Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
f35eb025bd3e1a620c5339545fa3f66b971f98994d29a5fd28232e0f9559c4bd
-
Size
479KB
-
Sample
221030-ckenvshbcm
-
MD5
84990874119ffc27dc7e782cfd2aef20
-
SHA1
fcf4325d2b7e4d971d746644c21210578c3eb85b
-
SHA256
f35eb025bd3e1a620c5339545fa3f66b971f98994d29a5fd28232e0f9559c4bd
-
SHA512
9a3ae4f863569990f840715ffdfc041cc70c452dd1c09d7e1364bd100d298bd4242ef00241496b12574a8553a3a919ec7823a1984acd2a205fd60d30e5251506
-
SSDEEP
12288:IcqrueThJyjLR9EJ0KXEVbI3VjI7Gs81ArKlO:VcPLyjLR9EJVXqaRI7GcZ
Static task
static1
Behavioral task
behavioral1
Sample
f35eb025bd3e1a620c5339545fa3f66b971f98994d29a5fd28232e0f9559c4bd.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f35eb025bd3e1a620c5339545fa3f66b971f98994d29a5fd28232e0f9559c4bd.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
f35eb025bd3e1a620c5339545fa3f66b971f98994d29a5fd28232e0f9559c4bd
-
Size
479KB
-
MD5
84990874119ffc27dc7e782cfd2aef20
-
SHA1
fcf4325d2b7e4d971d746644c21210578c3eb85b
-
SHA256
f35eb025bd3e1a620c5339545fa3f66b971f98994d29a5fd28232e0f9559c4bd
-
SHA512
9a3ae4f863569990f840715ffdfc041cc70c452dd1c09d7e1364bd100d298bd4242ef00241496b12574a8553a3a919ec7823a1984acd2a205fd60d30e5251506
-
SSDEEP
12288:IcqrueThJyjLR9EJ0KXEVbI3VjI7Gs81ArKlO:VcPLyjLR9EJVXqaRI7GcZ
Score10/10-
Modifies visibility of file extensions in Explorer
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-