Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    sample

  • Size

    13KB

  • Sample

    240516-vczyyaed43

  • MD5

    89f3aebc8900986a2cc6e35670fd6cb8

  • SHA1

    8f6aabe3bf3c6ab0ed3d00d4593fef2d8957fade

  • SHA256

    bb3ae8fe06418dff8b04a63e0be6874d6e5216857ac055f155bb9b2969f0c521

  • SHA512

    e92b855798620492a42f157f27972b519fec88a841ca0a294a7ff1cf81e1f937698244e8e996c4c3b356f4055efc62a8abcd874209733cd4d3807bc17077bb33

  • SSDEEP

    192:ftOEds4/H4g3zJ45RsM3VbOeLMxym2ogtxyTQ/yz+qSI/1qRUltyPVVgh3S:1JJ/H4g3MbOeQxZ2htCUqpAPVVghC

Malware Config

Targets

    • Target

      sample

    • Size

      13KB

    • MD5

      89f3aebc8900986a2cc6e35670fd6cb8

    • SHA1

      8f6aabe3bf3c6ab0ed3d00d4593fef2d8957fade

    • SHA256

      bb3ae8fe06418dff8b04a63e0be6874d6e5216857ac055f155bb9b2969f0c521

    • SHA512

      e92b855798620492a42f157f27972b519fec88a841ca0a294a7ff1cf81e1f937698244e8e996c4c3b356f4055efc62a8abcd874209733cd4d3807bc17077bb33

    • SSDEEP

      192:ftOEds4/H4g3zJ45RsM3VbOeLMxym2ogtxyTQ/yz+qSI/1qRUltyPVVgh3S:1JJ/H4g3MbOeQxZ2htCUqpAPVVghC

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • XMRig Miner payload

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks