Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
26s -
max time network
22s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/01/2025, 20:38
General
-
Target
rig.exe
-
Size
2.4MB
-
MD5
570a9cc9fd20159e92707abe69676299
-
SHA1
864cb610c0c80cf8ff00fd4aaae9b05fa63fd990
-
SHA256
ba52bd426e17cf8902ae05eb8caea7e0510d668db97dedd2cabcd1dc5a06063f
-
SHA512
ba11d2e1888f736d1934e78db6397ae04ea49422beb7392575422ea51cd459ac9b0c8a274397ab828792728364d145c16fc2390242a17a56a8ad02fa4c580f92
-
SSDEEP
49152:BfOqHErn3OFIJDOmxFVIdtKfBDhqGDZdB4hYk/0AK0uOkJA79OB8OITieIr:fcne+9Omb+dtKfBD3rZOkJA79OBkbI
Malware Config
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Privateloader family
-
Xmrig family
-
XMRig Miner payload 4 IoCs
resource yara_rule behavioral1/memory/1776-9-0x0000000000B50000-0x000000000109D000-memory.dmp xmrig behavioral1/memory/1776-5-0x0000000000B50000-0x000000000109D000-memory.dmp xmrig behavioral1/memory/1776-13-0x0000000000B50000-0x000000000109D000-memory.dmp xmrig behavioral1/memory/1776-18-0x0000000000B50000-0x000000000109D000-memory.dmp xmrig -
resource yara_rule behavioral1/memory/1776-9-0x0000000000B50000-0x000000000109D000-memory.dmp vmprotect behavioral1/memory/1776-5-0x0000000000B50000-0x000000000109D000-memory.dmp vmprotect behavioral1/memory/1776-13-0x0000000000B50000-0x000000000109D000-memory.dmp vmprotect behavioral1/memory/1776-18-0x0000000000B50000-0x000000000109D000-memory.dmp vmprotect -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rig.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 1776 rig.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 1776 rig.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3020 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3020 taskmgr.exe Token: SeLockMemoryPrivilege 1776 rig.exe Token: SeLockMemoryPrivilege 1776 rig.exe -
Suspicious use of FindShellTrayWindow 47 IoCs
pid Process 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe -
Suspicious use of SendNotifyMessage 47 IoCs
pid Process 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe 3020 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\rig.exe"C:\Users\Admin\AppData\Local\Temp\rig.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3020