Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
25a906877af7aed44c21b4c947a34666c3480629a929a227b67b273245ee3708.zip
-
Size
140KB
-
Sample
230926-f35jsaeh2y
-
MD5
c5ada7c215261b7333b58d24b657e990
-
SHA1
dcfe6fe33714418f65ba1a68eca7f71cac7a3070
-
SHA256
22457bbeee5f0c20c4272b72c1d0d34991753d6d84802ba56cdd9d11155d043d
-
SHA512
e53eb0e1410d187218b740cd17acf6a387245bc7ed38269103b1ca2cc33b652303d98676abb27992e2ab7c5f91186c1adcb303c8a5f27634fb4acca324a4729e
-
SSDEEP
3072:4E38zhWRoHgn8Qk+YWJMeMOg5bn8LR3NVmdntGz4bWhwmre:4ELRoHgn85+XLMhbn893fmjMrw+e
Static task
static1
Behavioral task
behavioral1
Sample
25a906877af7aed44c21b4c947a34666c3480629a929a227b67b273245ee3708.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
25a906877af7aed44c21b4c947a34666c3480629a929a227b67b273245ee3708.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
C:\Recovery\!LostTrustEncoded.txt
http://hscr6cjzhgoybibuzn2xud7u4crehuoo4ykw3swut7m7irde74hdfzyd.onion/s/qnwbjsfd
Targets
-
-
Target
25a906877af7aed44c21b4c947a34666c3480629a929a227b67b273245ee3708
-
Size
301KB
-
MD5
4ae8efc6c80fe086aa27117619718fc2
-
SHA1
09170b8fd03258b0deaa7b881c46180818b88381
-
SHA256
25a906877af7aed44c21b4c947a34666c3480629a929a227b67b273245ee3708
-
SHA512
31aacad5277a2a6f8199be9bd457749689d678ae74c5eefe26165c3f1f369ad579ee279d26d6460ebaf7ffaef12c1bb5b53294a9c3d724c6288a0b8da3d7b539
-
SSDEEP
6144:a9GxIp80vvgsYW0/kNAhHDQGsarUs7/TvgfBEwmXjAbImzFps1Se:aYI/6MN0jQjbs7cBEaJzk/
Score10/10-
Clears Windows event logs
-
Renames multiple (7053) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Renames multiple (7474) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-