Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
underground_19476853362.zip
-
Size
263KB
-
Sample
241022-s1h9zssbre
-
MD5
2e221450145b4cc518dde3dab8a9a16b
-
SHA1
f1dc9ed7ac09f4e49b3405d9f8a5889d29e40c9e
-
SHA256
6b8f437952b810764ae0e7350f427a254bdd38e2d24ae5bde008d0bc2f9e766c
-
SHA512
2511a577e7ba70298dfdfaf00f71bbfe9fcff121a67f98c5bc7261652d5bdb933f19889260a89591e565d69ac30073dd3ef95048ffa38515bdca4b23a7ea66b9
-
SSDEEP
3072:E7C6CZRdxz5gme1ySYC6dE6xWVbS9DI7OrUcUPKlnphkJVZ8JmqpMKVFoDBsoulQ:dtJgRi7IpSdVrURuWJ72ZKTBQr3WDVd
Static task
static1
Behavioral task
behavioral1
Sample
02de715f147fa4365150fbc1f576622026cc4f60cc1316b5c3052dbeac72ec3f.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
02de715f147fa4365150fbc1f576622026cc4f60cc1316b5c3052dbeac72ec3f.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
C:\Program Files\7-Zip\!!readme!!!.txt
underground
http://undgrddapc4reaunnrdrmnagvdelqfvmgycuvilgwb5uxm25sxawaoqd.onion/
Targets
-
-
Target
02de715f147fa4365150fbc1f576622026cc4f60cc1316b5c3052dbeac72ec3f
-
Size
483KB
-
MD5
85e91593b75daba22988bb251400853a
-
SHA1
713d55c60af03c21afb7a37ccc49e17b9a06e257
-
SHA256
02de715f147fa4365150fbc1f576622026cc4f60cc1316b5c3052dbeac72ec3f
-
SHA512
9be6bd0d7606182e162bafbc2f369c3bd24a5edf3b2a35c726cb92a22c44f6aab17c64367753a01e600adb3dec91eb3f3de1dcee46dae10d872d7b1c9f6d4112
-
SSDEEP
6144:SlbX0Y1DgsOKCGHqC4InJnPm14HaQ/L8VfefRIUcwC/19KKNQA0EQrB2z/sG8d:Slrbe9GCInJPmOHOVfC7i14Gv0EQrB
-
Underground Team
Underground Team is a ransomware first seen in July 2023 that is primarily distriuted via exploting vulnerabilities.
-
Clears Windows event logs
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops desktop.ini file(s)
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-