Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10cz-x1/WinRing0x64.sys
windows7-x64
1cz-x1/WinRing0x64.sys
windows10-2004-x64
1cz-x1/benc...0M.cmd
windows7-x64
1cz-x1/benc...0M.cmd
windows10-2004-x64
1cz-x1/benc...1M.cmd
windows7-x64
1cz-x1/benc...1M.cmd
windows10-2004-x64
1cz-x1/pool...le.cmd
windows7-x64
1cz-x1/pool...le.cmd
windows10-2004-x64
1cz-x1/rtm_...le.cmd
windows7-x64
1cz-x1/rtm_...le.cmd
windows10-2004-x64
1cz-x1/solo...le.cmd
windows7-x64
1cz-x1/solo...le.cmd
windows10-2004-x64
1cz-x1/start.cmd
windows7-x64
1cz-x1/start.cmd
windows10-2004-x64
1cz-x1/xmrig.exe
windows7-x64
1cz-x1/xmrig.exe
windows10-2004-x64
1Analysis
-
max time kernel
148s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 03:32
Behavioral task
behavioral1
Sample
cz-x1/WinRing0x64.sys
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
cz-x1/WinRing0x64.sys
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
cz-x1/benchmark_10M.cmd
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
cz-x1/benchmark_10M.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
cz-x1/benchmark_1M.cmd
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
cz-x1/benchmark_1M.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
cz-x1/pool_mine_example.cmd
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
cz-x1/pool_mine_example.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
cz-x1/rtm_ghostrider_example.cmd
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
cz-x1/rtm_ghostrider_example.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
cz-x1/solo_mine_example.cmd
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
cz-x1/solo_mine_example.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
cz-x1/start.cmd
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
cz-x1/start.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
cz-x1/xmrig.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
cz-x1/xmrig.exe
Resource
win10v2004-20240709-en
General
-
Target
cz-x1/benchmark_1M.cmd
-
Size
60B
-
MD5
cba1927cf6959dc99ecbd0c553e4db6f
-
SHA1
7f2d59cfdf2b0550d22ac54d0b1fa5ac8f8b5f57
-
SHA256
d7747e7a3c782009f4ceb6e9c106115876386853929563b509da5258e3968d15
-
SHA512
c78ab9b017153c497ef2d0f568ade265ae9b60238ebdb36d8ef7ecc4d232cd90fd5fdc5b600bb26437466c7300e571b95b4ff92a7f024a981a02196a14d6e3f1
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 1832 xmrig.exe Token: SeLockMemoryPrivilege 1832 xmrig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1832 xmrig.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3672 wrote to memory of 1832 3672 cmd.exe 85 PID 3672 wrote to memory of 1832 3672 cmd.exe 85
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cz-x1\benchmark_1M.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\cz-x1\xmrig.exexmrig.exe --bench=1M --submit2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1832
-