Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
01/10/2024, 19:23 UTC
241001-x3szeszekf 1023/09/2024, 10:45 UTC
240923-mteqbsvdkj 1022/09/2024, 13:14 UTC
240922-qgq5da1flh 1022/09/2024, 13:13 UTC
240922-qgf96s1eml 1022/09/2024, 13:12 UTC
240922-qfysts1fjb 1022/09/2024, 13:12 UTC
240922-qfsa2s1erd 1022/09/2024, 11:50 UTC
240922-nzne4aybjf 1022/09/2024, 11:50 UTC
240922-nzmtkaxhrr 1022/09/2024, 11:50 UTC
240922-nzlw9sxhrp 1022/09/2024, 11:49 UTC
240922-nzfegsxhqr 10Analysis
-
max time kernel
1790s -
max time network
1765s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
01/10/2024, 19:23 UTC
General
-
Target
TEST POP/Start-Salvium - Copie (2) - Copie - Copie.bat
-
Size
102B
-
MD5
f6c3ca8b6489dd2343401ed0610a47ce
-
SHA1
1d6342ce8af33a4ba298d7b5e619502a7dbfe195
-
SHA256
1496fedb69b8dd719ebe2413ad6d59c5277d928bff1a86df265dee9060a007a0
-
SHA512
089a357fe5cd949df1b997a52e65fccf2ed2d493b40b86f896a1d79c26b94544a66a4aaba12ee3a7511a721c795a9728011d18d334f6663a563ad0bbbba0ee1b
Score
10/10
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 63 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TEST POP\Start-Salvium - Copie (2) - Copie - Copie.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TEST POP\xmrig.exexmrig.exe -a rx/0 --url "sal.kryptex.network:7777" --user scallorphee@gmail.com -p x -k2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
-
DNSsal.kryptex.networkRemote address:8.8.8.8:53Requestsal.kryptex.networkIN AResponsesal.kryptex.networkIN A5.9.61.230 -
DNS230.61.9.5.in-addr.arpaRemote address:8.8.8.8:53Request230.61.9.5.in-addr.arpaIN PTRResponse230.61.9.5.in-addr.arpaIN PTRstatic2306195clients your-serverde
-
DNSnexusrules.officeapps.live.comRemote address:8.8.8.8:53Requestnexusrules.officeapps.live.comIN AResponsenexusrules.officeapps.live.comIN CNAMEprod.nexusrules.live.com.akadns.netprod.nexusrules.live.com.akadns.netIN A52.111.227.13
-
DNSself.events.data.microsoft.comRemote address:8.8.8.8:53Requestself.events.data.microsoft.comIN AResponseself.events.data.microsoft.comIN CNAMEself-events-data.trafficmanager.netself-events-data.trafficmanager.netIN CNAMEonedscolprdeus10.eastus.cloudapp.azure.comonedscolprdeus10.eastus.cloudapp.azure.comIN A52.168.117.169
-
DNS169.117.168.52.in-addr.arpaRemote address:8.8.8.8:53Request169.117.168.52.in-addr.arpaIN PTRResponse
-
DNSctldl.windowsupdate.comRemote address:8.8.8.8:53Requestctldl.windowsupdate.comIN AResponsectldl.windowsupdate.comIN CNAMEctldl.windowsupdate.com.delivery.microsoft.comctldl.windowsupdate.com.delivery.microsoft.comIN CNAMEwu-b-net.trafficmanager.netwu-b-net.trafficmanager.netIN CNAMEdownload.windowsupdate.com.edgesuite.netdownload.windowsupdate.com.edgesuite.netIN CNAMEa767.dspw65.akamai.neta767.dspw65.akamai.netIN A2.20.12.94a767.dspw65.akamai.netIN A2.20.12.97
-
DNSocsp.digicert.comRemote address:8.8.8.8:53Requestocsp.digicert.comIN AResponseocsp.digicert.comIN CNAMEocsp.edge.digicert.comocsp.edge.digicert.comIN CNAMEfp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.2be4.phicdn.netIN CNAMEfp2e7a.wpc.phicdn.netfp2e7a.wpc.phicdn.netIN A192.229.221.95
-
DNS94.12.20.2.in-addr.arpaRemote address:8.8.8.8:53Request94.12.20.2.in-addr.arpaIN PTRResponse94.12.20.2.in-addr.arpaIN PTRa2-20-12-94deploystaticakamaitechnologiescom
-
DNSctldl.windowsupdate.comRemote address:8.8.8.8:53Requestctldl.windowsupdate.comIN AResponsectldl.windowsupdate.comIN CNAMEctldl.windowsupdate.com.delivery.microsoft.comctldl.windowsupdate.com.delivery.microsoft.comIN CNAMEwu-b-net.trafficmanager.netwu-b-net.trafficmanager.netIN CNAMEdownload.windowsupdate.com.edgesuite.netdownload.windowsupdate.com.edgesuite.netIN CNAMEa767.dspw65.akamai.neta767.dspw65.akamai.netIN A2.23.210.88a767.dspw65.akamai.netIN A2.23.210.83
-
DNS88.210.23.2.in-addr.arpaRemote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTRResponse88.210.23.2.in-addr.arpaIN PTRa2-23-210-88deploystaticakamaitechnologiescom
-
5.9.61.230:7777sal.kryptex.network
-
8.8.8.8:53sal.kryptex.networkdns
DNS Request
sal.kryptex.network
DNS Response
5.9.61.230
DNS Request
230.61.9.5.in-addr.arpa
DNS Request
nexusrules.officeapps.live.com
DNS Response
52.111.227.13
DNS Request
self.events.data.microsoft.com
DNS Response
52.168.117.169
DNS Request
169.117.168.52.in-addr.arpa
DNS Request
ctldl.windowsupdate.com
DNS Response
2.20.12.942.20.12.97
DNS Request
ocsp.digicert.com
DNS Response
192.229.221.95
DNS Request
94.12.20.2.in-addr.arpa
DNS Request
ctldl.windowsupdate.com
DNS Response
2.23.210.882.23.210.83
DNS Request
88.210.23.2.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
12.2MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
12.2MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB