Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938
-
Size
994KB
-
Sample
220131-ek6tfsfcg3
-
MD5
0cefce0dbbbedc5eb1febe4d85b23c71
-
SHA1
6aef7d5a462268c438c8417ee0da3f130b8aa84a
-
SHA256
aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938
-
SHA512
1311cf0b918419c192b3914a01e467430f445aaf6a003338e2176b1527c74263f658d8d39bd6d9c78b70324615101026767034798945d42d25215ee4d45654bf
Static task
static1
Behavioral task
behavioral1
Sample
aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe
Resource
win10-en-20211208
Malware Config
Extracted
C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-uqvplrh.txt
http://onja764ig6vah2jo.onion.cab
http://onja764ig6vah2jo.tor2web.org
http://onja764ig6vah2jo.onion/
Targets
-
-
Target
aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938
-
Size
994KB
-
MD5
0cefce0dbbbedc5eb1febe4d85b23c71
-
SHA1
6aef7d5a462268c438c8417ee0da3f130b8aa84a
-
SHA256
aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938
-
SHA512
1311cf0b918419c192b3914a01e467430f445aaf6a003338e2176b1527c74263f658d8d39bd6d9c78b70324615101026767034798945d42d25215ee4d45654bf
Score10/10-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Loads dropped DLL
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-