25673e74ae555329f21ec9dfa4ad56c0c411402b699ea926d0626c0fbdadbbb5678
SHA5126a935588a4525a9b69b0fefde0fd1fa0b4c4a580d5dcfdcd01ec38b9c467f95c3baff46474a7cc93fc4615b409e1845bd35acfaf12bdd3df6b60463bd4fe4609