Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1800s
  • max time network
    1596s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    29/03/2024, 02:05

General

  • Target

    miner100.exe

  • Size

    2.7MB

  • MD5

    eae2347aaed97da4f802c0b32689f4eb

  • SHA1

    a7a83d1ff7ec22d74d8415b95b3d57f1323699ce

  • SHA256

    3d403e5661dd33a3e3e33585ce28384fde2f9d0d3e128ad5b46da1bec36ba0f4

  • SHA512

    65f3411a7e80ec6d1dfea40d644ca621f4de929d17e58a54e43030b58662fedba11f000928049b4d3d7ae6ec38003d62dd8109c330ceba588be96f598b35d7cd

  • SSDEEP

    49152:+Ev7yMxM0ZzUjqhWBkZFOj3nscD6gLRZdjM0PcuzQ3zAlkVKd:+EvWMxHUjqPPOjXsngLjdjBPz+3

Score
8/10

Malware Config

Signatures

  • Creates new service(s) 1 TTPs
  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 9 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Modifies data under HKEY_USERS 47 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:592
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:1004
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:644
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
        1⤵
          PID:752
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
          1⤵
            PID:908
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
            1⤵
              PID:1020
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
              1⤵
                PID:588
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
                1⤵
                  PID:1048
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
                  1⤵
                  • Drops file in System32 directory
                  PID:1056
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                  1⤵
                    PID:1064
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k localservice -s nsi
                    1⤵
                      PID:1160
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                      1⤵
                        PID:1236
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
                        1⤵
                          PID:1284
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s Themes
                          1⤵
                            PID:1344
                          • c:\windows\system32\svchost.exe
                            c:\windows\system32\svchost.exe -k localservice -s EventSystem
                            1⤵
                              PID:1368
                            • c:\windows\system32\svchost.exe
                              c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
                              1⤵
                                PID:1436
                              • c:\windows\system32\svchost.exe
                                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1444
                                • \??\c:\windows\system32\sihost.exe
                                  sihost.exe
                                  2⤵
                                    PID:5012
                                  • \??\c:\windows\system32\sihost.exe
                                    sihost.exe
                                    2⤵
                                      PID:4800
                                    • \??\c:\windows\system32\sihost.exe
                                      sihost.exe
                                      2⤵
                                        PID:3040
                                    • c:\windows\system32\svchost.exe
                                      c:\windows\system32\svchost.exe -k netsvcs -s SENS
                                      1⤵
                                        PID:1552
                                      • c:\windows\system32\svchost.exe
                                        c:\windows\system32\svchost.exe -k networkservice -s Dnscache
                                        1⤵
                                          PID:1568
                                        • C:\Windows\sysmon.exe
                                          C:\Windows\sysmon.exe
                                          1⤵
                                            PID:2488
                                          • C:\Users\Admin\AppData\Local\Temp\miner100.exe
                                            "C:\Users\Admin\AppData\Local\Temp\miner100.exe"
                                            1⤵
                                            • Drops file in System32 directory
                                            • Suspicious use of SetThreadContext
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of WriteProcessMemory
                                            PID:5060
                                            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2588
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                              2⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:3864
                                              • C:\Windows\system32\wusa.exe
                                                wusa /uninstall /kb:890830 /quiet /norestart
                                                3⤵
                                                  PID:1680
                                              • C:\Windows\system32\sc.exe
                                                C:\Windows\system32\sc.exe stop UsoSvc
                                                2⤵
                                                • Launches sc.exe
                                                PID:924
                                              • C:\Windows\system32\sc.exe
                                                C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                2⤵
                                                • Launches sc.exe
                                                PID:868
                                              • C:\Windows\system32\sc.exe
                                                C:\Windows\system32\sc.exe stop wuauserv
                                                2⤵
                                                • Launches sc.exe
                                                PID:2576
                                              • C:\Windows\system32\sc.exe
                                                C:\Windows\system32\sc.exe stop bits
                                                2⤵
                                                • Launches sc.exe
                                                PID:984
                                              • C:\Windows\system32\sc.exe
                                                C:\Windows\system32\sc.exe stop dosvc
                                                2⤵
                                                • Launches sc.exe
                                                PID:2856
                                              • C:\Windows\system32\powercfg.exe
                                                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                2⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2348
                                              • C:\Windows\system32\powercfg.exe
                                                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                2⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2248
                                              • C:\Windows\system32\powercfg.exe
                                                C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                2⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2284
                                              • C:\Windows\system32\powercfg.exe
                                                C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                2⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4320
                                              • C:\Windows\system32\dialer.exe
                                                C:\Windows\system32\dialer.exe
                                                2⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of WriteProcessMemory
                                                PID:4688
                                              • C:\Windows\system32\sc.exe
                                                C:\Windows\system32\sc.exe delete "OPAGMGUY"
                                                2⤵
                                                • Launches sc.exe
                                                PID:60
                                              • C:\Windows\system32\sc.exe
                                                C:\Windows\system32\sc.exe create "OPAGMGUY" binpath= "C:\ProgramData\axadwxtjeetz\tiucgvijebnv.exe" start= "auto"
                                                2⤵
                                                • Launches sc.exe
                                                PID:4372
                                              • C:\Windows\system32\sc.exe
                                                C:\Windows\system32\sc.exe stop eventlog
                                                2⤵
                                                • Launches sc.exe
                                                PID:2344
                                              • C:\Windows\system32\sc.exe
                                                C:\Windows\system32\sc.exe start "OPAGMGUY"
                                                2⤵
                                                • Launches sc.exe
                                                PID:3392
                                            • C:\ProgramData\axadwxtjeetz\tiucgvijebnv.exe
                                              C:\ProgramData\axadwxtjeetz\tiucgvijebnv.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4840
                                              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                2⤵
                                                • Drops file in System32 directory
                                                • Modifies data under HKEY_USERS
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:604

