Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    14s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    22/07/2024, 16:17 UTC

General

  • Target

    Mineralbeta.exe

  • Size

    787KB

  • MD5

    2b8184c9f54622a72211d4c17dba88d5

  • SHA1

    644e3e459e12d86e932f2e7a96fe98ae0d0fa547

  • SHA256

    195faded7aeb9b795f55063d2f83d1d429938ecd14a8bf10c39b6d07c202c6a7

  • SHA512

    18b3e8d2628c1fb468b761bb099f9cc38c709dc05121ebb2275ec2670c0b05aa858fdb39f4104615cb7d8635068bf24965064f966955a50a8d7c216ba71b0b8f

  • SSDEEP

    12288:5M1mdfEgLo2HAy4A456SoHlMj5I8TFy2dsFCHtBtoi12U0:5M1md8g8gAyjSoHlMj5noa1

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Mineralbeta.exe
    "C:\Users\Admin\AppData\Local\Temp\Mineralbeta.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2924

Network

  • flag-us
    DNS
    raw.githubusercontent.com
    Mineralbeta.exe
    Remote address:
    8.8.8.8:53
    Request
    raw.githubusercontent.com
    IN A
    Response
    raw.githubusercontent.com
    IN A
    185.199.111.133
    raw.githubusercontent.com
    IN A
    185.199.109.133
    raw.githubusercontent.com
    IN A
    185.199.108.133
    raw.githubusercontent.com
    IN A
    185.199.110.133
  • 185.199.111.133:443
    raw.githubusercontent.com
    tls
    Mineralbeta.exe
    528 B
    219 B
    6
    5
  • 8.8.8.8:53
    raw.githubusercontent.com
    dns
    Mineralbeta.exe
    71 B
    135 B
    1
    1

    DNS Request

    raw.githubusercontent.com

    DNS Response

    185.199.111.133
    185.199.109.133
    185.199.108.133
    185.199.110.133

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2924-0-0x0000000073C4E000-0x0000000073C4F000-memory.dmp

    Filesize

    4KB

  • memory/2924-1-0x0000000001210000-0x00000000012DA000-memory.dmp

    Filesize

    808KB

  • memory/2924-2-0x0000000073C40000-0x000000007432E000-memory.dmp

    Filesize

    6.9MB

  • memory/2924-3-0x0000000073C40000-0x000000007432E000-memory.dmp

    Filesize

    6.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.