Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

f4f4712417...53.exe

windows7-x64

10

f4f4712417...53.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9024948206.zip

  • Size

    676KB

  • Sample

    230205-ycxqcsea3z

  • MD5

    1179f4e54c3c52b5f1e5ce78fa6a9dca

  • SHA1

    e7a8cab41a08218ff976d7f1f136d25a17b30abe

  • SHA256

    d56fcb26c8512e3758e93cd1479d5e0965919a03584bf949d18a822127c2e20d

  • SHA512

    fdf71f60093fc5a7f5f2a4756087992bbae254d04084dc098f10eaa23ae7c84a7ceabee5416862b1e9cb7af6839ddee9129ab0f391572b5daac2fcfe49f2454b

  • SSDEEP

    12288:CPUCiDh1bUEhE8v4FLjmvDLSaVSzovUXcohbxCKvuYYECq6e2wKei6ppS:CPUxDPrhEoc+vDWRZawuYJCZSS

Score
10/10
ransomware

Malware Config

Extracted

Path

C:\instructions_read_me.txt

Ransom Note
ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/ Login ID: e49f0f49-0bc7-4a3b-bc3d-f50072e3a006 *!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) *!* To restore all your PCs and get your network working again, follow these instructions: - Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency. Please follow these simple rules to avoid data corruption: - Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. Waiting you in a chat.
URLs

https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/

Targets

    • Target

      f4f471241714fbf24a103f8a7fce00fecdf795dbf6edbc6420e34834cb93eb53

    • Size

      859KB

    • MD5

      30927f9bc15d99900d377747494f5c60

    • SHA1

      b34c12bafd26ae92d8217eb16a5a846c5ced92e2

    • SHA256

      f4f471241714fbf24a103f8a7fce00fecdf795dbf6edbc6420e34834cb93eb53

    • SHA512

      e8e59cacb3c24e4f8876d618bb9510d8a6c6b5a98201f79d367a6874804849c7cee403519e776f004f4bd69ed7ba680de9253ff70a0f8d48ecc52a29a65fa5a1

    • SSDEEP

      12288:l0v5NBjYIR0yhfVf/Wc7OhgkYa5EpaHe7yCfxnR1P4GfcM53ICDQhlquDXXCM:l0rBjVOc7OUaGv7yazgqDCIElqK

    Score
    10/10
    ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks