Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Trojan-Ransom.Win32.Blocker.cnbl-836bde23efaee37bf62d5f53602031440ce58c9a99988b89edc6f50b6b3b2471

  • Size

    346KB

  • Sample

    221106-tpy2qschdr

  • MD5

    1d763c73aae73235b4509e28870ac365

  • SHA1

    75536427f7c3be699ad0f44b3ad87546b2532da3

  • SHA256

    836bde23efaee37bf62d5f53602031440ce58c9a99988b89edc6f50b6b3b2471

  • SHA512

    d7e64643aea6a28a1f775818ca1e25303aab8a27173a3cf0a6ed572476b3b6bb351c6fd279b83260831933b223915f5c6de3f80354f87d6e014cfe17e63bf627

  • SSDEEP

    6144:8M3Ttl8q+AzLB9Ljr73Q0xOSluqJ9dJA6FQC6Gag3XsfR+qqnpwehl1jcjUm:nTtlJLfnj/gJsVFv6kqqlxjqUm

Score
8/10

Malware Config

Targets

    • Target

      Kobotv1/Project1.exe

    • Size

      892KB

    • MD5

      4f1b74dd94561adad98fd1d01d3377f5

    • SHA1

      a096b8572ad7d5594718930ea1602362a5ac8b19

    • SHA256

      001e3a5f374572aeb25eba1c8d63e598b632f656db6d206c77042e2bf1832180

    • SHA512

      f42ebe083613f8920e84601f126e109373bb01377e7102a2edfa5024e6db8f46c52198fc729a7890ffcc673742e3b0e7e59c8eb28dd1f2fd7beae3f2f62c29c1

    • SSDEEP

      24576:cOzOfWmQaxWRrWZOTx2SzT/lFnOREY9imH:c1mMOdbOREY91H

    Score
    8/10
    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks