Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    10/01/2024, 21:47

General

  • Target

    51b441fc722169a556f963b3c6d4f3d1.exe

  • Size

    784KB

  • MD5

    51b441fc722169a556f963b3c6d4f3d1

  • SHA1

    18e1c4ca21e38955cfc5c62c826bd343933725ab

  • SHA256

    552274ddbef1513b376901247c3ef7545ef64d3bdc14e8ad2ba4ea46c0ff4ed6

  • SHA512

    5721b564c9dab19cef405c7da3621a53139459f40a80f38dcd1d1ffffd095891953824950c24b866d7d17310b3a1823bdf5f9200e9cfc777f2a762dda5d388a7

  • SSDEEP

    24576:3ve2yrY5GSfeS3ZeMxdCn8Aob/Itksjxg:xyrYsS3ZeMxwntoLcjxg

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 6 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\51b441fc722169a556f963b3c6d4f3d1.exe
    "C:\Users\Admin\AppData\Local\Temp\51b441fc722169a556f963b3c6d4f3d1.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Users\Admin\AppData\Local\Temp\51b441fc722169a556f963b3c6d4f3d1.exe
      C:\Users\Admin\AppData\Local\Temp\51b441fc722169a556f963b3c6d4f3d1.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:1696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\51b441fc722169a556f963b3c6d4f3d1.exe

    Filesize

    64KB

    MD5

    b35696958efd9d6def98b88b82e1ca34

    SHA1

    e57a75c31aa29830380b28549f40f66e6e0864e3

    SHA256

    8c339d1f890664a5e4bb6a68157c76d5adf5416a601a6edc6260646094228b0d

    SHA512

    6ba36099023cdc4316ac63002dd73addf5e4338d57dd34f45bcd3d303bd115fe7a7014291e0630d4b1d4312945cfdf3cc0a575337e26c79eb865aa52adaf8ace

  • \Users\Admin\AppData\Local\Temp\51b441fc722169a556f963b3c6d4f3d1.exe

    Filesize

    99KB

    MD5

    fe1265fe1957921fe8d1347ba80f1eb4

    SHA1

    db213df215c962907be62a81ab91d5395a26aa9f

    SHA256

    493211351991d0a9ad99338017c00e866fcad40a923b76ac8a6785bbdfd216ff

    SHA512

    fe4243e707ad941082e3410d7ff2fec2efbe5664640807dc73b145158bcbcfd546580bd8d951ee71ebb11e0e1280e6e8be2fcfd227b75682594530c1f50dfdc7

  • memory/1696-16-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/1696-18-0x00000000002E0000-0x00000000003A4000-memory.dmp

    Filesize

    784KB

  • memory/1696-24-0x0000000003150000-0x00000000032E3000-memory.dmp

    Filesize

    1.6MB

  • memory/1696-23-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/1696-17-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/1696-33-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/1712-0-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/1712-1-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/1712-15-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/1712-3-0x0000000000210000-0x00000000002D4000-memory.dmp

    Filesize

    784KB