Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    9308ea3ebaf4d39f8cb5f29b015cf0064f73170d61226a5f9b5b7c28173bc402.zip

  • Size

    3.5MB

  • Sample

    240724-bm9fkssgqb

  • MD5

    b71d65468aceda690b0fc474f89a4d13

  • SHA1

    a67983b6ace054ced0812df12b5414c7de5441a4

  • SHA256

    5f597c276fd54188aac6ab9e2975a4d1dafac80d365a05c836bf92777a6af623

  • SHA512

    d51c83bc83718e31c7b090aaf653bb1d96f26aaffcfb5f3db946e21f6f98c6efa0fe25fd456cbfc3856929c11ed100674f3cdab51031ac0e87b01b6693d51e65

  • SSDEEP

    98304:fylSFOYBXVAnT+tWgdfflDPyE13op4LF+lXv5mSsa:dsUVgSttdft7yE1l+f5mSsa

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\ReadMe.txt

Ransom Note
=== README === Greet citizen of the world. Your files have been encrypted by the NetForceZ's Ransomware. Your documents, photos, databases, and other important files have been encrypted with the strongest encryption and a unique key. The files are no longer usable as they have been encrypted. You cannot recover them without our help. To restore your files, you need to purchase a special decryption key. The price for the key is $500 USDT ERC20 on Ethereum Network. To buy the decryption program, you need to do the following: Your ID : 1. Create an account on Coinbase or Binance to buy $500 USDT ERC20 on Ethereum Network. 2. Install a USDT ERC20 on Ethereum Network Wallet like Exodus. 3. Send USDT ERC20 on Ethereum Network to us : Once you have USDT ERC20 on Ethereum Network in your Wallet, you must send the required amount to our USDT ERC20 on Ethereum Network address. 4. Confirm Payment : Notify us through Telegram with the transaction ID. After we confirm your payment, we will send you the decryption key. Warning: * Do not try to decrypt your files using third-party software; this may cause permanent data loss. * Do not rename the encrypted files or try to modify them in any way; this will prevent you from being able to decrypt them. * If you do not pay within 10 hours, your files will be permanently deleted. If you need proof that we can decrypt your files, you can contact us and decrypt one file for free. Contact us on Telegram at: @xpolarized | @ZZART3XX Contact us on Tox at : 498F8B96D058FEB29A315C4572117E753F471847AFDF37E0A9896F6FFA5530547680628F8134 Our USDT ERC20 on Ethereum Network address : 0xdF0f41d46Dd8Be583F9a69b4a85A600C8Af7f4Ad Remember, we are the only ones who can help you recover your files. === END OF README ===

Targets

    • Target

      9308ea3ebaf4d39f8cb5f29b015cf0064f73170d61226a5f9b5b7c28173bc402

    • Size

      7.0MB

    • MD5

      2e74557d1ac847575f10650b8dd13276

    • SHA1

      0e937f3b1a770bbc4fd28cdf330d9b217ab34062

    • SHA256

      9308ea3ebaf4d39f8cb5f29b015cf0064f73170d61226a5f9b5b7c28173bc402

    • SHA512

      fe2651014bc17cf37b1f947e25b898f0c9ee35a2b2fcfe3d247b43854c4430dabc372f16eff03c1eb7f16d0a2c55778d209020023042e4715b8f6fbaf8493692

    • SSDEEP

      98304:6K8JmgV5fPcYE+/3q+PO0b+ISWAR66ga2v8j:6MgV5f4aiPISWAVgp

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks