Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

cryptolaemus

windows10-2004-x64

9

cryptolaemus

windows11-21h2-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616

  • Size

    194KB

  • Sample

    240429-sqcz8aeb4v

  • MD5

    e990e7571cdb06c5d0f093176cecf414

  • SHA1

    409fc0816adbf05ac1586112044401ecb90c8022

  • SHA256

    a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616

  • SHA512

    9719fb45a0cd79ba8d51c3d052fe76dcb6d1b5b677a5398cc4fdbe6373d8763d2b0c3375929f41c5a0e46237b4a3f660b0b7f6a4f8a24ea47d52074da69baa64

  • SSDEEP

    3072:A6glyuxE4GsUPnliByocWepzdBaChENI/NBpke:A6gDBGpvEByocWelq+V

Score
10/10
lockbitransomwarespywarestealer

Malware Config

Targets

    • Target

      a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616

    • Size

      194KB

    • MD5

      e990e7571cdb06c5d0f093176cecf414

    • SHA1

      409fc0816adbf05ac1586112044401ecb90c8022

    • SHA256

      a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616

    • SHA512

      9719fb45a0cd79ba8d51c3d052fe76dcb6d1b5b677a5398cc4fdbe6373d8763d2b0c3375929f41c5a0e46237b4a3f660b0b7f6a4f8a24ea47d52074da69baa64

    • SSDEEP

      3072:A6glyuxE4GsUPnliByocWepzdBaChENI/NBpke:A6gDBGpvEByocWelq+V

    Score
    9/10
    ransomwarespywarestealer

    • Renames multiple (639) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks