Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
112s -
max time network
122s -
platform
windows7_x64 -
resource
win7 -
submitted
13/08/2020, 12:27
Static task
static1
Behavioral task
behavioral1
Sample
alt.bin.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
alt.bin.exe
Resource
win10v200722
0 signatures
0 seconds
General
-
Target
alt.bin.exe
-
Size
3.0MB
-
MD5
5235242923a537b58b7064082dad7432
-
SHA1
2a044e5e3dde62ded6a3f2a5a634067168a41810
-
SHA256
c2b9f3b84e3e990e2c225e05ea65e7a3aaaf5a688864d0ee68ed2eece557fac0
-
SHA512
6811036c65152f772b6f2e539b7bec657cb0cc7255f8b00271e5d51017e4734a2ebee18133c38411ee4eb0acb3803b030fa19e009d3cb7b95f721098488213bd
Score
10/10
Malware Config
Extracted
Path
C:\\NEF1LIM-DECRYPT.txt
Ransom Note
Two things have happened to your company.
==========================================================================================================================
Gigabytes of archived files that we deemed valuable or sensitive were downloaded from your network to a secure location.
When you contact us we will tell you how much data was downloaded and can provide extensive proof of the data extraction.
You can analyze the type of the data we download on our websites.
If you do not contact us we will start leaking the data periodically in parts.
==========================================================================================================================
We have also encrypted files on your computers with military grade algorithms.
If you don't have extensive backups the only way to retrieve your data is with our software.
Restoration of your data with our software requires a private key which only we possess.
==========================================================================================================================
To confirm that our decryption software works send 2 encrypted files from random computers to us via email.
You will receive further instructions after you send us the test files.
We will make sure you retrieve your data swiftly and securely and your data that we downloaded will be securely deleted when our demands are met.
If we do not come to an agreement your data will be leaked on this website.
Website: http://corpleaks.net
TOR link: http://hxt254aygrsziejn.onion
Contact us via email:
[email protected]
[email protected]
[email protected]
URLs
http://corpleaks.net
http://hxt254aygrsziejn.onion
Signatures
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\UninstallPush.raw => C:\Users\Admin\Pictures\UninstallPush.raw.NEF1LIM alt.bin.exe File renamed C:\Users\Admin\Pictures\UnregisterInitialize.png => C:\Users\Admin\Pictures\UnregisterInitialize.png.NEF1LIM alt.bin.exe File opened for modification C:\Users\Admin\Pictures\PingApprove.tiff alt.bin.exe File renamed C:\Users\Admin\Pictures\PingApprove.tiff => C:\Users\Admin\Pictures\PingApprove.tiff.NEF1LIM alt.bin.exe File renamed C:\Users\Admin\Pictures\StepRead.tif => C:\Users\Admin\Pictures\StepRead.tif.NEF1LIM alt.bin.exe