Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/02/2024, 15:35
Behavioral task
behavioral1
Sample
ac3ab813f034022384909c4a83ddf11c.exe
Resource
win7-20240221-en
General
-
Target
ac3ab813f034022384909c4a83ddf11c.exe
-
Size
784KB
-
MD5
ac3ab813f034022384909c4a83ddf11c
-
SHA1
873bb8be328c6d4b17c70f7ec3032f965aa210cb
-
SHA256
55818ef859190746b3f8bcd16abb787b2aa7478d3cbb26bc323a284dca5d925c
-
SHA512
72684e88110ff69a744a7433ba3489a77a499829387466819c1f4c12ac7644054092a2739be181360acd821e98f981d956dc8820464bb72ffcbfc887cc5f82ea
-
SSDEEP
24576:CuWzb76RujsWAK8J5/kjrt9PXJo9X1RbZoB:C1zOuNAKA58jzJYX1R
Malware Config
Signatures
-
XMRig Miner payload 7 IoCs
resource yara_rule behavioral1/memory/2512-1-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2512-14-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2212-17-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2212-23-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/2212-26-0x0000000003250000-0x00000000033E3000-memory.dmp xmrig behavioral1/memory/2212-33-0x00000000005A0000-0x000000000071F000-memory.dmp xmrig behavioral1/memory/2212-34-0x0000000000400000-0x0000000000587000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 2212 ac3ab813f034022384909c4a83ddf11c.exe -
Executes dropped EXE 1 IoCs
pid Process 2212 ac3ab813f034022384909c4a83ddf11c.exe -
Loads dropped DLL 1 IoCs
pid Process 2512 ac3ab813f034022384909c4a83ddf11c.exe -
resource yara_rule behavioral1/memory/2512-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral1/files/0x000b000000012256-10.dat upx behavioral1/memory/2212-16-0x0000000000400000-0x0000000000712000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2512 ac3ab813f034022384909c4a83ddf11c.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2512 ac3ab813f034022384909c4a83ddf11c.exe 2212 ac3ab813f034022384909c4a83ddf11c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2212 2512 ac3ab813f034022384909c4a83ddf11c.exe 29 PID 2512 wrote to memory of 2212 2512 ac3ab813f034022384909c4a83ddf11c.exe 29 PID 2512 wrote to memory of 2212 2512 ac3ab813f034022384909c4a83ddf11c.exe 29 PID 2512 wrote to memory of 2212 2512 ac3ab813f034022384909c4a83ddf11c.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac3ab813f034022384909c4a83ddf11c.exe"C:\Users\Admin\AppData\Local\Temp\ac3ab813f034022384909c4a83ddf11c.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\ac3ab813f034022384909c4a83ddf11c.exeC:\Users\Admin\AppData\Local\Temp\ac3ab813f034022384909c4a83ddf11c.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2212
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD513f1c89c03ab032e37ba7b40da21e2f2
SHA1de729e34bd7a7f49dcb7b7a789f242bf934c36f9
SHA256de7a2c21eef38343ff10c205c65a373a67dd1535b10818cc5b6490f03958f5cd
SHA512d4c6794d59e1441122c3c334a638703a07c5774cef3bc911717c82b3b212b6e570e412a9b23cc4252ecca6931d0e30b2a457df29f22a1e15463f023c2f34c57c