Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
1.bin
-
Size
1.8MB
-
Sample
230829-q5j1zacg84
-
MD5
212e77d39264b02290a97c25d692f746
-
SHA1
6adf30be27fe42380ff57caa8bb1c2b955586941
-
SHA256
eedda61d02d8bd0e145a07e6048621fc84f420376e6cda2616c2d77d4fd4fe18
-
SHA512
26207731be09241bedc6804f4620c6f132e92c9b4246e12cb9ae3d89ba912b9394a1d6644141154b1b2eb931d365a6aeb1cad37220a60ed4c953e32bffe4a11f
-
SSDEEP
24576:ZucUS55cDR3NgJ4zJ1H+QI84rncvGt3nE6vlTlFxBkTde/cfkOg:ZucUS55cHgJIzez8+n9Bn3NTlBkYokOg
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
C:\Users\How To Restore Your Files.txt
http://knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion/c8c30be6-dbd5-44d5-b431-ba5aaa7e5e8b/
https://www.binance.com/en/how-to-buy/bitcoin
Targets
-
-
Target
1.bin
-
Size
1.8MB
-
MD5
212e77d39264b02290a97c25d692f746
-
SHA1
6adf30be27fe42380ff57caa8bb1c2b955586941
-
SHA256
eedda61d02d8bd0e145a07e6048621fc84f420376e6cda2616c2d77d4fd4fe18
-
SHA512
26207731be09241bedc6804f4620c6f132e92c9b4246e12cb9ae3d89ba912b9394a1d6644141154b1b2eb931d365a6aeb1cad37220a60ed4c953e32bffe4a11f
-
SSDEEP
24576:ZucUS55cDR3NgJ4zJ1H+QI84rncvGt3nE6vlTlFxBkTde/cfkOg:ZucUS55cHgJIzez8+n9Bn3NTlBkYokOg
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Renames multiple (159) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
-