Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 19:17
Behavioral task
behavioral1
Sample
4962afe40192cd9657ba5f74f341ff82.exe
Resource
win7-20231129-en
9 signatures
150 seconds
General
-
Target
4962afe40192cd9657ba5f74f341ff82.exe
-
Size
784KB
-
MD5
4962afe40192cd9657ba5f74f341ff82
-
SHA1
841283ec53472bf95b7201cb82d43ba793cf58fb
-
SHA256
06316a5c21d1986b4c1f191452ee69856c265587a979e9ae4ef4bfa058b98908
-
SHA512
586e2e762b53a662b3d9950d4b4afd3c71add38aa8dd19b7cb43fe608bc1502bf0fac95f3395efa2d7ec97ec1110fad7ebc7f7e6d293c84504815c9bc137d62c
-
SSDEEP
12288:+i4NzBc8RC7AkNtj2VtI746Kro+4yJ8+GOzOvxIxBlCKJj96W7JtwMm7QN5jP:BgzBzCTNE38lya+GOCvEWKF9Lbhm7kB
Malware Config
Signatures
-
XMRig Miner payload 7 IoCs
resource yara_rule behavioral1/memory/2360-1-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/3060-24-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/3060-27-0x0000000003250000-0x00000000033E3000-memory.dmp xmrig behavioral1/memory/3060-35-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/3060-34-0x00000000005A0000-0x000000000071F000-memory.dmp xmrig behavioral1/memory/3060-18-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2360-14-0x0000000000400000-0x0000000000593000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 3060 4962afe40192cd9657ba5f74f341ff82.exe -
Executes dropped EXE 1 IoCs
pid Process 3060 4962afe40192cd9657ba5f74f341ff82.exe -
Loads dropped DLL 1 IoCs
pid Process 2360 4962afe40192cd9657ba5f74f341ff82.exe -
resource yara_rule behavioral1/memory/2360-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral1/memory/3060-17-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral1/memory/2360-15-0x0000000003290000-0x00000000035A2000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2360 4962afe40192cd9657ba5f74f341ff82.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2360 4962afe40192cd9657ba5f74f341ff82.exe 3060 4962afe40192cd9657ba5f74f341ff82.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2360 wrote to memory of 3060 2360 4962afe40192cd9657ba5f74f341ff82.exe 17 PID 2360 wrote to memory of 3060 2360 4962afe40192cd9657ba5f74f341ff82.exe 17 PID 2360 wrote to memory of 3060 2360 4962afe40192cd9657ba5f74f341ff82.exe 17 PID 2360 wrote to memory of 3060 2360 4962afe40192cd9657ba5f74f341ff82.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\4962afe40192cd9657ba5f74f341ff82.exeC:\Users\Admin\AppData\Local\Temp\4962afe40192cd9657ba5f74f341ff82.exe1⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:3060
-
C:\Users\Admin\AppData\Local\Temp\4962afe40192cd9657ba5f74f341ff82.exe"C:\Users\Admin\AppData\Local\Temp\4962afe40192cd9657ba5f74f341ff82.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2360