Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
10/01/2024, 21:47
Behavioral task
behavioral1
Sample
51b441fc722169a556f963b3c6d4f3d1.exe
Resource
win7-20231129-en
General
-
Target
51b441fc722169a556f963b3c6d4f3d1.exe
-
Size
784KB
-
MD5
51b441fc722169a556f963b3c6d4f3d1
-
SHA1
18e1c4ca21e38955cfc5c62c826bd343933725ab
-
SHA256
552274ddbef1513b376901247c3ef7545ef64d3bdc14e8ad2ba4ea46c0ff4ed6
-
SHA512
5721b564c9dab19cef405c7da3621a53139459f40a80f38dcd1d1ffffd095891953824950c24b866d7d17310b3a1823bdf5f9200e9cfc777f2a762dda5d388a7
-
SSDEEP
24576:3ve2yrY5GSfeS3ZeMxdCn8Aob/Itksjxg:xyrYsS3ZeMxwntoLcjxg
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
resource yara_rule behavioral1/memory/1712-1-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/1712-15-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/1696-24-0x0000000003150000-0x00000000032E3000-memory.dmp xmrig behavioral1/memory/1696-23-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/1696-17-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/1696-33-0x0000000000400000-0x0000000000587000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 1696 51b441fc722169a556f963b3c6d4f3d1.exe -
Executes dropped EXE 1 IoCs
pid Process 1696 51b441fc722169a556f963b3c6d4f3d1.exe -
Loads dropped DLL 1 IoCs
pid Process 1712 51b441fc722169a556f963b3c6d4f3d1.exe -
resource yara_rule behavioral1/memory/1712-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral1/memory/1696-16-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral1/files/0x0009000000015df1-14.dat upx behavioral1/files/0x0009000000015df1-10.dat upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1712 51b441fc722169a556f963b3c6d4f3d1.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1712 51b441fc722169a556f963b3c6d4f3d1.exe 1696 51b441fc722169a556f963b3c6d4f3d1.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1712 wrote to memory of 1696 1712 51b441fc722169a556f963b3c6d4f3d1.exe 19 PID 1712 wrote to memory of 1696 1712 51b441fc722169a556f963b3c6d4f3d1.exe 19 PID 1712 wrote to memory of 1696 1712 51b441fc722169a556f963b3c6d4f3d1.exe 19 PID 1712 wrote to memory of 1696 1712 51b441fc722169a556f963b3c6d4f3d1.exe 19
Processes
-
C:\Users\Admin\AppData\Local\Temp\51b441fc722169a556f963b3c6d4f3d1.exe"C:\Users\Admin\AppData\Local\Temp\51b441fc722169a556f963b3c6d4f3d1.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\51b441fc722169a556f963b3c6d4f3d1.exeC:\Users\Admin\AppData\Local\Temp\51b441fc722169a556f963b3c6d4f3d1.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1696
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5b35696958efd9d6def98b88b82e1ca34
SHA1e57a75c31aa29830380b28549f40f66e6e0864e3
SHA2568c339d1f890664a5e4bb6a68157c76d5adf5416a601a6edc6260646094228b0d
SHA5126ba36099023cdc4316ac63002dd73addf5e4338d57dd34f45bcd3d303bd115fe7a7014291e0630d4b1d4312945cfdf3cc0a575337e26c79eb865aa52adaf8ace
-
Filesize
99KB
MD5fe1265fe1957921fe8d1347ba80f1eb4
SHA1db213df215c962907be62a81ab91d5395a26aa9f
SHA256493211351991d0a9ad99338017c00e866fcad40a923b76ac8a6785bbdfd216ff
SHA512fe4243e707ad941082e3410d7ff2fec2efbe5664640807dc73b145158bcbcfd546580bd8d951ee71ebb11e0e1280e6e8be2fcfd227b75682594530c1f50dfdc7