Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10cz-x1/WinRing0x64.sys
windows7-x64
1cz-x1/WinRing0x64.sys
windows10-2004-x64
1cz-x1/benc...0M.cmd
windows7-x64
1cz-x1/benc...0M.cmd
windows10-2004-x64
1cz-x1/benc...1M.cmd
windows7-x64
1cz-x1/benc...1M.cmd
windows10-2004-x64
1cz-x1/pool...le.cmd
windows7-x64
1cz-x1/pool...le.cmd
windows10-2004-x64
1cz-x1/rtm_...le.cmd
windows7-x64
1cz-x1/rtm_...le.cmd
windows10-2004-x64
1cz-x1/solo...le.cmd
windows7-x64
1cz-x1/solo...le.cmd
windows10-2004-x64
1cz-x1/start.cmd
windows7-x64
1cz-x1/start.cmd
windows10-2004-x64
1cz-x1/xmrig.exe
windows7-x64
1cz-x1/xmrig.exe
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 03:32
Behavioral task
behavioral1
Sample
cz-x1/WinRing0x64.sys
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
cz-x1/WinRing0x64.sys
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
cz-x1/benchmark_10M.cmd
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
cz-x1/benchmark_10M.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
cz-x1/benchmark_1M.cmd
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
cz-x1/benchmark_1M.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
cz-x1/pool_mine_example.cmd
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
cz-x1/pool_mine_example.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
cz-x1/rtm_ghostrider_example.cmd
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
cz-x1/rtm_ghostrider_example.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
cz-x1/solo_mine_example.cmd
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
cz-x1/solo_mine_example.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
cz-x1/start.cmd
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
cz-x1/start.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
cz-x1/xmrig.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
cz-x1/xmrig.exe
Resource
win10v2004-20240709-en
General
-
Target
cz-x1/benchmark_1M.cmd
-
Size
60B
-
MD5
cba1927cf6959dc99ecbd0c553e4db6f
-
SHA1
7f2d59cfdf2b0550d22ac54d0b1fa5ac8f8b5f57
-
SHA256
d7747e7a3c782009f4ceb6e9c106115876386853929563b509da5258e3968d15
-
SHA512
c78ab9b017153c497ef2d0f568ade265ae9b60238ebdb36d8ef7ecc4d232cd90fd5fdc5b600bb26437466c7300e571b95b4ff92a7f024a981a02196a14d6e3f1
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 2360 xmrig.exe Token: SeLockMemoryPrivilege 2360 xmrig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2360 xmrig.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2360 2356 cmd.exe 31 PID 2356 wrote to memory of 2360 2356 cmd.exe 31 PID 2356 wrote to memory of 2360 2356 cmd.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\cz-x1\benchmark_1M.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\cz-x1\xmrig.exexmrig.exe --bench=1M --submit2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2360
-