Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2024-08-06...ig.exe

windows7-x64

10

2024-08-06...ig.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    06/08/2024, 11:00 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-08-06_8fa4ba96d81622607375659aa5775a76_icedid_xmrig.exe

  • Size

    6.0MB

  • MD5

    8fa4ba96d81622607375659aa5775a76

  • SHA1

    99d9cdbfd0bcbd6cda58f9c3e5b72853f1a5aa8b

  • SHA256

    554fb44d53e6d648e6e37ad2197cb109bd6107a3309b0a25adaca01f5f88bc55

  • SHA512

    5ddcd994c6cb67196d646418340ca341ab8e2dad39d3c79f1a3a9d7ca31953e263fd662313aa907c8d7cf14486f7e55d39a6353f4620c974bda19c67a0ce4020

  • SSDEEP

    98304:dvfapmo1Y4+6Y7SOEfX/SbgRLaYKw7UwrzKxUE:da9+6Y7SOEibgRJH7PVE

Score
10/10
blackmoonxmrigbankerdiscoveryevasionminerpersistencespywarestealertrojan

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • Detect Blackmoon payload 2 IoCs
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 17 IoCs
    miner
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 12 IoCs
    persistence
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-06_8fa4ba96d81622607375659aa5775a76_icedid_xmrig.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-06_8fa4ba96d81622607375659aa5775a76_icedid_xmrig.exe"
    1⤵
    • UAC bypass
    • Event Triggered Execution: Image File Execution Options Injection
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2364
    • C:\Windows\svchost.exe
      "C:\Windows\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2688

Network

  • flag-us
    DNS
    mine.ppxxmr.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    mine.ppxxmr.com
    IN A
    Response
No results found
  • 8.8.8.8:53
    mine.ppxxmr.com
    dns
    svchost.exe
    61 B
     133 B
     1
    1

    DNS Request

    mine.ppxxmr.com

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

3
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7z.exe
    Filesize

    6.5MB

    MD5

    13d3367024097e0149d1d873666391bc

    SHA1

    a611029a8b22d9eead4e306639cd6d06911b7232

    SHA256

    84fa8db6a88d5643d460e5306e2b1226354c870e8856a5888cfbb4ceb1ccd3ae

    SHA512

    893643e3b4f3e41cbf0f7ec89d04f697407b995b8c46fe304f901edeb5f7abf2a99e65dedbc89001af1161a61961dec33d7b5449d9e0121bd70a9c83067752d8

    Download Submit

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html
    Filesize

    16KB

    MD5

    ed1191da9c4f74a60d695a25686f374e

    SHA1

    3a427657c16a716be332587425101653c25221d0

    SHA256

    ab8cafd1958c27d70adc747259495e35592f8a06ae00969964f5f34f72896f3f

    SHA512

    68098c1342f87939b3f57cd3e3a799ff316d2f1eb5c52f8d9c0c9e7c214281bff68a1260a91527b7175ad031798f42125cf9ee2e0d49772eb03b5836b67d9fbf

    Download Submit

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html
    Filesize

    6KB

    MD5

    657eb3527d651515f97b960a67d19fda

    SHA1

    27404b587183bc2f3b3b6919fbb91892f505b60d

    SHA256

    f301745232a72d84f277980ad53b65d94b02479369e8b73fe0e6717adcf11a35

    SHA512

    1085550a8844de081a216bd864990e56fbe91498fb6186cce435173ab73e29932e7b8182078cd2876039addbdb7e3c9769d7d7923f7ed2a5422e6a2a36321b70

    Download Submit

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html
    Filesize

    12KB

    MD5

    cdea5d1cccee27144519c75bcf3015bd

    SHA1

    c36862abb1ada006b3dd4c28adc8b393a92fd325

    SHA256

    1184f2316c36648a2d457b602c713d5d5eb980e86e5e8ed388e94a47f8573dbd

    SHA512

    5d0ea1cef2af7111098c19578c42bfdfd7bb00ec3259fe026df6dd867a24f9a94f3299b035235e3cb87b1c9010f0d1be434a08318dae0412e03ecfdb439edfe9

    Download Submit

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html
    Filesize

    9KB

    MD5

    bc3e199345ad8ba54e2fe4acad95433d

    SHA1

    c93cb69c27e1c03069de3c952534a52f391e3fb9

    SHA256

    462c197c83ee3d677b07fe000b2c4e64ac4be4ceaaea80c1c77a5e67d832edd8

    SHA512

    c1941c9106ff0d665dfee1888afcdc3c54e4db8fdb11e3313cd92a147a1084264dba8f1f9cbac5216d3c5ce1f97ff7f8d7d7493826ec3538d5db57a933fe32e4

    Download Submit

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html
    Filesize

    14KB

    MD5

    59e4add1732aef6b8e228ecfb880c299

    SHA1

    31a6380e878f89ec9d2c83716fe42faafdd828db

    SHA256

    089aaccbf4c17d2a0163f13820e926f8ce3122c9ed87e7e040a77439795b8fc4

    SHA512

    461240638f98f92a0df94a6a76470d7ed3a9bf45f845b545ff37355efd4fb3efdbe592e563b6624d2e42374a3bf7682a572c3bfd96c21be87fc96ec3b3bcfbaf

    Download Submit

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html
    Filesize

    16KB

    MD5

    26986f79440b7a706b65724e509f009f

    SHA1

    9d8ff0beef1c19fbecd28e3f632101acf3d02599

    SHA256

    e59b7fa34b947d5ada478ff17543204251955052fdace284e5a285bd2abec5d1

    SHA512

    2c240c4f7b8912bd5049bef22c2507c7c1af15432c860549d0f1ea35f03183270eb7315607fdf35be86703a61ec0ed7801e9e6ea627a026dbf93d98ff11d2ed6

    Download Submit

  • C:\Windows\config.json
    Filesize

    1KB

    MD5

    88c5c5706d2e237422eda18490dc6a59

    SHA1

    bb8d12375f6b995301e756de2ef4fa3a3f6efd39

    SHA256

    4756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e

    SHA512

    a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7

    Download Submit

  • C:\Windows\svchost.exe
    Filesize

    833KB

    MD5

    4a87a4d6677558706db4afaeeeb58d20

    SHA1

    7738dc6a459f8415f0265d36c626b48202cd6764

    SHA256

    08b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7

    SHA512

    bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594

    Download Submit

  • C:\vcredist2010_x86.log.html
    Filesize

    81KB

    MD5

    8e4d18ea41de19d341b1f6b1443ce549

    SHA1

    9b84b16fc2cc40ed15c076399ba1df22f95211a5

    SHA256

    ab8ec24689a2e92a6aae4b84b0cf517a73ec3d8f519fe95667f523b313e162ab

    SHA512

    a1f7bb5eae190ed0ef246098302f05d84c10358d05be9e7d34d59df1171749c1e8f80fed6c3f7fa68be45473f9b5a3cc212e794a3230919e1a35fa440cf3c831

    Download Submit

  • memory/2364-0-0x0000000000400000-0x0000000000613000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2688-741-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

    Download

  • memory/2688-744-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

    Download

  • memory/2688-339-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

    Download

  • memory/2688-740-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

    Download

  • memory/2688-362-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

    Download

  • memory/2688-742-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

    Download

  • memory/2688-743-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

    Download

  • memory/2688-447-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

    Download

  • memory/2688-745-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

    Download

  • memory/2688-746-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

    Download

  • memory/2688-747-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

    Download

  • memory/2688-748-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

    Download

  • memory/2688-749-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

    Download

  • memory/2688-750-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.