Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992
-
Size
333KB
-
Sample
230204-2gdptseh74
-
MD5
3191feae778309eb99df4e4e25c62f1a
-
SHA1
d639821e3fbbb15e14b46aed5b98568e3ce045c3
-
SHA256
a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992
-
SHA512
c8d8734bb1d6e413d8b14e73952a4eb42fd5641ca49822db66f87ea7f0c1fb4c2a38232a652a11ca1c3c5564a517a2aaef8fb59fadff36a11afcce60e5d89798
-
SSDEEP
6144:P1S1JwNbEKcwwZTz2fYNR5OyxyM6qy9iJ4zv5fmRw9aC1oPtYdeAS9aqbGqeBD:9So4KcZbRwyxmf9iWhuw9aCqPtYMH9zs
Static task
static1
Behavioral task
behavioral1
Sample
a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\Users\Admin\Favorites\Links\How To Restore Your Files.txt
Extracted
C:\Users\Admin\AppData\Local\Temp\readme-warning.hta
https://tox.chat/
Extracted
C:\Users\Admin\Favorites\Links\How To Restore Your Files.txt
Targets
-
-
Target
a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992
-
Size
333KB
-
MD5
3191feae778309eb99df4e4e25c62f1a
-
SHA1
d639821e3fbbb15e14b46aed5b98568e3ce045c3
-
SHA256
a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992
-
SHA512
c8d8734bb1d6e413d8b14e73952a4eb42fd5641ca49822db66f87ea7f0c1fb4c2a38232a652a11ca1c3c5564a517a2aaef8fb59fadff36a11afcce60e5d89798
-
SSDEEP
6144:P1S1JwNbEKcwwZTz2fYNR5OyxyM6qy9iJ4zv5fmRw9aC1oPtYdeAS9aqbGqeBD:9So4KcZbRwyxmf9iWhuw9aCqPtYMH9zs
Score10/10-
Modifies RDP port number used by Windows
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Stops running service(s)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks registry for disk virtualization
Detecting virtualization disks is order done to detect sandboxing environments.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Sets desktop wallpaper using registry
-