Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    cafb97fb68eb8af52d37d55c38d9a6b222339a7f786c20aab22b41ad51f7c97d

  • Size

    54KB

  • Sample

    220211-haeh1abgg9

  • MD5

    f7c69ac5f5b2f6552f19acb6e712b373

  • SHA1

    8ba9ab739128c7f6630f3f65fb12ca121d72afc8

  • SHA256

    cafb97fb68eb8af52d37d55c38d9a6b222339a7f786c20aab22b41ad51f7c97d

  • SHA512

    fb044c247c8804f469ebbecc1a8f9cc58c78fe0fb6c2d97632dd552bb156cf007342351318f7c02446da442c5b009b2c49730e1743fcbe3b65965581526debed

Malware Config

Extracted

Path

C:\how_to_back_files.html

Ransom Note
<!DOCTYPE html> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #ff0000; } .tabs1 .identi { text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; /*height: 30px;*/ background: red; } .tabs .tab{ /*float: left;*/ display: inline-block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 15px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #F5F5F5; background: #ff0000; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 100%; left: 0; background: #303030; color: #F5F5F5; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; outline: 1px solid red; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> </head> <body> <div class="tabs"> <div id="tab-content1" class="content"> <h1>Your files are encrypted! </h1> <div class="text"> <center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.<br> Without a secret key stored with us, the restoration of your files is impossible</center> <br> <center>----------------------------------------------------------</center> You will be able to restore files so: <ul><li>To contact us by e-mail: <strong> [email protected] </strong> & send your personal ID and 3 crypted files, up to 3 MB in size everyone.</li> <li>We will decipher them, as proof that we can do this. Also you receive the instruction where and how many it is necessary to pay.</li> <li>You pay and confirm payment.</li> <li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li></ul> <center>---------------------------------------------------------</center> <div class="identi"> <strong>Your personal ID:</strong> <pre>������������23 66 7A B6 B3 C2 AA FB 67 2C 97 91 D4 EE AC C3 4D 8C 6F 28 13 81 FD D2 42 B2 9F 1F 45 91 7D 7B 3F FB 8A 95 1F BF 06 0D E5 CB BA F8 45 75 28 1C BD 12 8F 61 D1 8E 40 08 57 DE 25 88 B0 AF 70 6B 4C 67 C8 63 95 6D 88 6B 40 F1 9E 83 53 F0 FB E4 45 B4 9C 2A E8 5C 0A 26 3F CA 6B E1 F2 D6 3D F5 BC D7 7D 12 BC BC 1E B0 76 8E D7 3B D0 DD 87 E6 58 27 A2 51 D5 41 5F 7F 6E 61 2D 52 93 FD 49 94 AD 37 E7 2C 26 88 B5 CD B9 25 06 AD 93 47 53 D2 FB 5A EC 2E 8B F3 37 74 E4 EE 0F B5 FA 68 3C 6E 84 B7 52 CB 30 0E E3 52 97 16 69 BE F3 DB 2A F4 0A 81 89 75 08 47 94 61 0A 7B 56 69 01 DF EC B0 52 30 06 44 BE 98 1A 14 BB 26 AB 64 6A B5 F5 6C 4D 00 17 E1 61 8A 2F 65 4B B2 19 3C 2D 50 0B B5 B3 31 C4 03 8F 5E 3A 7F 8C 7B 63 6B DB 87 7C A9 0B 24 DC C1 EC 25 7B FD 3E DF 0D 96 BF 9E 38 2D </pre> </div> <center>----------------------------- P.S. ----------------------------------</center> <ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li> <li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong> [email protected] </strong></li></ul> </div> </div> </div> </body> </html>�����

Extracted

Path

C:\how_to_back_files.html

Ransom Note
<!DOCTYPE html> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #ff0000; } .tabs1 .identi { text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; /*height: 30px;*/ background: red; } .tabs .tab{ /*float: left;*/ display: inline-block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 15px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #F5F5F5; background: #ff0000; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 100%; left: 0; background: #303030; color: #F5F5F5; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; outline: 1px solid red; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> </head> <body> <div class="tabs"> <div id="tab-content1" class="content"> <h1>Your files are encrypted! </h1> <div class="text"> <center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.<br> Without a secret key stored with us, the restoration of your files is impossible</center> <br> <center>----------------------------------------------------------</center> You will be able to restore files so: <ul><li>To contact us by e-mail: <strong> [email protected] </strong> & send your personal ID and 3 crypted files, up to 3 MB in size everyone.</li> <li>We will decipher them, as proof that we can do this. Also you receive the instruction where and how many it is necessary to pay.</li> <li>You pay and confirm payment.</li> <li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li></ul> <center>---------------------------------------------------------</center> <div class="identi"> <strong>Your personal ID:</strong> <pre>������������2D DA A6 4D 0C 33 C5 33 5B F9 C9 A8 42 01 67 CA 14 99 A0 C4 F7 F3 74 5A 1E 18 F0 AC 7A 9F F3 EC 5D C1 A8 3E 94 C9 68 0C 90 4B 16 01 A4 F1 CF BD 4E E9 28 54 6D C6 38 92 59 43 43 D2 9D 50 D6 41 1F B9 05 29 E7 D8 1F AD B7 CC 31 46 15 83 C8 B3 2A 77 2E 59 06 3F CB 4B 55 35 4B F5 CD B7 1E 6B 75 07 09 24 F8 EE DF 6C C6 C0 58 0A 1E BA 64 ED 8E 85 18 F4 A7 30 38 DF 7B 91 5E 85 DB 4C FB EC 7E CA 92 91 A5 9F 23 41 C0 BF D4 FF B3 01 B8 CB 99 CD 95 8B E3 F8 BD 5A 1D 88 BA D3 C4 46 0E F8 16 F7 77 7B 4E 1F E1 74 D8 4B 88 4D 3A 93 86 94 8F F6 D9 01 82 48 72 EA FD 1F EF 9A BF 1F 6A DE 2B 7E B4 A3 1F F4 F3 C0 21 43 F8 33 B6 D1 23 E7 1A 93 86 88 DB 13 B8 15 42 39 3B 9D 0D A0 52 A0 A8 18 F3 D3 8F F6 59 52 FC A6 28 64 A7 4B 25 FE 23 6C 21 A5 65 33 98 4B 04 ED B7 2F E5 15 D4 65 </pre> </div> <center>----------------------------- P.S. ----------------------------------</center> <ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li> <li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong> [email protected] </strong></li></ul> </div> </div> </div> </body> </html>�����

Targets

    • Target

      cafb97fb68eb8af52d37d55c38d9a6b222339a7f786c20aab22b41ad51f7c97d

    • Size

      54KB

    • MD5

      f7c69ac5f5b2f6552f19acb6e712b373

    • SHA1

      8ba9ab739128c7f6630f3f65fb12ca121d72afc8

    • SHA256

      cafb97fb68eb8af52d37d55c38d9a6b222339a7f786c20aab22b41ad51f7c97d

    • SHA512

      fb044c247c8804f469ebbecc1a8f9cc58c78fe0fb6c2d97632dd552bb156cf007342351318f7c02446da442c5b009b2c49730e1743fcbe3b65965581526debed

MITRE ATT&CK Enterprise v6

Tasks