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\ProgramData\axadwxtjeetz\tiucgvijebnv.exe

                                              Filesize

                                              2.7MB

                                              MD5

                                              eae2347aaed97da4f802c0b32689f4eb

                                              SHA1

                                              a7a83d1ff7ec22d74d8415b95b3d57f1323699ce

                                              SHA256

                                              3d403e5661dd33a3e3e33585ce28384fde2f9d0d3e128ad5b46da1bec36ba0f4

                                              SHA512

                                              65f3411a7e80ec6d1dfea40d644ca621f4de929d17e58a54e43030b58662fedba11f000928049b4d3d7ae6ec38003d62dd8109c330ceba588be96f598b35d7cd

                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ps1w0sxo.tyo.ps1

                                              Filesize

                                              1B

                                              MD5

                                              c4ca4238a0b923820dcc509a6f75849b

                                              SHA1

                                              356a192b7913b04c54574d18c28d46e6395428ab

                                              SHA256

                                              6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                              SHA512

                                              4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                            • memory/588-101-0x0000020BA69E0000-0x0000020BA6A0B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/588-106-0x00007FFCD4D90000-0x00007FFCD4DA0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/588-114-0x0000020BA69E0000-0x0000020BA6A0B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/592-116-0x0000019F3DF00000-0x0000019F3DF2B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/592-70-0x00007FFD14DA5000-0x00007FFD14DA6000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/592-68-0x0000019F3DF00000-0x0000019F3DF2B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/592-64-0x0000019F3DB20000-0x0000019F3DB44000-memory.dmp

                                              Filesize

                                              144KB

                                            • memory/592-115-0x00007FFCD4D90000-0x00007FFCD4DA0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/604-234-0x000001DA2E760000-0x000001DA2E76A000-memory.dmp

                                              Filesize

                                              40KB

                                            • memory/604-194-0x000001DA2E740000-0x000001DA2E75C000-memory.dmp

                                              Filesize

                                              112KB

                                            • memory/604-195-0x00007FF6DC800000-0x00007FF6DC810000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/604-201-0x000001DA2EC40000-0x000001DA2ECF9000-memory.dmp

                                              Filesize

                                              740KB

                                            • memory/604-83-0x000001DA2E490000-0x000001DA2E4A0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/604-79-0x00007FFCF8200000-0x00007FFCF8BEC000-memory.dmp

                                              Filesize

                                              9.9MB

                                            • memory/604-291-0x000001DA2E490000-0x000001DA2E4A0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/604-294-0x000001DA2E490000-0x000001DA2E4A0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/604-325-0x00007FFCF8200000-0x00007FFCF8BEC000-memory.dmp

