Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    f448fd9c3f26ffe93f2499965ae1c190N.exe

  • Size

    1.9MB

  • Sample

    240720-was82swfjl

  • MD5

    f448fd9c3f26ffe93f2499965ae1c190

  • SHA1

    e4c042644e6c512a5218ccf6950f20cf13f33978

  • SHA256

    1dae4a8cf52853f29d612682ebcc2b4b7ff5b0eeefe9cd89ad0c739f34cf5079

  • SHA512

    6efcc5198519532900500483b7254f227986019a10344f8b52b14a8566622a1c548b722cff4b186eaa2e567ea7294d47652f0357f88acfdc6198eb9043ef8ffd

  • SSDEEP

    24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjFkTVnfuDPFFWqreoYtgWqabE1yuyzyd+:Lz071uv4BPMkHC0IEFTo/abRuOWFvs1

Malware Config

Targets

    • Target

      f448fd9c3f26ffe93f2499965ae1c190N.exe

    • Size

      1.9MB

    • MD5

      f448fd9c3f26ffe93f2499965ae1c190

    • SHA1

      e4c042644e6c512a5218ccf6950f20cf13f33978

    • SHA256

      1dae4a8cf52853f29d612682ebcc2b4b7ff5b0eeefe9cd89ad0c739f34cf5079

    • SHA512

      6efcc5198519532900500483b7254f227986019a10344f8b52b14a8566622a1c548b722cff4b186eaa2e567ea7294d47652f0357f88acfdc6198eb9043ef8ffd

    • SSDEEP

      24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjFkTVnfuDPFFWqreoYtgWqabE1yuyzyd+:Lz071uv4BPMkHC0IEFTo/abRuOWFvs1

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks