Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
24/08/2024, 14:46
General
-
Target
________ ___________.exe
-
Size
1.1MB
-
MD5
35b94119f76089e8937496e6942fb9dd
-
SHA1
8cc1318e56d7f57ac2c1f62ebfffdd2ad68c4d7c
-
SHA256
f69025c3989bcf53faa23fb240fc6710ab36ed36c13b5c2fa78c8725772dbe4f
-
SHA512
d899970fbb9dc843def051d03830cc76a27b9ea4fab9b4785eba901a45d85d1db91cfa2d7f2e7458a1353636a98d012842e831f34e6b2c7fc69e43d0db150348
-
SSDEEP
24576:obx7BAy6HWDVXL2dqzdasluCO5iiZmD5CdA:obJBAy6HWDVJdasYCO5iiZf
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 15 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Cryptocurrency Miner
Makes network request to known mining pool URL.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\________ ___________.exe"C:\Users\Admin\AppData\Local\Temp\________ ___________.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\AudioDriver.exe" -o stratum+tcp://xmr.pool.minergate.com:45700 -u [email protected] -p x -k -v=0 --donate-level=1 -t 42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5bc74901be1f64e4270fae0712f61a7ec
SHA1432d40540405b9b5f55077fb4fea11d1d7bdeaed
SHA256cb3c5619a8391f989c6a69135d890c3126eda9841b9dc591d44f02078a6fd49b
SHA512d9289839db70d4f60ef1096b5fb0551f5f3a3b5b8e93cdb7c157b40a43f3d1986849850c1d44dff67a6a33275a6692c0209906eba83a2f93016ac1f73cf92344
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB