Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    4ad9579a6663855a06485ba17b3a9060N.exe

  • Size

    2.9MB

  • Sample

    240803-etgkxsxflb

  • MD5

    4ad9579a6663855a06485ba17b3a9060

  • SHA1

    653ff2feacc5ab3ee13848967f50b3abc6ea0033

  • SHA256

    06ab053d74652a793af8d2f5eddf3b8203bd0474a3e9d8577d3a0d72383b6831

  • SHA512

    820ed597c9eadf56355350fd766a407fca95f44ef93e74d5e9913c8dd75558ed9ec3c7cdf3c904ba023b218cf4b8a77df9a57c262172d26cbee44fd566a46855

  • SSDEEP

    49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5V+J1K7zt:NAB9

Malware Config

Targets

    • Target

      4ad9579a6663855a06485ba17b3a9060N.exe

    • Size

      2.9MB

    • MD5

      4ad9579a6663855a06485ba17b3a9060

    • SHA1

      653ff2feacc5ab3ee13848967f50b3abc6ea0033

    • SHA256

      06ab053d74652a793af8d2f5eddf3b8203bd0474a3e9d8577d3a0d72383b6831

    • SHA512

      820ed597c9eadf56355350fd766a407fca95f44ef93e74d5e9913c8dd75558ed9ec3c7cdf3c904ba023b218cf4b8a77df9a57c262172d26cbee44fd566a46855

    • SSDEEP

      49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5V+J1K7zt:NAB9

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks