Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
file.exe
-
Size
260KB
-
Sample
221029-j4z78sgge9
-
MD5
257eb857f8bb4557e98acdc30f209b66
-
SHA1
f6e57354bea528c4db7c1096e53f8c5c6b94273d
-
SHA256
ec9baf02d53da35618afb04be30f976c97fcca173712fa2acfefe979e598cb9a
-
SHA512
8d0615a278e9124f6a66ec2a2a75d3bed26fa61bfaece95d7bc9a14fb27adafd2825e26c3b9e558d158e986d795823b1e7784e047c6b3d48fca348dd2a9b5e0e
-
SSDEEP
6144:sSFBiHLLktQEkXoaB8oLYzW7tJHuDLeGW:tBygtQEktB8hq7/HuvjW
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
file.exe
-
Size
260KB
-
MD5
257eb857f8bb4557e98acdc30f209b66
-
SHA1
f6e57354bea528c4db7c1096e53f8c5c6b94273d
-
SHA256
ec9baf02d53da35618afb04be30f976c97fcca173712fa2acfefe979e598cb9a
-
SHA512
8d0615a278e9124f6a66ec2a2a75d3bed26fa61bfaece95d7bc9a14fb27adafd2825e26c3b9e558d158e986d795823b1e7784e047c6b3d48fca348dd2a9b5e0e
-
SSDEEP
6144:sSFBiHLLktQEkXoaB8oLYzW7tJHuDLeGW:tBygtQEktB8hq7/HuvjW
-
XMRig Miner payload
-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Deletes itself
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-