Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2024, 09:23 UTC

General

  • Target

    2024-12-26_10a7b5272a2ef63da1a6e051e1556431_icedid_xmrig.exe

  • Size

    3.9MB

  • MD5

    10a7b5272a2ef63da1a6e051e1556431

  • SHA1

    f5541892354885cbfc4aaeb470519e5b0eb3b871

  • SHA256

    828260eaa7f0e469baa894668554b8933e82ba526806976d894a8061bdeed162

  • SHA512

    f132ad3fedd1ba2e3e355f06df5a018c8884caf5f6c7e43bd6ccbd21299ed7083bb676252d1b89421f45e4130e0e1b68067e7d915b762c5f4b9ec9f43e75ddf1

  • SSDEEP

    98304:dvfapmo1Y4+6Y7SOEfX/SbgR98Jy91SHINL:da9+6Y7SOEibgRrwo

Malware Config

Signatures

  • Blackmoon family
  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 2 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 17 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 12 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-26_10a7b5272a2ef63da1a6e051e1556431_icedid_xmrig.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-26_10a7b5272a2ef63da1a6e051e1556431_icedid_xmrig.exe"
    1⤵
    • UAC bypass
    • Event Triggered Execution: Image File Execution Options Injection
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2068
    • C:\Windows\svchost.exe
      "C:\Windows\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2316

Network

  • flag-us
    DNS
    mine.ppxxmr.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    mine.ppxxmr.com
    IN A
    Response
No results found
  • 8.8.8.8:53
    mine.ppxxmr.com
    dns
    svchost.exe
    61 B
    133 B
    1
    1

    DNS Request

    mine.ppxxmr.com

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7z.exe

    Filesize

    4.4MB

    MD5

    c8b1d8b7e6e9605ddb38cacc8a51b54c

    SHA1

    f1d5a709bf6e3162b3f130de669169f42c1bd70f

    SHA256

    7f6cdbc4ffafc437268399eef8d4e5ca35420daa1cffd94ad6d74f5365e05a20

    SHA512

    f416ea9819b94334dbeaf52774d29e88507190ff2f9756ba4e4f5d608f952f55f358ca1391ab318958d8f578067561352fc0ed5c12fb03f042e95a2404570b8f

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html

    Filesize

    16KB

    MD5

    ed1191da9c4f74a60d695a25686f374e

    SHA1

    3a427657c16a716be332587425101653c25221d0

    SHA256

    ab8cafd1958c27d70adc747259495e35592f8a06ae00969964f5f34f72896f3f

    SHA512

    68098c1342f87939b3f57cd3e3a799ff316d2f1eb5c52f8d9c0c9e7c214281bff68a1260a91527b7175ad031798f42125cf9ee2e0d49772eb03b5836b67d9fbf

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html

    Filesize

    6KB

    MD5

    657eb3527d651515f97b960a67d19fda

    SHA1

    27404b587183bc2f3b3b6919fbb91892f505b60d

    SHA256

    f301745232a72d84f277980ad53b65d94b02479369e8b73fe0e6717adcf11a35

    SHA512

    1085550a8844de081a216bd864990e56fbe91498fb6186cce435173ab73e29932e7b8182078cd2876039addbdb7e3c9769d7d7923f7ed2a5422e6a2a36321b70

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html

    Filesize

    12KB

    MD5

    cdea5d1cccee27144519c75bcf3015bd

    SHA1

    c36862abb1ada006b3dd4c28adc8b393a92fd325

    SHA256

    1184f2316c36648a2d457b602c713d5d5eb980e86e5e8ed388e94a47f8573dbd

    SHA512

    5d0ea1cef2af7111098c19578c42bfdfd7bb00ec3259fe026df6dd867a24f9a94f3299b035235e3cb87b1c9010f0d1be434a08318dae0412e03ecfdb439edfe9

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html

    Filesize

    9KB

    MD5

    bc3e199345ad8ba54e2fe4acad95433d

    SHA1

    c93cb69c27e1c03069de3c952534a52f391e3fb9

    SHA256

    462c197c83ee3d677b07fe000b2c4e64ac4be4ceaaea80c1c77a5e67d832edd8

    SHA512

    c1941c9106ff0d665dfee1888afcdc3c54e4db8fdb11e3313cd92a147a1084264dba8f1f9cbac5216d3c5ce1f97ff7f8d7d7493826ec3538d5db57a933fe32e4

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html

    Filesize

    14KB

    MD5

    59e4add1732aef6b8e228ecfb880c299

    SHA1

    31a6380e878f89ec9d2c83716fe42faafdd828db

    SHA256

    089aaccbf4c17d2a0163f13820e926f8ce3122c9ed87e7e040a77439795b8fc4

    SHA512

    461240638f98f92a0df94a6a76470d7ed3a9bf45f845b545ff37355efd4fb3efdbe592e563b6624d2e42374a3bf7682a572c3bfd96c21be87fc96ec3b3bcfbaf

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html

    Filesize

    16KB

    MD5

    26986f79440b7a706b65724e509f009f

    SHA1

    9d8ff0beef1c19fbecd28e3f632101acf3d02599

    SHA256

    e59b7fa34b947d5ada478ff17543204251955052fdace284e5a285bd2abec5d1

    SHA512

    2c240c4f7b8912bd5049bef22c2507c7c1af15432c860549d0f1ea35f03183270eb7315607fdf35be86703a61ec0ed7801e9e6ea627a026dbf93d98ff11d2ed6

  • C:\Windows\config.json

    Filesize

    1KB

    MD5

    88c5c5706d2e237422eda18490dc6a59

    SHA1

    bb8d12375f6b995301e756de2ef4fa3a3f6efd39

    SHA256

    4756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e

    SHA512

    a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7

  • C:\Windows\svchost.exe

    Filesize

    833KB

    MD5

    4a87a4d6677558706db4afaeeeb58d20

    SHA1

    7738dc6a459f8415f0265d36c626b48202cd6764

    SHA256

    08b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7

    SHA512

    bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594

  • C:\vcredist2010_x86.log.html

    Filesize

    80KB

    MD5

    104a110d8cd0c0e6931ccff1565d0ecf

    SHA1

    a35c5d625daf195b7e0a86ee2643ee45c08c1316

    SHA256

    ab3c24c0e8e201fe0e9de81bee42fc72cf1f070a0e23a3a7922c8936d3faadbb

    SHA512

    7cc4b7471721bbdb9dd50f33022dde14945f86c88245d5022dd3d705364f945abae822a93b6ffb322f7f1cee40af8e2f8d3212b5035acd106a439a0dd7b6aeb7

  • memory/2068-0-0x0000000000400000-0x0000000000613000-memory.dmp

    Filesize

    2.1MB

  • memory/2316-383-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/2316-749-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/2316-339-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/2316-745-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/2316-746-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/2316-747-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/2316-748-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/2316-362-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/2316-750-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/2316-751-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/2316-752-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/2316-753-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/2316-754-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/2316-755-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.