Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
240723-28pamsnp2w_pw_infected.zip
-
Size
1.3MB
-
Sample
240724-3cel1awfqh
-
MD5
0b5e3f25e6409f78effe5cb1d597a305
-
SHA1
a9628c3fcd8345d77347b54d7a33d3378946be4f
-
SHA256
9f628cfed8996f974a6c6d39d41d82d8e29972117591605ccceff0bd5c6fd432
-
SHA512
6be58a9dcb321f71cda3b2f552e2629ca2298f385812b88657abd9c49b1a422f8a2e7e12d814a2469503921dd8e15be688c4ed011b1063aed768c525e28c7b13
-
SSDEEP
24576:g1QQfPrr8b4FnvZVfqDbJxRJ9b4QR0zZZ4bTml/FZnQiIYt1OY9ja2KO3U:/QfUb4V/Ez9cgCZX5bnQi4Y9jsd
Static task
static1
Behavioral task
behavioral1
Sample
5bc9478d90533ebccf09c7204999853bae36db997b230e2809090c7827c8ced0.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5bc9478d90533ebccf09c7204999853bae36db997b230e2809090c7827c8ced0.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
C:\Users\Admin\Desktop\README_FOR_DECRYPT.txt
https://join.skype.com/invite/MO0SAOWRh0zo
https://alvac.es
https://vimeo.com/752214614
https://hacknotice.com/2022/10/01/alvac-sa/
https://twitter.com/elhackernet/status/1576678217603502080
https://twitter.com/search?q=alvacvimeo&src=typed_query&f=live
https://t.me/elconfidencial
https://t.me/baseleak
https://github.com/fastfire/deepdarkCTI/blob/main/telegram.md
http://xb6q2aggycmlcrjtbjendcnnwpmmwbosqaugxsqb4nx6cmod3emy7sad.onion
http://mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion
http://bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion/
http://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion
http://knight3xppu263m7g4ag3xlit2qxpryjwueobh7vjdc3zrscqlfu3pqd.onion/
Targets
-
-
Target
5bc9478d90533ebccf09c7204999853bae36db997b230e2809090c7827c8ced0
-
Size
2.8MB
-
MD5
7aa09e4360e6f20bddf496b1a761625c
-
SHA1
69a82326b7dfd32c13aaafe6f35513041677e2bc
-
SHA256
5bc9478d90533ebccf09c7204999853bae36db997b230e2809090c7827c8ced0
-
SHA512
0870390c9e2eb329ce6be788206703d31ac6ca7f9ff5a73c9cb27651845bdccce0af1b8554e5f04f45e241ca125151807e3d5dc53bf3562eab67c2fc206f37ac
-
SSDEEP
24576:x9unT88TyX8GwjLXULXr9EZZHGUPpNjgk59yjfX/AGrYum1e/Khs6apAUFc6d8Wa:zqTfTUpdLXREi8jp5E51/KWK
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (171) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
3