Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

31/07/2024, 17:50

240731-wess3s1apd 10

24/07/2024, 23:21

240724-3cel1awfqh 10

General

  • Target

    240723-28pamsnp2w_pw_infected.zip

  • Size

    1.3MB

  • Sample

    240724-3cel1awfqh

  • MD5

    0b5e3f25e6409f78effe5cb1d597a305

  • SHA1

    a9628c3fcd8345d77347b54d7a33d3378946be4f

  • SHA256

    9f628cfed8996f974a6c6d39d41d82d8e29972117591605ccceff0bd5c6fd432

  • SHA512

    6be58a9dcb321f71cda3b2f552e2629ca2298f385812b88657abd9c49b1a422f8a2e7e12d814a2469503921dd8e15be688c4ed011b1063aed768c525e28c7b13

  • SSDEEP

    24576:g1QQfPrr8b4FnvZVfqDbJxRJ9b4QR0zZZ4bTml/FZnQiIYt1OY9ja2KO3U:/QfUb4V/Ez9cgCZX5bnQi4Y9jsd

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\README_FOR_DECRYPT.txt

Ransom Note
RADAR Your network has been breached and all major data were encrypted. Important files have been downloaded from your servers and are ready to be published on TOR blogs. To decrypt all the data and prevent exfiltrated files to be disclosed on TOR blogs, dataleak forums, dataleak databases, telegram channels etc with lot of tags/videos on twitter/facebook you should purchase our decryption tool. We will provide you a proof video how our Decryption Tool works. Please contact our sales department at Skype: https://join.skype.com/invite/MO0SAOWRh0zo We appreciate and respect everyone, that's why in Skype you will get a proof, we will record a video of 5-10 files of your choice. Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete encrypted files. In result your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything and your data, recorded data on videos etc will be published. - Do not hire a recovery company. They can't decrypt files without our Decryption Tool. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. You should contact with us yourself and we'll guarantee you 10077BCB65CA365CF885446C7CB6B4ABA99uccessful decryption without any loss + exfiltrated data erasing from our servers. - Do not reject to purchase RADAR Decryptor from us, otherwise exfiltrated files will be publicly disclosed with video of files. P.S. Do not repeat the same mistakes as other companies did with us, for example our old case with a small Spain Company: ALVAC S.A. Their Website - https://alvac.es Our media team published files and videos, because they didn't pay as in time. Small part of proofs: https://vimeo.com/752214614 https://hacknotice.com/2022/10/01/alvac-sa/ https://twitter.com/elhackernet/status/1576678217603502080 https://twitter.com/search?q=alvacvimeo&src=typed_query&f=live Lot of telegram channels like https://t.me/elconfidencial , https://t.me/baseleak , all darkweb resources list from here - https://github.com/fastfire/deepdarkCTI/blob/main/telegram.md We have a direct contact with a list of ransomware owners in jabber and tox, you can see all the companies that refused to cooperate with us, TOR/onion URLs: http://xb6q2aggycmlcrjtbjendcnnwpmmwbosqaugxsqb4nx6cmod3emy7sad.onion http://mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion http://bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion/ http://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion http://knight3xppu263m7g4ag3xlit2qxpryjwueobh7vjdc3zrscqlfu3pqd.onion/ For ALVAC SA we hired 3rd party team of data analysts with OSINT-specialists. Because of adding such 3rd parties, the price for Decryption Tool and exfiltrated data erasing has been increased. In result they suffered significant problems due disastrous consequences, leading to loss of valuable intellectual property and other sensitive information, GDPR issues, costly incident response efforts, information misuse/abuse, loss of customer trust, brand and reputational damage, legal and regulatory issues. And it will never end for them, as their files are constantly downloaded and videos are viewed by people from all over the World. That's why we don't recommend to ignore us. Let's respect each others time. With best Regards, RADAR
URLs

https://join.skype.com/invite/MO0SAOWRh0zo

https://alvac.es

https://vimeo.com/752214614

https://hacknotice.com/2022/10/01/alvac-sa/

https://twitter.com/elhackernet/status/1576678217603502080

https://twitter.com/search?q=alvacvimeo&src=typed_query&f=live

https://t.me/elconfidencial

https://t.me/baseleak

https://github.com/fastfire/deepdarkCTI/blob/main/telegram.md

http://xb6q2aggycmlcrjtbjendcnnwpmmwbosqaugxsqb4nx6cmod3emy7sad.onion

http://mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion

http://bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion/

http://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion

http://knight3xppu263m7g4ag3xlit2qxpryjwueobh7vjdc3zrscqlfu3pqd.onion/

Targets

    • Target

      5bc9478d90533ebccf09c7204999853bae36db997b230e2809090c7827c8ced0

    • Size

      2.8MB

    • MD5

      7aa09e4360e6f20bddf496b1a761625c

    • SHA1

      69a82326b7dfd32c13aaafe6f35513041677e2bc

    • SHA256

      5bc9478d90533ebccf09c7204999853bae36db997b230e2809090c7827c8ced0

    • SHA512

      0870390c9e2eb329ce6be788206703d31ac6ca7f9ff5a73c9cb27651845bdccce0af1b8554e5f04f45e241ca125151807e3d5dc53bf3562eab67c2fc206f37ac

    • SSDEEP

      24576:x9unT88TyX8GwjLXULXr9EZZHGUPpNjgk59yjfX/AGrYum1e/Khs6apAUFc6d8Wa:zqTfTUpdLXREi8jp5E51/KWK

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Renames multiple (171) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks