Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
file.exe
-
Size
303KB
-
Sample
221219-v39wtsaf5y
-
MD5
9d7c55bebffc368b36387a730bca3591
-
SHA1
32499cd446ef5d6e89f9b4a6c03227132afd1fde
-
SHA256
6ade32487b2109f96484539acb27c74e03f7ec48f14075e6c7618547fa2c4773
-
SHA512
da862b30ffb028ae301fabdde4569fcca3b9551b4ba245c2f0e5a342efe4db4c1549cc45e48360fe8704f3bb8439c063854eb6b6e1d773c4f38d664836fc0527
-
SSDEEP
6144:CLlP8ArUNJD0QQtrWTvXz+3ng+E49HwchLP3i:CN8A6JD0QQtrW/wnVZH9P3
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
file.exe
-
Size
303KB
-
MD5
9d7c55bebffc368b36387a730bca3591
-
SHA1
32499cd446ef5d6e89f9b4a6c03227132afd1fde
-
SHA256
6ade32487b2109f96484539acb27c74e03f7ec48f14075e6c7618547fa2c4773
-
SHA512
da862b30ffb028ae301fabdde4569fcca3b9551b4ba245c2f0e5a342efe4db4c1549cc45e48360fe8704f3bb8439c063854eb6b6e1d773c4f38d664836fc0527
-
SSDEEP
6144:CLlP8ArUNJD0QQtrWTvXz+3ng+E49HwchLP3i:CN8A6JD0QQtrW/wnVZH9P3
-
XMRig Miner payload
-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-