Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
ed605159c6fcf44feb70a19e01a512762b2d8a72a4b68c017d56858a24f6dfaf
-
Size
279KB
-
Sample
230110-r1gwgscc2t
-
MD5
297fc5bca0604242ccdff8bfaf72cf99
-
SHA1
71ca2ec750c3a9443efb737f7efdc77d9e5decb0
-
SHA256
ed605159c6fcf44feb70a19e01a512762b2d8a72a4b68c017d56858a24f6dfaf
-
SHA512
d19de3fcaf63db37bad141b34fa4d625568683bfffb1d7a5afcefba0ee939a8831a27d1c0308b63472a113893df4847c6175c7aecd24ddedf21476d121beec78
-
SSDEEP
3072:W7XE89ZzknLtQ44UEv6M5NCVSGNhUxfgWg+yU9fHIQ52eoG8MR2m4FwCpjKpEAHc:gZSLp4UEv6osSkaz9oGhnEmQLr
Static task
static1
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
ed605159c6fcf44feb70a19e01a512762b2d8a72a4b68c017d56858a24f6dfaf
-
Size
279KB
-
MD5
297fc5bca0604242ccdff8bfaf72cf99
-
SHA1
71ca2ec750c3a9443efb737f7efdc77d9e5decb0
-
SHA256
ed605159c6fcf44feb70a19e01a512762b2d8a72a4b68c017d56858a24f6dfaf
-
SHA512
d19de3fcaf63db37bad141b34fa4d625568683bfffb1d7a5afcefba0ee939a8831a27d1c0308b63472a113893df4847c6175c7aecd24ddedf21476d121beec78
-
SSDEEP
3072:W7XE89ZzknLtQ44UEv6M5NCVSGNhUxfgWg+yU9fHIQ52eoG8MR2m4FwCpjKpEAHc:gZSLp4UEv6osSkaz9oGhnEmQLr
-
XMRig Miner payload
-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-