Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

URLScan

urlscan

http://we.tl/t-njAnK...

windows10-2004-x64

9

Resubmissions

29/10/2022, 11:00

221029-m3y6bsdbc7 8

29/10/2022, 10:57

221029-m2eejadag4 1

29/10/2022, 10:23

221029-me9bdschhl 9

29/10/2022, 08:32

221029-kfcmpsaagk 9

29/10/2022, 08:07

221029-jz1yzagfa9 9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    http://we.tl/t-njAnKAfxKd

  • Sample

    221029-kfcmpsaagk

Score
9/10
evasionpersistenceransomware

Malware Config

Targets

    • Target

      http://we.tl/t-njAnKAfxKd

    Score
    9/10
    evasionpersistenceransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Disables Task Manager via registry modification

      evasion

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks