Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
file.exe
-
Size
295KB
-
Sample
230807-e4tcgade66
-
MD5
d23526d5cd20f9798f82ef630510838c
-
SHA1
531bac0c65fd2209651295dab9e71085f3e2950d
-
SHA256
81841275b53476b892ba3da736e05c01392b7f79f6fbb679fbb344f1433cc11e
-
SHA512
d49de33f3b81280d5bf0bc429e9508438de71dec43deb995956d684131df724017c152e2e27b8983dc5c6c7a6d440f1bc86bc80c1c0e9d2aa22ab79019b2e0b5
-
SSDEEP
3072:NoN2WdiJsjnhu+snkoBgaUCeboSuZXuPPdhVCe2TJXweU5VeNzGZ:qNWUnhuntvUISeEPNAJXweQVe4
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230712-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
file.exe
-
Size
295KB
-
MD5
d23526d5cd20f9798f82ef630510838c
-
SHA1
531bac0c65fd2209651295dab9e71085f3e2950d
-
SHA256
81841275b53476b892ba3da736e05c01392b7f79f6fbb679fbb344f1433cc11e
-
SHA512
d49de33f3b81280d5bf0bc429e9508438de71dec43deb995956d684131df724017c152e2e27b8983dc5c6c7a6d440f1bc86bc80c1c0e9d2aa22ab79019b2e0b5
-
SSDEEP
3072:NoN2WdiJsjnhu+snkoBgaUCeboSuZXuPPdhVCe2TJXweU5VeNzGZ:qNWUnhuntvUISeEPNAJXweQVe4
-
XMRig Miner payload
-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2