Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02

  • Size

    221KB

  • Sample

    240920-x4ehestdje

  • MD5

    a04eb443870896fbe9a0b6468c4844f7

  • SHA1

    e3001ef25b1386763caec9b5339ec6ddb0275a71

  • SHA256

    a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02

  • SHA512

    28919641ecb89a7770a974992231bbdb9a7369e429d4b37d5b685bafab30b95c5bd87ce781d5a67db6c1b2823c85f9f3c6901285912f1bb641d9967d82d2660f

  • SSDEEP

    6144:JrazEX0203RegvjxnpGhu3BJMIp2CuvY63:B+3JpGEBJMg2CuvY6

Malware Config

Extracted

Path

C:\CIopReadMe.txt

Ransom Note
------------------------Your networks has been penetrated--------------------------------------- All files on each host in the networks have been encrypted with a strong algorithm. Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed, so F-8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation. ===No DECRYPTION software is AVAILABLE in the PUBLIC=== - DO NOT RENAME OR MOVE the encrypted and readme files. ========================DO NOT RESET OR SHUTDOWN – FILES MAY BE DAMAGED======================== ========================DO NOT RESET OR SHUTDOWN – FILES MAY BE DAMAGED======================== ========================DO NOT RESET OR SHUTDOWN – FILES MAY BE DAMAGED======================== ---THIS MAY LEAD TO THE IMPOSSIBILITY OF RECOVERY OF THE CERTAIN FILES--- ---ALL REPAIR TOOLS ARE USELESS AND CAN DESTROY YOUR FILES IRREVERSIBLY--- If you want to restore your files write to email. [CONTACTS ARE AT THE BOTTOM OF THE SHEET] and attach 4-6 encrypted files! [Less than 7 Mb each, non-archived and your files should not contain valuable information!!! [Databases,large excel sheets, backups etc...]]!!! ***You will receive decrypted samples and our conditions how to get the decoder*** *^*ATTENTION*^* =YOUR WARRANTY - DECRYPTED SAMPLES= -=-DO NOT TRY TO DECRYPT YOUR DATA USING THIRD PARTY SOFTWARE-=- -=-WE DONT NEED YOUR FILES AND YOUR INFORMATION-=- CONTACTS E-MAILS: [email protected] AND [email protected] OR [email protected] _-_ATTENTION_-_ In the letter, type your company name and site! ***The final price depends on how fast you write to us*** ^_*Nothing personal just business^_* CLOP^_- ----------------------------------------------------------------------------------------------

Targets

    • Target

      a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02

    • Size

      221KB

    • MD5

      a04eb443870896fbe9a0b6468c4844f7

    • SHA1

      e3001ef25b1386763caec9b5339ec6ddb0275a71

    • SHA256

      a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02

    • SHA512

      28919641ecb89a7770a974992231bbdb9a7369e429d4b37d5b685bafab30b95c5bd87ce781d5a67db6c1b2823c85f9f3c6901285912f1bb641d9967d82d2660f

    • SSDEEP

      6144:JrazEX0203RegvjxnpGhu3BJMIp2CuvY63:B+3JpGEBJMg2CuvY6

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Renames multiple (142) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks