Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    cb966139adb162ea019d1f6ca648febaf4249cbb9e255f492987f26087c3397b.exe

  • Size

    4.8MB

  • Sample

    240212-fhcchabf6y

  • MD5

    9803950281290044e32fb78605c129b5

  • SHA1

    133f587df70680d81c18d8c112b9a34e6041d629

  • SHA256

    cb966139adb162ea019d1f6ca648febaf4249cbb9e255f492987f26087c3397b

  • SHA512

    b5be7c8710a6dfea3fafc85cd10881c62be587607be8f05a61f9bf6aa88456c8c1dd694c85dd5707cd5518bb2f87f077824e410c24f081fab30ea13572de3c21

  • SSDEEP

    98304:pWFsTuRN2zazBLlLvOc1Pgd1E20fzsFvOF3BQQi4y0g1ea6:pWFsTuRN2zahf1Y7EhZSlI

Malware Config

Targets

    • Target

      cb966139adb162ea019d1f6ca648febaf4249cbb9e255f492987f26087c3397b.exe

    • Size

      4.8MB

    • MD5

      9803950281290044e32fb78605c129b5

    • SHA1

      133f587df70680d81c18d8c112b9a34e6041d629

    • SHA256

      cb966139adb162ea019d1f6ca648febaf4249cbb9e255f492987f26087c3397b

    • SHA512

      b5be7c8710a6dfea3fafc85cd10881c62be587607be8f05a61f9bf6aa88456c8c1dd694c85dd5707cd5518bb2f87f077824e410c24f081fab30ea13572de3c21

    • SSDEEP

      98304:pWFsTuRN2zazBLlLvOc1Pgd1E20fzsFvOF3BQQi4y0g1ea6:pWFsTuRN2zahf1Y7EhZSlI

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Blocklisted process makes network request

    • Checks whether UAC is enabled

    • Downloads MZ/PE file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks