Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

40331d6e3d...79.exe

windows7-x64

10

40331d6e3d...79.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe

  • Size

    3.1MB

  • Sample

    240612-bp7d1axekc

  • MD5

    2f03ead3988fc2b5e16470ed0a96557d

  • SHA1

    4d0dcb7ebb340af8887fdec5f665eb091db9caf6

  • SHA256

    40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779

  • SHA512

    799830b418d6bf37a4d7bcd9649ee6d2f0551101029fecb5e44e8115fd7e29daabd8e662e316565bd6e1e36aaf9c26a82c49c7bd65e7eb28a73e9c3930c90ca6

  • SSDEEP

    49152:ByTeFwtj0HLirwzPPk/iZuKsZxof6SD3nlOyT3Pwsu8/Cf6PyBXEjk1:ByVEer3/iQZxofZXlOaN/Cf66NEa

Score
10/10
xmrigexecutionminerpersistencevmprotect

Malware Config

Targets

    • Target

      40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe

    • Size

      3.1MB

    • MD5

      2f03ead3988fc2b5e16470ed0a96557d

    • SHA1

      4d0dcb7ebb340af8887fdec5f665eb091db9caf6

    • SHA256

      40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779

    • SHA512

      799830b418d6bf37a4d7bcd9649ee6d2f0551101029fecb5e44e8115fd7e29daabd8e662e316565bd6e1e36aaf9c26a82c49c7bd65e7eb28a73e9c3930c90ca6

    • SSDEEP

      49152:ByTeFwtj0HLirwzPPk/iZuKsZxof6SD3nlOyT3Pwsu8/Cf6PyBXEjk1:ByVEer3/iQZxofZXlOaN/Cf66NEa

    Score
    10/10
    xmrigexecutionminerpersistencevmprotect

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Detects executables packed with VMProtect.

    • Creates new service(s)

      persistenceexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks