Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2420-0-0x0000000010000000-0x00000000104B5000-memory.dmp

  • Size

    4.7MB

  • Sample

    250310-wkjscstwaw

  • MD5

    f588802958c35fe18eb87bc36651a3d1

  • SHA1

    45fb5e8c7b4809abab0d7b64875490dc6afa2fef

  • SHA256

    dcce9e235d247c1c368a85edc1480d8a5d8ba07413a222161bfc52632d6f0762

  • SHA512

    aae5f7b82c3326f8a439e2b8ce72c7d69ee06da73b1c0b7a426e9a94bd3a4ca78e83c1b6eededbcf2564f1ab78f74b92e4e3d0e449f7c334a3257d188488c639

  • SSDEEP

    98304:qTAroKRRlaL3IkcusxIViubeqDVzCkyLEKFwPD+8th5L:qTArpRRoL3IknLVVbeqDNCkyLm

Score
10/10

Malware Config

Extracted

Family

agenda

Attributes
  • company_id

    0c-IyC4m1G

  • note

    -- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from your system/network. Our group cooperates with the mass media. If you refuse to communicate with us and we do not come to an agreement, your data will be reviewed and published on our blog and on the media page (https://31.41.244.100) Blog links: http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials-- Credentials Extension: 0c-IyC4m1G Domain: fsthixb5w4uq3nge4xrghmvxnufnd77vvic7mxvrgkjycrpyy6fw5qad.onion login: cRKOId7XfmSWmvHze5tj-66-LKhnooRT password:

rsa_pubkey.plain

Targets

    • Target

      2420-0-0x0000000010000000-0x00000000104B5000-memory.dmp

    • Size

      4.7MB

    • MD5

      f588802958c35fe18eb87bc36651a3d1

    • SHA1

      45fb5e8c7b4809abab0d7b64875490dc6afa2fef

    • SHA256

      dcce9e235d247c1c368a85edc1480d8a5d8ba07413a222161bfc52632d6f0762

    • SHA512

      aae5f7b82c3326f8a439e2b8ce72c7d69ee06da73b1c0b7a426e9a94bd3a4ca78e83c1b6eededbcf2564f1ab78f74b92e4e3d0e449f7c334a3257d188488c639

    • SSDEEP

      98304:qTAroKRRlaL3IkcusxIViubeqDVzCkyLEKFwPD+8th5L:qTArpRRoL3IknLVVbeqDNCkyLm

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks