Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10cz-x1/WinRing0x64.sys
windows7-x64
1cz-x1/WinRing0x64.sys
windows10-2004-x64
1cz-x1/benc...0M.cmd
windows7-x64
1cz-x1/benc...0M.cmd
windows10-2004-x64
1cz-x1/benc...1M.cmd
windows7-x64
1cz-x1/benc...1M.cmd
windows10-2004-x64
1cz-x1/pool...le.cmd
windows7-x64
1cz-x1/pool...le.cmd
windows10-2004-x64
1cz-x1/rtm_...le.cmd
windows7-x64
1cz-x1/rtm_...le.cmd
windows10-2004-x64
1cz-x1/solo...le.cmd
windows7-x64
1cz-x1/solo...le.cmd
windows10-2004-x64
1cz-x1/start.cmd
windows7-x64
1cz-x1/start.cmd
windows10-2004-x64
1cz-x1/xmrig.exe
windows7-x64
1cz-x1/xmrig.exe
windows10-2004-x64
1Analysis
-
max time kernel
128s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 03:32
Behavioral task
behavioral1
Sample
cz-x1/WinRing0x64.sys
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
cz-x1/WinRing0x64.sys
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
cz-x1/benchmark_10M.cmd
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
cz-x1/benchmark_10M.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
cz-x1/benchmark_1M.cmd
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
cz-x1/benchmark_1M.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
cz-x1/pool_mine_example.cmd
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
cz-x1/pool_mine_example.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
cz-x1/rtm_ghostrider_example.cmd
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
cz-x1/rtm_ghostrider_example.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
cz-x1/solo_mine_example.cmd
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
cz-x1/solo_mine_example.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
cz-x1/start.cmd
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
cz-x1/start.cmd
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
cz-x1/xmrig.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
cz-x1/xmrig.exe
Resource
win10v2004-20240709-en
General
-
Target
cz-x1/rtm_ghostrider_example.cmd
-
Size
1KB
-
MD5
3f0155abe745be1f6089eafc4f517ac8
-
SHA1
277f510ceb62b277b141d094c82eedebdc6f3a35
-
SHA256
810614290bdb14d2ddf10f65f8adc988a8272764f2a9e2c378e52fad162da344
-
SHA512
8def46852a962ff5dbed94e01f8d23019ef401a718d9c5a440d12b2ffa369539be328f165f68ccc2098cd5e5c939bcb5f784f877bdd7b9d939393bbd2229d19e
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 2156 xmrig.exe Token: SeLockMemoryPrivilege 2156 xmrig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2156 xmrig.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2572 wrote to memory of 2156 2572 cmd.exe 31 PID 2572 wrote to memory of 2156 2572 cmd.exe 31 PID 2572 wrote to memory of 2156 2572 cmd.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\cz-x1\rtm_ghostrider_example.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\cz-x1\xmrig.exexmrig.exe -a gr -o raptoreumemporium.com:3008 -u WALLET_ADDRESS -p x2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2156
-