Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 04:12
Behavioral task
behavioral1
Sample
5280000395bac0e5bc2eda0d346c4503.exe
Resource
win7-20231129-en
General
-
Target
5280000395bac0e5bc2eda0d346c4503.exe
-
Size
784KB
-
MD5
5280000395bac0e5bc2eda0d346c4503
-
SHA1
e5d044177a6c3bba12ee66198fa31c0862b8de64
-
SHA256
18c4b5ad1c9b17a178644ed3c0dec979c825ffe4dce30d242b3949cc9497eb2e
-
SHA512
afbad1753951b1175d2dfc7ca6888434f3dba840431282015cb2968704f0c6000f77ceacc1634ac319940a86f15e61d8bae655d1ab0a351408661e27d1a04b65
-
SSDEEP
12288:4w9roMj2kwtMus9MjRC+h/6DpfWVqjs/ev2QDFk8V0dG6hwfXlAdGl2nuF56sPo7:4MjSJ9CcwvwTQDaZdG6gknuFlPo5ATq
Malware Config
Signatures
-
XMRig Miner payload 7 IoCs
resource yara_rule behavioral2/memory/3652-2-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/3972-20-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/3972-23-0x0000000005340000-0x00000000054D3000-memory.dmp xmrig behavioral2/memory/3972-31-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/3972-30-0x00000000005A0000-0x000000000071F000-memory.dmp xmrig behavioral2/memory/3972-14-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/3652-12-0x0000000000400000-0x0000000000593000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 3972 5280000395bac0e5bc2eda0d346c4503.exe -
Executes dropped EXE 1 IoCs
pid Process 3972 5280000395bac0e5bc2eda0d346c4503.exe -
resource yara_rule behavioral2/memory/3652-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral2/files/0x00080000000231ea-11.dat upx behavioral2/memory/3972-13-0x0000000000400000-0x0000000000712000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3652 5280000395bac0e5bc2eda0d346c4503.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3652 5280000395bac0e5bc2eda0d346c4503.exe 3972 5280000395bac0e5bc2eda0d346c4503.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3652 wrote to memory of 3972 3652 5280000395bac0e5bc2eda0d346c4503.exe 93 PID 3652 wrote to memory of 3972 3652 5280000395bac0e5bc2eda0d346c4503.exe 93 PID 3652 wrote to memory of 3972 3652 5280000395bac0e5bc2eda0d346c4503.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\5280000395bac0e5bc2eda0d346c4503.exe"C:\Users\Admin\AppData\Local\Temp\5280000395bac0e5bc2eda0d346c4503.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\5280000395bac0e5bc2eda0d346c4503.exeC:\Users\Admin\AppData\Local\Temp\5280000395bac0e5bc2eda0d346c4503.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:3972
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD51842e5a911e0cb13ee578ff09e231a30
SHA1e790c914b3464803ae24622295fc310dbb8cfc3a
SHA2560fbf05e23f44d783d77e11fc57af945ce547492fd0c93743f06716c3b349df17
SHA512c593da19d91865f1d0541719d3b5d8bd0cc33b598f2abd5faee784f9b0e6a66bd59c9b4b615d70baa952c69fbb685f74d3931f6d6fc554837cd92cd7ef5c028a