Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

06/07/2024, 19:03 UTC

240706-xqksaazhrm 10

21/06/2024, 07:08 UTC

240621-hyl8razgpc 10

16/06/2024, 18:48 UTC

240616-xf5ppswgmq 10

16/06/2024, 18:34 UTC

240616-w759wasbqf 10

16/06/2024, 18:21 UTC

240616-wzje5swajj 10

16/06/2024, 18:08 UTC

240616-wqxams1ekf 10

16/06/2024, 17:54 UTC

240616-whbzqsvcrn 10

16/06/2024, 17:41 UTC

240616-v9q3aszhkf 10

16/06/2024, 17:28 UTC

240616-v1237szgpc 10

Analysis

  • max time kernel
    1799s
  • max time network
    1800s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/01/2024, 22:24 UTC

General

  • Target

    main - Copy (5) - Copy.exe

  • Size

    6.9MB

  • MD5

    22c978ffaefef3389bf29068b9621661

  • SHA1

    5671972c1d70826fb85dced4c83c700dd282ea21

  • SHA256

    e6ee8e9b38e10a92a89e61b8655ca4fedcc381fd93cb36f43fe323132923dfcf

  • SHA512

    8a280cb782f0afab171d2e7955b75362e98cefd449d382004ef2568c2c230cd633a754b1dd5f0dc5e17407819e4dceb5b0cbb2647e279a6ec674b8d9484be26a

  • SSDEEP

    98304:7b5Ak7khMiyw0VREqfnle5EEPbxVhCQHSIMf:5LUMiywZqshDxaQHh

Score
10/10

Malware Config

Signatures

  • XMRig Miner payload 64 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\main - Copy (5) - Copy.exe
    "C:\Users\Admin\AppData\Local\Temp\main - Copy (5) - Copy.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4600
    • C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
      xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4728

Network

  • flag-us
    DNS
    18.53.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.53.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    9.228.82.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    9.228.82.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    github.com
    main - Copy (5) - Copy.exe
    Remote address:
    8.8.8.8:53
    Request
    github.com
    IN A
    Response
    github.com
    IN A
    140.82.121.4
  • flag-us
    DNS
    github.com
    main - Copy (5) - Copy.exe
    Remote address:
    8.8.8.8:53
    Request
    github.com
    IN A
  • flag-us
    DNS
    objects.githubusercontent.com
    main - Copy (5) - Copy.exe
    Remote address:
    8.8.8.8:53
    Request
    objects.githubusercontent.com
    IN A
    Response
    objects.githubusercontent.com
    IN A
    185.199.108.133
    objects.githubusercontent.com
    IN A
    185.199.109.133
    objects.githubusercontent.com
    IN A
    185.199.110.133
    objects.githubusercontent.com
    IN A
    185.199.111.133
  • flag-us
    DNS
    59.128.231.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    59.128.231.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    4.121.82.140.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    4.121.82.140.in-addr.arpa
    IN PTR
    Response
    4.121.82.140.in-addr.arpa
    IN PTR
    lb-140-82-121-4-fragithubcom
  • flag-us
    DNS
    133.108.199.185.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.108.199.185.in-addr.arpa
    IN PTR
    Response
    133.108.199.185.in-addr.arpa
    IN PTR
    cdn-185-199-108-133githubcom
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
    Response
  • 140.82.121.4:443
    github.com
    tls
    main - Copy (5) - Copy.exe
    1.1kB
    7.0kB
    13
    11
  • 185.199.108.133:443
    objects.githubusercontent.com
    tls
    main - Copy (5) - Copy.exe
    48.4kB
    1.3MB
    888
    961
  • 96.17.178.174:80
    40 B
    1
  • 45.76.89.70:80
    tls
    xmrig.exe
    12.2kB
    28.9kB
    98
    77
  • 96.16.110.41:443
  • 192.229.221.95:80
  • 40.68.123.157:443
  • 40.68.123.157:443
  • 88.221.134.18:80
    92 B
    40 B
    2
    1
  • 96.17.178.176:80
    138 B
    40 B
    3
    1
  • 40.68.123.157:443
  • 40.68.123.157:443
  • 40.127.240.158:443
  • 40.68.123.157:443
  • 88.221.134.18:80
  • 51.104.136.2:443
  • 51.104.136.2:443
  • 93.184.221.240:80
  • 93.184.221.240:80
  • 52.111.236.21:443
  • 93.184.221.240:80
  • 20.42.65.89:443
  • 192.229.221.95:80
  • 92.123.241.104:80
  • 92.123.241.104:80
  • 13.85.23.86:443
  • 20.54.110.119:443
  • 88.221.134.18:80
  • 88.221.134.18:80
  • 88.221.134.18:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 93.184.221.240:80
  • 88.221.134.18:80
  • 88.221.134.18:80
  • 88.221.134.18:80
  • 88.221.134.18:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 88.221.134.32:80
  • 88.221.134.18:80
  • 88.221.134.18:80
  • 96.17.178.174:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 96.17.178.176:80
  • 88.221.135.217:80
  • 88.221.135.217:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 93.184.221.240:80
  • 93.184.221.240:80
  • 88.221.135.217:80
  • 88.221.135.217:80
  • 93.184.221.240:80
  • 93.184.221.240:80
    1.5kB
    69.2kB
    31
    50
  • 88.221.135.217:80
  • 8.8.8.8:53
    18.53.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    18.53.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    9.228.82.20.in-addr.arpa
    dns
    70 B
    156 B
    1
    1

