Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    681489e93c845e475a4ff0878a9244e9a1519668ecdffbe46507c9f3cfb20c1e

  • Size

    42KB

  • Sample

    240203-vplxvagedr

  • MD5

    0ae0e189bbe1e33cc08e905ab98b0a69

  • SHA1

    140ab08c71a4e1014f132ffae4428cbafcd7b8ad

  • SHA256

    681489e93c845e475a4ff0878a9244e9a1519668ecdffbe46507c9f3cfb20c1e

  • SHA512

    5a7c567926bc24aab379b1ad1dfa866e992f4df39195165c8fb4941b8aada8cb1043ca7b7568051e29035c4473555345959477876f24d675555220b6aca52479

  • SSDEEP

    768:EO1oR/DVS1RzK4wbs+D/SIJX+ZZ1SQQwVTIOPzDq1xTq3ZQJtCQ:EBS1FKnDtmTImq+3ZQX

Score
10/10

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\+README-WARNING+.txt

Ransom Note
::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay us. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailboxes: helprequest@techmail.info or hope2honest@aol.com .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.
Emails

helprequest@techmail.info

hope2honest@aol.com

Targets

    • Target

      681489e93c845e475a4ff0878a9244e9a1519668ecdffbe46507c9f3cfb20c1e

    • Size

      42KB

    • MD5

      0ae0e189bbe1e33cc08e905ab98b0a69

    • SHA1

      140ab08c71a4e1014f132ffae4428cbafcd7b8ad

    • SHA256

      681489e93c845e475a4ff0878a9244e9a1519668ecdffbe46507c9f3cfb20c1e

    • SHA512

      5a7c567926bc24aab379b1ad1dfa866e992f4df39195165c8fb4941b8aada8cb1043ca7b7568051e29035c4473555345959477876f24d675555220b6aca52479

    • SSDEEP

      768:EO1oR/DVS1RzK4wbs+D/SIJX+ZZ1SQQwVTIOPzDq1xTq3ZQJtCQ:EBS1FKnDtmTImq+3ZQX

    Score
    10/10
    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Renames multiple (7555) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.