Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/01/2024, 01:37

General

  • Target

    51a9a75f25908da04e103544853a31b9.exe

  • Size

    784KB

  • MD5

    51a9a75f25908da04e103544853a31b9

  • SHA1

    bd6f59741ad73d35d1b3e7c72cc442250438c699

  • SHA256

    936bd6fe68ab197ec2532172609c42906135dce4ed2a9c00534753256befd43d

  • SHA512

    dcc5c321819bc00f26aba376f2ce45a84f3b51f85aed80957560131a065213de5e659c984b523ecfbbbafdb40c84920ed333d7005a774116c06abf3db73bc325

  • SSDEEP

    12288:T0Q9RGgdQSTpFCH+sAk1fxBi6O28Vq9yBQ+CvkAscJKw1Q/h0MW:XH7dQ+39vAA/A9yJrAbJ+/h/

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 6 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\51a9a75f25908da04e103544853a31b9.exe
    "C:\Users\Admin\AppData\Local\Temp\51a9a75f25908da04e103544853a31b9.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1248
    • C:\Users\Admin\AppData\Local\Temp\51a9a75f25908da04e103544853a31b9.exe
      C:\Users\Admin\AppData\Local\Temp\51a9a75f25908da04e103544853a31b9.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:3684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\51a9a75f25908da04e103544853a31b9.exe

    Filesize

    256KB

    MD5

    cc9b90bc3e0246a5a551cb3b9fabdfce

    SHA1

    aebd607d35b48528f5cf24ca02af0acb9f702248

    SHA256

    f01b678a897fa0620e7a856b6aecf20c8668085500ab53e798031df007f9160c

    SHA512

    cbceaa488665a673d52c2c68e5d2bbd1ccf38ae8bf94cd5b2f1e31dafc16ca93aee489dffbb2f99e696d2fcf3247b42ebeb68fabf77e0be543328e72cc9997fa

  • memory/1248-0-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/1248-1-0x0000000001A40000-0x0000000001B04000-memory.dmp

    Filesize

    784KB

  • memory/1248-2-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/1248-12-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/3684-13-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/3684-14-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/3684-16-0x00000000018C0000-0x0000000001984000-memory.dmp

    Filesize

    784KB

  • memory/3684-21-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/3684-20-0x0000000005430000-0x00000000055C3000-memory.dmp

    Filesize

    1.6MB

  • memory/3684-30-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB