Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
5.exe
-
Size
1.8MB
-
Sample
230829-m7g3lsfb3z
-
MD5
53c1fa0286a21f9269f7c0dd5d6ddcaf
-
SHA1
07eecfd07af0a7a6758d3141e57fbb252364c6b2
-
SHA256
1341bd6193ea223c05566aaca13fc1152732b67af8344519d6efaaf9ab6ed5f4
-
SHA512
e53416018753823b6eb6b4dffa45d7520c8deb116faafa398810d599c27e0316a8c047154fc79612a1ec4ddb96b21bbf4e48a246d09b72eaa83d02668f263831
-
SSDEEP
24576:9ucUS55cDR3NgJ4zJ1H+QI84rncvGt3nE6vlTlIxBkTde/cfkyg:9ucUS55cHgJIzez8+n9Bn3NTaBkYokyg
Static task
static1
Behavioral task
behavioral1
Sample
5.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
5.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
F:\How To Restore Your Files.txt
http://knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion/1326c67a-5082-4d81-b695-33a0864b1942/
https://www.binance.com/en/how-to-buy/bitcoin
Targets
-
-
Target
5.exe
-
Size
1.8MB
-
MD5
53c1fa0286a21f9269f7c0dd5d6ddcaf
-
SHA1
07eecfd07af0a7a6758d3141e57fbb252364c6b2
-
SHA256
1341bd6193ea223c05566aaca13fc1152732b67af8344519d6efaaf9ab6ed5f4
-
SHA512
e53416018753823b6eb6b4dffa45d7520c8deb116faafa398810d599c27e0316a8c047154fc79612a1ec4ddb96b21bbf4e48a246d09b72eaa83d02668f263831
-
SSDEEP
24576:9ucUS55cDR3NgJ4zJ1H+QI84rncvGt3nE6vlTlIxBkTde/cfkyg:9ucUS55cHgJIzez8+n9Bn3NTaBkYokyg
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Renames multiple (167) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
-