Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
03097f75904007de33f69ec77e02146fe2a0b3d3b2a923640677bb1f46815b07.bin.sample.gz
-
Size
78KB
-
Sample
231022-tacvyscd33
-
MD5
af6f9b7b0ff42c356a9a0734e56c52a4
-
SHA1
092441089839b5d81c7974fc9dc397a8e51b206a
-
SHA256
24f1c2a20833b1d6f88cb5e73513cc0f163e7c552db78fb783523fb3e1c3a75d
-
SHA512
e5a413b4e865b88c34c9f0992d277af851afb8fa5ca84d367563eab43111e49dfc7bfd88e1924d5b56c337cdc258e6b79cf67861a39eef76b966750c1b030779
-
SSDEEP
1536:DiMiHX/8x5BsU7YyWo6A4v/2LPJTVZMnI1aqzmqVaRWqqdCaGBuVq7+9SMlJT:DiMsX0DB/YyPuuLPJTVZMI1aqzmJo4oP
Static task
static1
Behavioral task
behavioral1
Sample
sample.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
sample.exe
Resource
win10v2004-20231020-en
Malware Config
Extracted
C:\ProgramData\Merlin_Recover.txt
https://getsession.org/download
Targets
-
-
Target
sample
-
Size
146KB
-
MD5
1784d03173fd273f9810be0a48f1f383
-
SHA1
b4354665152723b9fa6e31f07d155265a1d6e2f6
-
SHA256
03097f75904007de33f69ec77e02146fe2a0b3d3b2a923640677bb1f46815b07
-
SHA512
35dad75e13ab4363ee1495e304e58ec11f731da1f8e21ce9690cfd0cff7d77c50f8b9b5584208e315c8cbb71345401e6ffd771427690b2cffcb40b3ec78b7edb
-
SSDEEP
3072:nyPZHpVIYbQf91G3im/2Ef07Jysgk8vRFHoCj1advu07rr/b/V53SgvB+qMDDpvy:n2HpV+8vnvEu0Xrjt5igvy6Qijx3P
Score10/10-
Renames multiple (10319) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Renames multiple (7055) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-