Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

43691290ac...0c.exe

windows7-x64

10

43691290ac...0c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10/03/2025, 16:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    43691290ac03ebb26754203f1cc3940b32f036babb7cfab3cb14fe2128389c0c.exe

  • Size

    5.0MB

  • MD5

    2bb209ccfc5103eccab523c875050cfa

  • SHA1

    c5b2e36ef6356757da4bbce417ca90f49d369526

  • SHA256

    43691290ac03ebb26754203f1cc3940b32f036babb7cfab3cb14fe2128389c0c

  • SHA512

    7e6701343e4b46c9faa8af7b81a4a61c0b12651e47b2f2c9c0ddbf62663147c53bcc8295ef3249e08ee7ab62f8d29951b3f2fad3f775eb580eac14c3b9f21c9c

  • SSDEEP

    98304:usBHJmM4GxhB9KK2yngd2ndMdudGfcwJhIUYbimDtMt/nTWh1:usBHJmM4GXyyngCbBtMt/

Score
10/10
agendadiscoveryransomware

Malware Config

Extracted

Family

agenda

Attributes
  • company_id

    0c-IyC4m1G

  • note

    -- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from your system/network. Our group cooperates with the mass media. If you refuse to communicate with us and we do not come to an agreement, your data will be reviewed and published on our blog and on the media page (https://31.41.244.100) Blog links: http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials-- Credentials Extension: 0c-IyC4m1G Domain: fsthixb5w4uq3nge4xrghmvxnufnd77vvic7mxvrgkjycrpyy6fw5qad.onion login: cRKOId7XfmSWmvHze5tj-66-LKhnooRT password:

rsa_pubkey.plain

Signatures

  • Agenda Ransomware

    A ransomware with multiple variants written in Golang and Rust first seen in August 2022.

    ransomwareagenda
  • Agenda family
    agenda
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\43691290ac03ebb26754203f1cc3940b32f036babb7cfab3cb14fe2128389c0c.exe
    "C:\Users\Admin\AppData\Local\Temp\43691290ac03ebb26754203f1cc3940b32f036babb7cfab3cb14fe2128389c0c.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2420

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2420-0-0x0000000010000000-0x00000000104B5000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/2420-10-0x0000000000B60000-0x0000000001069000-memory.dmp

    Filesize

    5.0MB

    Download