Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.bin.sample.gz
-
Size
67KB
-
Sample
210801-3t2zqh4qqs
-
MD5
694ba66724f56f66dd19528045f77d7f
-
SHA1
bd5bd55dad57f66ec1fb4244f61d99ff9c7b010b
-
SHA256
b6a1f83228c732f3e4e2fa003a468a571635350a74434025f94b579e4c914095
-
SHA512
46de29188ca6b702a00293d1e670758f548aeb5d52219ec10a624290bbe112fb83c9579f428c602530cac9d3a78c10f37dcaea5fecb02613d4c6fd0e108d708e
Static task
static1
Behavioral task
behavioral1
Sample
sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
sample.exe
Resource
win10v20210410
Malware Config
Extracted
C:\1rWCqamCt.README.txt
http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/7NT6LXKC1XQHW5039BLOV
Targets
-
-
Target
sample
-
Size
67KB
-
MD5
598c53bfef81e489375f09792e487f1a
-
SHA1
80a29bd2c349a8588edf42653ed739054f9a10f5
-
SHA256
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6
-
SHA512
6a82ad5009588d2fa343bef8d9d2a02e2e76eec14979487a929a96a6b6965e82265a69ef8dd29a01927e9713468de3aedd7b5ee5e79839a1a50649855a160c35
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-