Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

0aa705e527...17.exe

windows7-x64

10

0aa705e527...17.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0aa705e527e09af6efefc9a512707d17

  • Size

    320KB

  • Sample

    220906-1cmaqsacg8

  • MD5

    0aa705e527e09af6efefc9a512707d17

  • SHA1

    550420ae3a52dfd7b710ca1a15c623db24f1131f

  • SHA256

    415cd8268a08158590ab882374355b5295b0587e5f270716736727b047d38dcc

  • SHA512

    a3c2ed6393e891b43df554b2c080e8b694fabb1dae52e0980744f5d0f4ab38fdcb637cd35870b987ec264d231ebe629de4b1c8378b17891d05bcc6d6317f8e9c

  • SSDEEP

    3072:4bRXn2p4B/51pzVyqZ5iQ88ZJmj3h2OdyC9aNhw3cvo2bDi5fBbHHD+FtW89:4b9+g/pzVwQ82Jm7h2As36CtaJHjN89

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      0aa705e527e09af6efefc9a512707d17

    • Size

      320KB

    • MD5

      0aa705e527e09af6efefc9a512707d17

    • SHA1

      550420ae3a52dfd7b710ca1a15c623db24f1131f

    • SHA256

      415cd8268a08158590ab882374355b5295b0587e5f270716736727b047d38dcc

    • SHA512

      a3c2ed6393e891b43df554b2c080e8b694fabb1dae52e0980744f5d0f4ab38fdcb637cd35870b987ec264d231ebe629de4b1c8378b17891d05bcc6d6317f8e9c

    • SSDEEP

      3072:4bRXn2p4B/51pzVyqZ5iQ88ZJmj3h2OdyC9aNhw3cvo2bDi5fBbHHD+FtW89:4b9+g/pzVwQ82Jm7h2As36CtaJHjN89

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks