Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    42a10d8edddb7960807080da2cb9f8700e1ff90c7e8068962065222203313b5eN

  • Size

    9.4MB

  • Sample

    241015-prswaavalh

  • MD5

    9ad34c88530eee979ed4f7ecdac785e0

  • SHA1

    0584974d7924e02d2700fc5caf3f5a97f084135b

  • SHA256

    42a10d8edddb7960807080da2cb9f8700e1ff90c7e8068962065222203313b5e

  • SHA512

    3e9b6e46d215c89a8e352f5fa3d95aa582b979995fedfb161865864bd894358b16b0a27958373a7240a677a27f530eeba4bf626e3f4106b5dc1204aed0ee7432

  • SSDEEP

    196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1

Malware Config

Targets

    • Target

      42a10d8edddb7960807080da2cb9f8700e1ff90c7e8068962065222203313b5eN

    • Size

      9.4MB

    • MD5

      9ad34c88530eee979ed4f7ecdac785e0

    • SHA1

      0584974d7924e02d2700fc5caf3f5a97f084135b

    • SHA256

      42a10d8edddb7960807080da2cb9f8700e1ff90c7e8068962065222203313b5e

    • SHA512

      3e9b6e46d215c89a8e352f5fa3d95aa582b979995fedfb161865864bd894358b16b0a27958373a7240a677a27f530eeba4bf626e3f4106b5dc1204aed0ee7432

    • SSDEEP

      196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1

    • Disables service(s)

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • OS Credential Dumping: LSASS Memory

      Malicious access to Credentials History.

    • XMRig Miner payload

    • mimikatz is an open source tool to dump credentials on Windows

    • Contacts a large (1035) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Drops file in Drivers directory

    • Event Triggered Execution: Image File Execution Options Injection

    • Modifies Windows Firewall

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Network Share Discovery

      Attempt to gather information on host network.

    • Creates a Windows Service

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.