Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2024, 13:06
Static task
static1
Behavioral task
behavioral1
Sample
MediaPlayer.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
MediaPlayer.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
MirClient.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
MirClient.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
WebBrowser.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
WebBrowser.dll
Resource
win10v2004-20240709-en
General
-
Target
MirClient.exe
-
Size
1.8MB
-
MD5
a48d7e53c577120e91d66a08d143b201
-
SHA1
ff6094aaa48380621e641e2a20d9eccaae01d507
-
SHA256
471e91720740b733284ee8448d682656934793f46085075d26919df32c06ed95
-
SHA512
ab4baca83152ee90158a2feb397cc860da20af9e867cec2540a2c9631e5f82a2dafb3d24d6bec33b9705a51fbe532f665b22dcb0fde75f580e2fdf975613fba9
-
SSDEEP
24576:jnY6PFW0+3cjyaiB6F/BB+Jj96Lz8Ol3TOpm9ieeIAQBlqBzqMEFNs8q6IFy9pMP:jVimpgnTOimf7D0zuFNskpMP
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: MirClient.exe File opened (read-only) \??\P: MirClient.exe File opened (read-only) \??\R: MirClient.exe File opened (read-only) \??\Z: MirClient.exe File opened (read-only) \??\A: MirClient.exe File opened (read-only) \??\I: MirClient.exe File opened (read-only) \??\K: MirClient.exe File opened (read-only) \??\L: MirClient.exe File opened (read-only) \??\N: MirClient.exe File opened (read-only) \??\O: MirClient.exe File opened (read-only) \??\S: MirClient.exe File opened (read-only) \??\B: MirClient.exe File opened (read-only) \??\G: MirClient.exe File opened (read-only) \??\H: MirClient.exe File opened (read-only) \??\Q: MirClient.exe File opened (read-only) \??\X: MirClient.exe File opened (read-only) \??\E: MirClient.exe File opened (read-only) \??\M: MirClient.exe File opened (read-only) \??\T: MirClient.exe File opened (read-only) \??\U: MirClient.exe File opened (read-only) \??\V: MirClient.exe File opened (read-only) \??\W: MirClient.exe File opened (read-only) \??\Y: MirClient.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe 3616 MirClient.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3616 MirClient.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 3616 MirClient.exe Token: SeCreatePagefilePrivilege 3616 MirClient.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3616 MirClient.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MirClient.exe"C:\Users\Admin\AppData\Local\Temp\MirClient.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3616
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b