Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/01/2024, 07:51
Behavioral task
behavioral1
Sample
55e4e51a752a839e60126331df007fe7.exe
Resource
win7-20231215-en
9 signatures
150 seconds
General
-
Target
55e4e51a752a839e60126331df007fe7.exe
-
Size
784KB
-
MD5
55e4e51a752a839e60126331df007fe7
-
SHA1
e9beca276ee829f956e429906749b55163f3ae73
-
SHA256
9da4dd292a20ed8d2ce29f78b3b9d9eea9b20d0e1a13f91cb569ab413c934e4d
-
SHA512
17376f4581d9bf1d0d27bb6fc3577918d2fb50ee533916d2ccf0e91d7f9de827f8649486101b32a118eaf6e28cfcff6a43783f46b27ddbe3b77494ff4fb0a2f6
-
SSDEEP
12288:/uEnSFCmJruhOjbNGyBdsmAl+pUy9bO5D+xUhXcKclQCQh6/JRZcwDwPX5u3VWxh:/uuQ0h2hGyLpzOx6wbY/tsYWMvY
Malware Config
Signatures
-
XMRig Miner payload 9 IoCs
resource yara_rule behavioral1/memory/2104-1-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2432-17-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2432-24-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/2432-26-0x0000000003200000-0x0000000003393000-memory.dmp xmrig behavioral1/memory/2432-35-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/2432-34-0x00000000005A0000-0x000000000071F000-memory.dmp xmrig behavioral1/memory/2432-18-0x0000000000400000-0x0000000000712000-memory.dmp xmrig behavioral1/memory/2104-16-0x0000000003170000-0x0000000003482000-memory.dmp xmrig behavioral1/memory/2104-15-0x0000000000400000-0x0000000000593000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 2432 55e4e51a752a839e60126331df007fe7.exe -
Executes dropped EXE 1 IoCs
pid Process 2432 55e4e51a752a839e60126331df007fe7.exe -
Loads dropped DLL 1 IoCs
pid Process 2104 55e4e51a752a839e60126331df007fe7.exe -
resource yara_rule behavioral1/memory/2104-0-0x0000000000400000-0x0000000000712000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2104 55e4e51a752a839e60126331df007fe7.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2104 55e4e51a752a839e60126331df007fe7.exe 2432 55e4e51a752a839e60126331df007fe7.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2432 2104 55e4e51a752a839e60126331df007fe7.exe 17 PID 2104 wrote to memory of 2432 2104 55e4e51a752a839e60126331df007fe7.exe 17 PID 2104 wrote to memory of 2432 2104 55e4e51a752a839e60126331df007fe7.exe 17 PID 2104 wrote to memory of 2432 2104 55e4e51a752a839e60126331df007fe7.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\55e4e51a752a839e60126331df007fe7.exe"C:\Users\Admin\AppData\Local\Temp\55e4e51a752a839e60126331df007fe7.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\55e4e51a752a839e60126331df007fe7.exeC:\Users\Admin\AppData\Local\Temp\55e4e51a752a839e60126331df007fe7.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2432
-