Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/07/2024, 13:06

General

  • Target

    MirClient.exe

  • Size

    1.8MB

  • MD5

    a48d7e53c577120e91d66a08d143b201

  • SHA1

    ff6094aaa48380621e641e2a20d9eccaae01d507

  • SHA256

    471e91720740b733284ee8448d682656934793f46085075d26919df32c06ed95

  • SHA512

    ab4baca83152ee90158a2feb397cc860da20af9e867cec2540a2c9631e5f82a2dafb3d24d6bec33b9705a51fbe532f665b22dcb0fde75f580e2fdf975613fba9

  • SSDEEP

    24576:jnY6PFW0+3cjyaiB6F/BB+Jj96Lz8Ol3TOpm9ieeIAQBlqBzqMEFNs8q6IFy9pMP:jVimpgnTOimf7D0zuFNskpMP

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MirClient.exe
    "C:\Users\Admin\AppData\Local\Temp\MirClient.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3616

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

    Filesize

    9KB

    MD5

    7050d5ae8acfbe560fa11073fef8185d

    SHA1

    5bc38e77ff06785fe0aec5a345c4ccd15752560e

    SHA256

    cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

    SHA512

    a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

  • memory/3616-23-0x0000000000400000-0x000000000062E000-memory.dmp

    Filesize

    2.2MB

  • memory/3616-25-0x0000000000400000-0x000000000062E000-memory.dmp

    Filesize

    2.2MB

  • memory/3616-4-0x00000000032E0000-0x00000000034FD000-memory.dmp

    Filesize

    2.1MB

  • memory/3616-8-0x00000000032E0000-0x00000000034FD000-memory.dmp

    Filesize

    2.1MB

  • memory/3616-2-0x00000000032E0000-0x00000000034FD000-memory.dmp

    Filesize

    2.1MB

  • memory/3616-19-0x0000000000400000-0x000000000062E000-memory.dmp

    Filesize

    2.2MB

  • memory/3616-20-0x00000000008C0000-0x00000000008C1000-memory.dmp

    Filesize

    4KB

  • memory/3616-21-0x0000000000400000-0x000000000062E000-memory.dmp

    Filesize

    2.2MB

  • memory/3616-22-0x00000000032E0000-0x00000000034FD000-memory.dmp

    Filesize

    2.1MB

  • memory/3616-0-0x00000000008C0000-0x00000000008C1000-memory.dmp

    Filesize

    4KB

  • memory/3616-6-0x00000000034EC000-0x00000000034EE000-memory.dmp

    Filesize

    8KB

  • memory/3616-26-0x0000000000400000-0x000000000062E000-memory.dmp

    Filesize

    2.2MB

  • memory/3616-24-0x0000000000400000-0x000000000062E000-memory.dmp

    Filesize

    2.2MB

  • memory/3616-27-0x0000000000400000-0x000000000062E000-memory.dmp

    Filesize

    2.2MB

  • memory/3616-28-0x0000000000400000-0x000000000062E000-memory.dmp

    Filesize

    2.2MB

  • memory/3616-29-0x0000000000400000-0x000000000062E000-memory.dmp

    Filesize

    2.2MB

  • memory/3616-30-0x0000000000400000-0x000000000062E000-memory.dmp

    Filesize

    2.2MB

  • memory/3616-31-0x0000000000400000-0x000000000062E000-memory.dmp

    Filesize

    2.2MB

  • memory/3616-32-0x0000000000400000-0x000000000062E000-memory.dmp

    Filesize

    2.2MB

  • memory/3616-33-0x0000000000400000-0x000000000062E000-memory.dmp

    Filesize

    2.2MB

  • memory/3616-34-0x0000000000400000-0x000000000062E000-memory.dmp

    Filesize

    2.2MB