Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
6.bin
-
Size
1.3MB
-
Sample
230829-q5415scg87
-
MD5
e489be3297effb32e5b015ffd20a3f3d
-
SHA1
ee26bd8b2903582bc7bc34962bf28c7ad0f2d7bd
-
SHA256
66871cebfa92f04476679fb3b00a125f7eb43ea35cfb8b187b4aa2bbd0230c10
-
SHA512
22f397bf1ac6b9d9fcecb47166ba45c4a1d4b982e0cf47184afcf179f6ece3e14bae75cb17796f1606abcfc2703185b396ad00ac86401b22a416bc0578eb4072
-
SSDEEP
12288:cBVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoPkouMA+nkGGCp+1E:1TcCG0447AMVgfdnTClVm4QkcGRbS
Static task
static1
Behavioral task
behavioral1
Sample
6.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
6.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
C:\Users\How To Restore Your Files.txt
http://knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion/7e349743-4658-4d67-950d-24e2e0a99049/
https://www.binance.com/en/how-to-buy/bitcoin
Targets
-
-
Target
6.bin
-
Size
1.3MB
-
MD5
e489be3297effb32e5b015ffd20a3f3d
-
SHA1
ee26bd8b2903582bc7bc34962bf28c7ad0f2d7bd
-
SHA256
66871cebfa92f04476679fb3b00a125f7eb43ea35cfb8b187b4aa2bbd0230c10
-
SHA512
22f397bf1ac6b9d9fcecb47166ba45c4a1d4b982e0cf47184afcf179f6ece3e14bae75cb17796f1606abcfc2703185b396ad00ac86401b22a416bc0578eb4072
-
SSDEEP
12288:cBVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoPkouMA+nkGGCp+1E:1TcCG0447AMVgfdnTClVm4QkcGRbS
Score10/10-
Renames multiple (140) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
-