Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10cz-x1/WinRing0x64.sys
windows7-x64
1cz-x1/WinRing0x64.sys
windows10-2004-x64
1cz-x1/benc...0M.cmd
windows7-x64
1cz-x1/benc...0M.cmd
windows10-2004-x64
1cz-x1/benc...1M.cmd
windows7-x64
1cz-x1/benc...1M.cmd
windows10-2004-x64
1cz-x1/pool...le.cmd
windows7-x64
1cz-x1/pool...le.cmd
windows10-2004-x64
1cz-x1/rtm_...le.cmd
windows7-x64
1cz-x1/rtm_...le.cmd
windows10-2004-x64
1cz-x1/solo...le.cmd
windows7-x64
1cz-x1/solo...le.cmd
windows10-2004-x64
1cz-x1/start.cmd
windows7-x64
1cz-x1/start.cmd
windows10-2004-x64
1cz-x1/xmrig.exe
windows7-x64
1cz-x1/xmrig.exe
windows10-2004-x64
1Analysis
-
max time kernel
136s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 03:32
Behavioral task
behavioral1
Sample
cz-x1/WinRing0x64.sys
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
cz-x1/WinRing0x64.sys
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
cz-x1/benchmark_10M.cmd
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
cz-x1/benchmark_10M.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
cz-x1/benchmark_1M.cmd
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
cz-x1/benchmark_1M.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
cz-x1/pool_mine_example.cmd
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
cz-x1/pool_mine_example.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
cz-x1/rtm_ghostrider_example.cmd
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
cz-x1/rtm_ghostrider_example.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
cz-x1/solo_mine_example.cmd
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
cz-x1/solo_mine_example.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
cz-x1/start.cmd
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
cz-x1/start.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
cz-x1/xmrig.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
cz-x1/xmrig.exe
Resource
win10v2004-20240709-en
General
-
Target
cz-x1/benchmark_10M.cmd
-
Size
61B
-
MD5
5be1c4cacb5ae37c43527e99a097dc7a
-
SHA1
1b2f00fefde9d601764d5d26d5e0fb2b9f58074c
-
SHA256
235a64e3520b1c2c27763122b303f78aee8d7c083dfd9f1eb936cd5174383609
-
SHA512
20a9e18bc397fe86514875af4213a02a5831a27671370849f05c2f3ba048bc29fc41ca96f0cb1cc08aaff27bbebf637f30d2ee798cb80ed03080e8c7d8f2d9a1
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 3792 xmrig.exe Token: SeLockMemoryPrivilege 3792 xmrig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3792 xmrig.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 728 wrote to memory of 3792 728 cmd.exe 85 PID 728 wrote to memory of 3792 728 cmd.exe 85
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cz-x1\benchmark_10M.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Users\Admin\AppData\Local\Temp\cz-x1\xmrig.exexmrig.exe --bench=10M --submit2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3792
-