Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2956-0-0x0000000010000000-0x00000000104B5000-memory.dmp

  • Size

    4.7MB

  • Sample

    250310-wh1cbstjv3

  • MD5

    03742d19843755bedacc445eaba82801

  • SHA1

    af3860fcc43c056693af1e3a533b33ba408cb9f3

  • SHA256

    269151290ec172daa999366dcaaf1a5719b7e40a40984821c2ff348ff1d60517

  • SHA512

    5ac3afcf6fc84458a479b8146ba8690961235dca6f825495690c56c40076e892983b51905af1f5a8bc6093f408e10f01b20ae64591161549204f7303fcb643f2

  • SSDEEP

    98304:acm3bMNI4j9HgcmhyOIFA/EeqDvzCkyqBwFwPD+8th5c:acm3ANIO9Hgc6oF6EeqD7Ckyqp

Score
10/10

Malware Config

Extracted

Family

agenda

Credentials
Attributes
  • company_id

    6ENLBw7FHl

  • note

    -- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from your system/network. Our group cooperates with the mass media. If you refuse to communicate with us and we do not come to an agreement, your data will be reviewed and published on our blog (http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion) and on the media page (https://31.41.244.100) Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials-- Credentials Extension: 6ENLBw7FHl Domain: 5xpitxvg6mas333qdoad3qfiv44o563sbgve4cpvey4qh3uv3aqfidyd.onion login: Qeg2YJErPVhPLm9w6o4eY99mfjndNqta password:

rsa_pubkey.plain

Targets

    • Target

      2956-0-0x0000000010000000-0x00000000104B5000-memory.dmp

    • Size

      4.7MB

    • MD5

      03742d19843755bedacc445eaba82801

    • SHA1

      af3860fcc43c056693af1e3a533b33ba408cb9f3

    • SHA256

      269151290ec172daa999366dcaaf1a5719b7e40a40984821c2ff348ff1d60517

    • SHA512

      5ac3afcf6fc84458a479b8146ba8690961235dca6f825495690c56c40076e892983b51905af1f5a8bc6093f408e10f01b20ae64591161549204f7303fcb643f2

    • SSDEEP

      98304:acm3bMNI4j9HgcmhyOIFA/EeqDvzCkyqBwFwPD+8th5c:acm3ANIO9Hgc6oF6EeqD7Ckyqp

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks