Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c
-
Size
270KB
-
Sample
240201-hsab1afgfk
-
MD5
49f2be089ed87da030c5d331a8a9da66
-
SHA1
f7fbc851936c3b90b2029d3f7f0b134e601dcd44
-
SHA256
1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c
-
SHA512
67631a14501c573d6abeb31fce5177af7191c1cf799feced7e00ed4ecb9da7cc34d90279c397ba264274a862dacaf9a1929c096aa1d48ba49f3066a9d91a154f
-
SSDEEP
6144:XqohGKel4VQg/U+Dgx3bMAVVzddi6jWGPxF:XqoGlK53DgZMSVFjW0x
Static task
static1
Behavioral task
behavioral1
Sample
1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
C:\Users\Admin\Data breach warning.txt
https://qtox.github.io
http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion
http://161.35.200.18
https://gofile.io/d/ufuFye
Targets
-
-
Target
1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c
-
Size
270KB
-
MD5
49f2be089ed87da030c5d331a8a9da66
-
SHA1
f7fbc851936c3b90b2029d3f7f0b134e601dcd44
-
SHA256
1773b284d3dd1e06be6dd92012d05720471395affc653874aa34636bf58d328c
-
SHA512
67631a14501c573d6abeb31fce5177af7191c1cf799feced7e00ed4ecb9da7cc34d90279c397ba264274a862dacaf9a1929c096aa1d48ba49f3066a9d91a154f
-
SSDEEP
6144:XqohGKel4VQg/U+Dgx3bMAVVzddi6jWGPxF:XqoGlK53DgZMSVFjW0x
Score10/10-
Renames multiple (245) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-