    DNS Request

    9.228.82.20.in-addr.arpa

  • 8.8.8.8:53
    github.com
    dns
    main - Copy (5) - Copy.exe
    112 B
    72 B
    2
    1

    DNS Request

    github.com

    DNS Request

    github.com

    DNS Response

    140.82.121.4

  • 8.8.8.8:53
    objects.githubusercontent.com
    dns
    main - Copy (5) - Copy.exe
    75 B
    139 B
    1
    1

    DNS Request

    objects.githubusercontent.com

    DNS Response

    185.199.108.133
    185.199.109.133
    185.199.110.133
    185.199.111.133

  • 8.8.8.8:53
    59.128.231.4.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    59.128.231.4.in-addr.arpa

  • 8.8.8.8:53
    4.121.82.140.in-addr.arpa
    dns
    71 B
    115 B
    1
    1

    DNS Request

    4.121.82.140.in-addr.arpa

  • 8.8.8.8:53
    133.108.199.185.in-addr.arpa
    dns
    74 B
    118 B
    1
    1

    DNS Request

    133.108.199.185.in-addr.arpa

  • 8.8.8.8:53
    88.156.103.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    88.156.103.20.in-addr.arpa

  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

    Filesize

    1.4MB

    MD5

    72a950d6fb7fdcf3c3379161d902917b

    SHA1

    d8e4dfc0e645be114791fbbd7fe8a9b0c46afa48

    SHA256

    76bb0a3657d7f4e4f9c4e3eabfc21713d7106c2449a215ecaeccd619f6f9c73a

    SHA512

    a64bf44e7ab916b71955e273c0d796ad8a7ef3723a378d0340cb67bba84968a68a013cdca4760b95d07f22aaf64fc70c77841bc43b45fa33771dbcde876812a7

  • memory/4728-14-0x000001FE94620000-0x000001FE94640000-memory.dmp

    Filesize

    128KB

  • memory/4728-15-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-16-0x000001FE94770000-0x000001FE947B0000-memory.dmp

    Filesize

    256KB

  • memory/4728-17-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-19-0x000001FE947D0000-0x000001FE947F0000-memory.dmp

    Filesize

    128KB

  • memory/4728-18-0x000001FE947B0000-0x000001FE947D0000-memory.dmp

    Filesize

    128KB

  • memory/4728-20-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-21-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-22-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-24-0x000001FE947D0000-0x000001FE947F0000-memory.dmp

    Filesize

    128KB

  • memory/4728-23-0x000001FE947B0000-0x000001FE947D0000-memory.dmp

    Filesize

    128KB

  • memory/4728-53-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-52-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-51-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-50-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-49-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-48-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-47-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-46-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-45-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-44-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-43-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-42-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-41-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-40-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-39-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-38-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-37-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-36-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-35-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-34-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-33-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-32-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-31-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-30-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-29-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-28-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-27-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-26-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-25-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-54-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-55-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-56-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-57-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-58-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-59-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-60-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-61-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-62-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-63-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-64-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-65-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-66-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-67-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-68-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-69-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-70-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-71-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-72-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-73-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-74-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-75-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-76-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-77-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-78-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-79-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-80-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-81-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

  • memory/4728-82-0x00007FF6AABD0000-0x00007FF6AB6D3000-memory.dmp

    Filesize

    11.0MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.