Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

OOF.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    OOF.exe

  • Size

    2.1MB

  • Sample

    230328-z6ebjsfb3x

  • MD5

    82a3c33f8a909a5e0169f90fa403913f

  • SHA1

    4cb3f7c9da99f279f4e878adaf902c149e5c933a

  • SHA256

    74115cbdd9870b20cde1c5c21d2d9c2274ca113f5bd91d74adca1a23ab659e44

  • SHA512

    8ea7e1c669c4f4804e8789b7545ad5108cf8b284894f41f62956e7b68fdb6b8effcfebac5df93d4b72f3fc836373db105f78299db8df58b94bbb470324f4690e

  • SSDEEP

    49152:1sWnPtu32xbNVTeST7XAYRSHmrwwj9pmv2X875vpLekTyq:1si43qhVaI20j9pmj7VBeY

Score
10/10
xmrigevasionminerupx

Malware Config

Targets

    • Target

      OOF.exe

    • Size

      2.1MB

    • MD5

      82a3c33f8a909a5e0169f90fa403913f

    • SHA1

      4cb3f7c9da99f279f4e878adaf902c149e5c933a

    • SHA256

      74115cbdd9870b20cde1c5c21d2d9c2274ca113f5bd91d74adca1a23ab659e44

    • SHA512

      8ea7e1c669c4f4804e8789b7545ad5108cf8b284894f41f62956e7b68fdb6b8effcfebac5df93d4b72f3fc836373db105f78299db8df58b94bbb470324f4690e

    • SSDEEP

      49152:1sWnPtu32xbNVTeST7XAYRSHmrwwj9pmv2X875vpLekTyq:1si43qhVaI20j9pmj7VBeY

    Score
    10/10
    xmrigevasionminerupx

    • Modifies security service

      evasion

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Drops file in Drivers directory

    • Stops running service(s)

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks