Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    5425e988f4427fd1a56dd6616f5b7dc6308fb3ea29babee09242be1cf73c15bb.exe.compressed

  • Size

    99KB

  • Sample

    240128-285bvseaan

  • MD5

    990354fb58448a1a224c3be180e575d9

  • SHA1

    d5f16148af1f50396beac5a56e507ec14eb295c4

  • SHA256

    58e5c39d780435909c4988518b3d5d33b3815429c005420cb61e8d3522fb5422

  • SHA512

    6dc886552d6b938e6fd9379d3c1e5f61b042136e18413208dfe1a8b2de813cf725e82b063b699637b00b04cd55c3ef2cf3e42451926369cc606a42ff7f6073c6

  • SSDEEP

    1536:1Ij4wyUN3HZUR5WnPszr0MBEJVLcZL82ZTBv2caHwaCB284O+cn:cuUJHZU5WPLMBEJlcGE7aHwa

Score
10/10

Malware Config

Targets

    • Target

      5425e988f4427fd1a56dd6616f5b7dc6308fb3ea29babee09242be1cf73c15bb.exe.compressed

    • Size

      99KB

    • MD5

      990354fb58448a1a224c3be180e575d9

    • SHA1

      d5f16148af1f50396beac5a56e507ec14eb295c4

    • SHA256

      58e5c39d780435909c4988518b3d5d33b3815429c005420cb61e8d3522fb5422

    • SHA512

      6dc886552d6b938e6fd9379d3c1e5f61b042136e18413208dfe1a8b2de813cf725e82b063b699637b00b04cd55c3ef2cf3e42451926369cc606a42ff7f6073c6

    • SSDEEP

      1536:1Ij4wyUN3HZUR5WnPszr0MBEJVLcZL82ZTBv2caHwaCB284O+cn:cuUJHZU5WPLMBEJlcGE7aHwa

    Score
    9/10
    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Detects command variations typically used by ransomware

    • Detects executables containing many references to VEEAM. Observed in ransomware

    • Detects executables referencing many IR and analysis tools

    • Renames multiple (291) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies boot configuration data using bcdedit

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks