Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN
-
Size
5.5MB
-
Sample
241018-lg4cgssblk
-
MD5
e5629c2b0355884c7a022372c1a5e160
-
SHA1
ba6c548fe73f1803797a8a93b6033ca4ba4af1eb
-
SHA256
3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775c
-
SHA512
523f09776fa764bb1b9e1b6465aaa3e44a9be0dafc662db197b9578451c6620a28a7f9e286652fcf0514ff6b4eb8b5c2ebba263afe764e085db4b911bc1e5281
-
SSDEEP
98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hn:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgj
Static task
static1
Behavioral task
behavioral1
Sample
3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe
Resource
win7-20241010-en
Malware Config
Targets
-
-
Target
3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN
-
Size
5.5MB
-
MD5
e5629c2b0355884c7a022372c1a5e160
-
SHA1
ba6c548fe73f1803797a8a93b6033ca4ba4af1eb
-
SHA256
3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775c
-
SHA512
523f09776fa764bb1b9e1b6465aaa3e44a9be0dafc662db197b9578451c6620a28a7f9e286652fcf0514ff6b4eb8b5c2ebba263afe764e085db4b911bc1e5281
-
SSDEEP
98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hn:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgj
-
XMRig Miner payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Creates new service(s)
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-