                                              Filesize

                                              9.9MB

                                            • memory/604-80-0x000001DA2E490000-0x000001DA2E4A0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/644-73-0x00000233B3730000-0x00000233B375B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/644-72-0x00007FFCD4D90000-0x00007FFCD4DA0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/644-326-0x00000233B3730000-0x00000233B375B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/644-75-0x00007FFD14DA5000-0x00007FFD14DA6000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/644-71-0x00000233B3730000-0x00000233B375B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/752-327-0x00000169AE690000-0x00000169AE6BB000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/752-90-0x00007FFCD4D90000-0x00007FFCD4DA0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/752-86-0x00000169AE690000-0x00000169AE6BB000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/908-95-0x00007FFCD4D90000-0x00007FFCD4DA0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/908-102-0x0000024789380000-0x00000247893AB000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/908-91-0x0000024789380000-0x00000247893AB000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1004-89-0x0000027903200000-0x000002790322B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1004-97-0x0000027903200000-0x000002790322B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1004-105-0x00007FFD14DA5000-0x00007FFD14DA6000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/1020-109-0x000001C9DFC60000-0x000001C9DFC8B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1020-96-0x000001C9DFC60000-0x000001C9DFC8B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1020-100-0x00007FFCD4D90000-0x00007FFCD4DA0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/1048-111-0x00007FFCD4D90000-0x00007FFCD4DA0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/1048-107-0x000001C16CD90000-0x000001C16CDBB000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1048-134-0x000001C16CD90000-0x000001C16CDBB000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1056-117-0x00007FFCD4D90000-0x00007FFCD4DA0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/1056-163-0x0000021487E60000-0x0000021487E8B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1056-112-0x0000021487E60000-0x0000021487E8B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1064-168-0x00000214E27B0000-0x00000214E27DB000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1064-131-0x00000214E27B0000-0x00000214E27DB000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1160-173-0x000001D7665F0000-0x000001D76661B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1160-133-0x000001D7665F0000-0x000001D76661B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1236-126-0x00007FFCD4D90000-0x00007FFCD4DA0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/1236-166-0x000001CF87E80000-0x000001CF87EAB000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1236-123-0x000001CF87E80000-0x000001CF87EAB000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1284-174-0x0000022A875F0000-0x0000022A8761B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1284-135-0x0000022A875F0000-0x0000022A8761B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1344-175-0x000001CD13EF0000-0x000001CD13F1B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1344-136-0x000001CD13EF0000-0x000001CD13F1B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1368-137-0x000001D281EC0000-0x000001D281EEB000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1368-184-0x000001D281EC0000-0x000001D281EEB000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1436-185-0x00000252A1BD0000-0x00000252A1BFB000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1444-172-0x0000020930FD0000-0x0000020930FFB000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1444-132-0x0000020930FD0000-0x0000020930FFB000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1552-170-0x00000211000A0000-0x00000211000CB000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/1568-171-0x00000178007A0000-0x00000178007CB000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/2588-23-0x0000022EF60C0000-0x0000022EF60D0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/2588-50-0x00007FFCF8200000-0x00007FFCF8BEC000-memory.dmp

                                              Filesize

                                              9.9MB

                                            • memory/2588-4-0x0000022EF61B0000-0x0000022EF61D2000-memory.dmp

                                              Filesize

                                              136KB

                                            • memory/2588-6-0x0000022EF60C0000-0x0000022EF60D0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/2588-7-0x0000022EF60C0000-0x0000022EF60D0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/2588-10-0x0000022EF62E0000-0x0000022EF6356000-memory.dmp

                                              Filesize

                                              472KB

                                            • memory/2588-46-0x0000022EF60C0000-0x0000022EF60D0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/2588-5-0x00007FFCF8200000-0x00007FFCF8BEC000-memory.dmp

                                              Filesize

                                              9.9MB

                                            • memory/4688-56-0x0000000140000000-0x000000014002B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/4688-51-0x0000000140000000-0x000000014002B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/4688-52-0x0000000140000000-0x000000014002B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/4688-54-0x0000000140000000-0x000000014002B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/4688-59-0x00007FFD13FC0000-0x00007FFD1406E000-memory.dmp

                                              Filesize

                                              696KB

                                            • memory/4688-57-0x00007FFD14D00000-0x00007FFD14EDB000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/4688-93-0x00007FFD14D00000-0x00007FFD14EDB000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/4688-61-0x0000000140000000-0x000000014002B000-memory.dmp

                                              Filesize

                                              172KB

                                            • memory/4688-53-0x0000000140000000-0x000000014002B000-memory.dmp

                                              Filesize

                                              172KB