Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 15:00
Static task
static1
Behavioral task
behavioral1
Sample
vaultFile11542278852936095360.exe
Resource
win7-20231215-en
General
-
Target
vaultFile11542278852936095360.exe
-
Size
209KB
-
MD5
2c728b8d169a71f995b2b06f70e1949c
-
SHA1
566799671a67ade9ac1319ee9c9526798afd8aeb
-
SHA256
fa679f8844ab283168f56247764b5e44cddd0aad6aea878fb213b80b54d51ce4
-
SHA512
cc07d587e64982232570cb7b7fdc858a449cdb1fc268a0954d69d2a90b4fcf3e73d0c44706d9533d7d4e8d2ad977f06819459711b22604615039b181370af707
-
SSDEEP
3072:p86dHxGNd5E9o7lOCET1NNAhTtaWmZzFfokt+F9EepWL2tI2b3UH8XAwKYEJ:plJ4Nwo7lOpT2hkWGzxU7pBwHSXEJ
Malware Config
Signatures
-
XMRig Miner payload 3 IoCs
resource yara_rule behavioral2/files/0x0003000000000713-55.dat xmrig behavioral2/memory/2256-64-0x0000000000400000-0x0000000000499000-memory.dmp xmrig behavioral2/memory/2256-65-0x0000000000400000-0x0000000000499000-memory.dmp xmrig -
Blocklisted process makes network request 2 IoCs
flow pid Process 7 732 WScript.exe 10 732 WScript.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation vaultFile11542278852936095360.exe -
Executes dropped EXE 1 IoCs
pid Process 2256 xmrig.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1140 schtasks.exe 4148 schtasks.exe 568 schtasks.exe -
Kills process with taskkill 1 IoCs
pid Process 4404 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings vaultFile11542278852936095360.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 7 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 10 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4404 taskkill.exe Token: SeIncBasePriorityPrivilege 2256 xmrig.exe Token: SeLockMemoryPrivilege 2256 xmrig.exe Token: SeLockMemoryPrivilege 2256 xmrig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 732 WScript.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3140 wrote to memory of 732 3140 vaultFile11542278852936095360.exe 88 PID 3140 wrote to memory of 732 3140 vaultFile11542278852936095360.exe 88 PID 3140 wrote to memory of 732 3140 vaultFile11542278852936095360.exe 88 PID 732 wrote to memory of 4404 732 WScript.exe 89 PID 732 wrote to memory of 4404 732 WScript.exe 89 PID 732 wrote to memory of 4404 732 WScript.exe 89 PID 732 wrote to memory of 1140 732 WScript.exe 99 PID 732 wrote to memory of 1140 732 WScript.exe 99 PID 732 wrote to memory of 1140 732 WScript.exe 99 PID 732 wrote to memory of 4148 732 WScript.exe 102 PID 732 wrote to memory of 4148 732 WScript.exe 102 PID 732 wrote to memory of 4148 732 WScript.exe 102 PID 732 wrote to memory of 568 732 WScript.exe 103 PID 732 wrote to memory of 568 732 WScript.exe 103 PID 732 wrote to memory of 568 732 WScript.exe 103 PID 732 wrote to memory of 2256 732 WScript.exe 105 PID 732 wrote to memory of 2256 732 WScript.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\vaultFile11542278852936095360.exe"C:\Users\Admin\AppData\Local\Temp\vaultFile11542278852936095360.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\winlog.vbs"2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /im xmrig.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4404
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC WEEKLY /D MON,TUE,WED,THU,FRI,SAT,SUN /TN "SYSTEM HEALTH1" /TR "C:\ProgramData\x64n\xmrig.exe" /ST 09:593⤵
- Creates scheduled task(s)
PID:1140
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC WEEKLY /D MON,TUE,WED,THU,FRI,SAT,SUN /TN "SYSTEM HEALTH2" /TR "C:\ProgramData\x64n\xmrig.exe" /ST 12:593⤵
- Creates scheduled task(s)
PID:4148
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC WEEKLY /D MON,TUE,WED,THU,FRI,SAT,SUN /TN "SYSTEM HEALTH3" /TR "C:\ProgramData\x64n\xmrig.exe" /ST 18:593⤵
- Creates scheduled task(s)
PID:568
-
-
C:\ProgramData\x64n\xmrig.exe"C:\ProgramData\x64n\xmrig.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2256
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5406ef562a1ed4e5ae5a3da786511e016
SHA18e440da9b8c0fa43e764854dfd84ac9e622fa82e
SHA25625aac05954d8717268c556f0708c69b6df5279c46f44b05c03308333f8e57cf1
SHA5122cf0ac454119d9ac24e9893796779ee476fe85b30b43d654dce1d7b8241d76431e6d22efd21a31fe6404762bc39cec7ad93549ac93cea225ef82a1d0da5a788e
-
Filesize
499B
MD5c251d06f10c3f0817e72bc550fca6aff
SHA1cf8def7f3c672c37b9444866393249052d342871
SHA25665de0b18a398e13d6c147de67ddd1ab558bb2a3d8778220e33f685e16b47c965
SHA51288cfa3e350f6afb8c48381aa7b24ceb069a2a81016e11ef7cee588b766c101bf56ebd08b023b350ee448b16458a6d8b3fe69549146aeda8ac2f4194e7244b5e2
-
Filesize
576KB
MD58f7e699ceed3fd1ae22b55edcf246596
SHA11a1b2a2a18651f0ae79b34a8707f8f6ece5cbe2b
SHA2566fe91d487876165347db6c5bd084101d32704755325b3648099c7b4d02b315a2
SHA512859e4ede427b20d76ee472575df7e076639f73aa9686aa71969b66b8eb4efc837c03a8d93351059a849b33c081372028a42be55a37360cb155bdce78e3301eec
-
Filesize
256KB
MD56ba688f68b6066a81ac9f0f26409bf80
SHA1709cf2d33bb0fc3302bc3c53bacaf5a391da927d
SHA2565e9f714e5273c69b70a7cf80bd299330ff725bb986823cf8797ab132f7d06bc3
SHA51287d448463aba4589afb89137f0fc8715a261d74303c31f3f1be0d9aa53261e8cc2d3a09c4de8dbfe8cec70e2650b3d256df5864adc7f36ad38f0975bb527fb5f