Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
b091e38b4cdf341c2733c6e8c2199afd4ee05fc9f921a37c8e555198f1ec2e12
-
Size
624KB
-
Sample
241019-z37tpazakh
-
MD5
92a20ba91b4d3b89b57aa95a120667ae
-
SHA1
5f45a26c898a2fad0da08a6c4ba626e52619a599
-
SHA256
b091e38b4cdf341c2733c6e8c2199afd4ee05fc9f921a37c8e555198f1ec2e12
-
SHA512
81c66376274649ad99a343b5bf15211c18615009bbf4c18cc4f6992ab64664c945333b781ac856ac1d0ae367a9fed2294516d2a372bd97ad9e9d01b68bf5ea09
-
SSDEEP
12288:hd0aVXqKVXjdnMUs10XjzXQIGP0uNFoEKY8gMDidGPZ55jEPttS6tEVwuYlwIBl/:XC82SUs3cZVS/GWvfFnayWHD5ZHsjWPx
Static task
static1
Behavioral task
behavioral1
Sample
b091e38b4cdf341c2733c6e8c2199afd4ee05fc9f921a37c8e555198f1ec2e12.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b091e38b4cdf341c2733c6e8c2199afd4ee05fc9f921a37c8e555198f1ec2e12.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
F:\!!!READ_ME_MEDUSA!!!.txt
https://t.me/+yXOcSjVjI9tjM2E0
http://cx5u7zxbvrfyoj6ughw76oa264ucuuizmmzypwum6ear7pct4yc723qd.onion/
http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/
http://qxssgdmzli5kazyimrz3ktra5knhialjrdf4edxnwqsokgvrwjqu7cqd.onion/
http://62foekhv5humjrfwjdyd2dgextpbf5i7obguhwvfoghmu3nxpkmxlcid.onion/
http://uyku4o2yg34ekvjtszg6gu7cvjzm6hyszhtu7c55iyuzhpr4k5knewyd.onion/43238f023e96b71e5abb8bc0fc2cd2ab
http://5ar4vuckm3k7osdlzskqkaqmqr4jjpmdikuotmlpkrbsxx7ard3xetyd.onion/43238f023e96b71e5abb8bc0fc2cd2ab
Targets
-
-
Target
b091e38b4cdf341c2733c6e8c2199afd4ee05fc9f921a37c8e555198f1ec2e12
-
Size
624KB
-
MD5
92a20ba91b4d3b89b57aa95a120667ae
-
SHA1
5f45a26c898a2fad0da08a6c4ba626e52619a599
-
SHA256
b091e38b4cdf341c2733c6e8c2199afd4ee05fc9f921a37c8e555198f1ec2e12
-
SHA512
81c66376274649ad99a343b5bf15211c18615009bbf4c18cc4f6992ab64664c945333b781ac856ac1d0ae367a9fed2294516d2a372bd97ad9e9d01b68bf5ea09
-
SSDEEP
12288:hd0aVXqKVXjdnMUs10XjzXQIGP0uNFoEKY8gMDidGPZ55jEPttS6tEVwuYlwIBl/:XC82SUs3cZVS/GWvfFnayWHD5ZHsjWPx
-
Medusa Ransomware
Ransomware first identified in 2022 that is distinct from the similarly named ransomware family MedusaLocker.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (1937) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-