Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
file.exe
-
Size
214KB
-
Sample
221217-cjemgaga59
-
MD5
3d0bc7f66285e2f25ebad65acaef20c9
-
SHA1
25e5fb81ea1477e48a139faf7df4aecf31c0a6e5
-
SHA256
ff1135e415ff51c850194f1191636b46e0a39f670a2290b17dde81f2e0e2117f
-
SHA512
f498d0cd13ce0ed952ca636b1043df72bfb08d372398e7fd1e191b53968f58c3638fb3464b24b161cc571579e9955fdb99c1040bf7ac6c22d00247dbb5bad134
-
SSDEEP
3072:RsXp5UL+HJHPaTRBx3ZzXgLsNJhNSoDEgPYV89uN4LszAInu40zwUzQRKF+:GYL+HJMFXgQzfZpYV89uN4gzo40M2b
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
file.exe
-
Size
214KB
-
MD5
3d0bc7f66285e2f25ebad65acaef20c9
-
SHA1
25e5fb81ea1477e48a139faf7df4aecf31c0a6e5
-
SHA256
ff1135e415ff51c850194f1191636b46e0a39f670a2290b17dde81f2e0e2117f
-
SHA512
f498d0cd13ce0ed952ca636b1043df72bfb08d372398e7fd1e191b53968f58c3638fb3464b24b161cc571579e9955fdb99c1040bf7ac6c22d00247dbb5bad134
-
SSDEEP
3072:RsXp5UL+HJHPaTRBx3ZzXgLsNJhNSoDEgPYV89uN4LszAInu40zwUzQRKF+:GYL+HJMFXgQzfZpYV89uN4gzo40M2b
-
XMRig Miner payload
-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-