Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
01/10/2024, 19:23 UTC
241001-x3szeszekf 1023/09/2024, 10:45 UTC
240923-mteqbsvdkj 1022/09/2024, 13:14 UTC
240922-qgq5da1flh 1022/09/2024, 13:13 UTC
240922-qgf96s1eml 1022/09/2024, 13:12 UTC
240922-qfysts1fjb 1022/09/2024, 13:12 UTC
240922-qfsa2s1erd 1022/09/2024, 11:50 UTC
240922-nzne4aybjf 1022/09/2024, 11:50 UTC
240922-nzmtkaxhrr 1022/09/2024, 11:50 UTC
240922-nzlw9sxhrp 1022/09/2024, 11:49 UTC
240922-nzfegsxhqr 10Analysis
-
max time kernel
299s -
max time network
252s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
22/09/2024, 11:50 UTC
General
-
Target
TEST POP/Start-Salvium - Copie (4).bat
-
Size
102B
-
MD5
f6c3ca8b6489dd2343401ed0610a47ce
-
SHA1
1d6342ce8af33a4ba298d7b5e619502a7dbfe195
-
SHA256
1496fedb69b8dd719ebe2413ad6d59c5277d928bff1a86df265dee9060a007a0
-
SHA512
089a357fe5cd949df1b997a52e65fccf2ed2d493b40b86f896a1d79c26b94544a66a4aaba12ee3a7511a721c795a9728011d18d334f6663a563ad0bbbba0ee1b
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TEST POP\Start-Salvium - Copie (4).bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TEST POP\xmrig.exexmrig.exe -a rx/0 --url "sal.kryptex.network:7777" --user scallorphee@gmail.com -p x -k2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
-
DNSsal.kryptex.networkRemote address:8.8.8.8:53Requestsal.kryptex.networkIN AResponsesal.kryptex.networkIN A5.9.61.230 -
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
DNSnexusrules.officeapps.live.comRemote address:8.8.8.8:53Requestnexusrules.officeapps.live.comIN AResponsenexusrules.officeapps.live.comIN CNAMEprod.nexusrules.live.com.akadns.netprod.nexusrules.live.com.akadns.netIN A52.111.229.19
-
DNS230.61.9.5.in-addr.arpaRemote address:8.8.8.8:53Request230.61.9.5.in-addr.arpaIN PTRResponse230.61.9.5.in-addr.arpaIN PTRstatic2306195clients your-serverde
-
DNS19.229.111.52.in-addr.arpaRemote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
5.9.61.230:7777sal.kryptex.network
-
8.8.8.8:53sal.kryptex.networkdns
DNS Request
sal.kryptex.network
DNS Response
5.9.61.230
DNS Request
8.8.8.8.in-addr.arpa
DNS Request
nexusrules.officeapps.live.com
DNS Response
52.111.229.19
-
8.8.8.8:53230.61.9.5.in-addr.arpadns
DNS Request
230.61.9.5.in-addr.arpa
DNS Request
19.229.111.52.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
12.2MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB