Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2024-10-09_8f03ecf8e865a6a210bdc78edc29ce3f_hijackloader_icedid_xmrig
-
Size
9.4MB
-
Sample
241009-rmnrwawgqr
-
MD5
8f03ecf8e865a6a210bdc78edc29ce3f
-
SHA1
276665cf12bc1cc0274072bd48f246f0a926ecf7
-
SHA256
c549910054755cf5631a0dbe6f7d4265607115020074bed1b451807e8e2f5660
-
SHA512
3fb40e686b1c22e3dcfc0fc2c9615704dd51575bbf9ced0ecc40ce39c0e17d5c1e3feff7b1af94c00d5742386820a2cea49cc4fa5ae3a79dcbcdfba9c1540f98
-
SSDEEP
196608:da9+6Y7SOEibgR/DiFVNi+rKmd0TcIUDX6:dFgR7ijNi+GqB9q
Behavioral task
behavioral1
Sample
2024-10-09_8f03ecf8e865a6a210bdc78edc29ce3f_hijackloader_icedid_xmrig.exe
Resource
win7-20240903-en
Malware Config
Targets
-
-
Target
2024-10-09_8f03ecf8e865a6a210bdc78edc29ce3f_hijackloader_icedid_xmrig
-
Size
9.4MB
-
MD5
8f03ecf8e865a6a210bdc78edc29ce3f
-
SHA1
276665cf12bc1cc0274072bd48f246f0a926ecf7
-
SHA256
c549910054755cf5631a0dbe6f7d4265607115020074bed1b451807e8e2f5660
-
SHA512
3fb40e686b1c22e3dcfc0fc2c9615704dd51575bbf9ced0ecc40ce39c0e17d5c1e3feff7b1af94c00d5742386820a2cea49cc4fa5ae3a79dcbcdfba9c1540f98
-
SSDEEP
196608:da9+6Y7SOEibgR/DiFVNi+rKmd0TcIUDX6:dFgR7ijNi+GqB9q
-
Detect Blackmoon payload
-
XMRig Miner payload
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1