Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2024-05-12_9d1fd92ea00c6eef88076dd55cad611e_snatch
-
Size
5.4MB
-
Sample
240512-qwmqhagg7z
-
MD5
9d1fd92ea00c6eef88076dd55cad611e
-
SHA1
a108c142dba8c9af5236ec64fe5a1ce04c54a3fb
-
SHA256
8badf1274da7c2bd1416e2ff8c384348fc42e7d1600bf826c9ad695fb5192c74
-
SHA512
5a3a4806e3e5752537185cdd467385f4bd693f0bf8650f9f0c0e6b742a39ea8d5f4bb98a63f9da89c55947fc80b707640be4344ea04a4dddb62f01548615e1e4
-
SSDEEP
49152:cSHZzXZ9Xrb/TWvO90d7HjmAFd4A64nsfJNpqVVVTZwJbwao2gkATs4hVl/YhpE4:PZ91ErwJ3CJE3/R4
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-12_9d1fd92ea00c6eef88076dd55cad611e_snatch.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-05-12_9d1fd92ea00c6eef88076dd55cad611e_snatch.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
C:\Users\Public\Desktop\HOW_RETURN_YOUR_DATA.TXT
http://panelqbinglxczi2gqkwderfvgq6bcv5cbjwxrksjtvr5xv7ozh5wqad.onion/Url=af1a0dc5-febd-4b19-bdf6-8d809756db71
Targets
-
-
Target
2024-05-12_9d1fd92ea00c6eef88076dd55cad611e_snatch
-
Size
5.4MB
-
MD5
9d1fd92ea00c6eef88076dd55cad611e
-
SHA1
a108c142dba8c9af5236ec64fe5a1ce04c54a3fb
-
SHA256
8badf1274da7c2bd1416e2ff8c384348fc42e7d1600bf826c9ad695fb5192c74
-
SHA512
5a3a4806e3e5752537185cdd467385f4bd693f0bf8650f9f0c0e6b742a39ea8d5f4bb98a63f9da89c55947fc80b707640be4344ea04a4dddb62f01548615e1e4
-
SSDEEP
49152:cSHZzXZ9Xrb/TWvO90d7HjmAFd4A64nsfJNpqVVVTZwJbwao2gkATs4hVl/YhpE4:PZ91ErwJ3CJE3/R4
Score10/10-
Renames multiple (163) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-