Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230705-en -
resource tags
arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system -
submitted
05/07/2023, 15:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
05f70f150a8f19exeexeexeex.exe
Resource
win7-20230705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
05f70f150a8f19exeexeexeex.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
05f70f150a8f19exeexeexeex.exe
-
Size
308KB
-
MD5
05f70f150a8f196df3a70c7b2876c7d6
-
SHA1
543b8a247341e9f9e32655ffc14d3548a84347d0
-
SHA256
f03769bfcdbcec552a11d3f4b1a6acf620c4a8e2495ede428aec03a916919f6a
-
SHA512
eeb3b8d5d9489f4804e8ba02f5405fe27fb47d084b47fb89998756bea5ad84a2e439d333492df68b7db476b78f31f33dd282153120f00331ca31e85852590e4b
-
SSDEEP
6144:PzL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:lDHNam62ZdKmZmuPH
Score
10/10
Malware Config
Signatures
-
GandCrab payload 4 IoCs
resource yara_rule behavioral1/memory/2384-55-0x0000000000400000-0x0000000001400000-memory.dmp family_gandcrab behavioral1/memory/2384-56-0x0000000000250000-0x0000000000267000-memory.dmp family_gandcrab behavioral1/memory/2384-63-0x0000000000400000-0x0000000001400000-memory.dmp family_gandcrab behavioral1/memory/2384-65-0x0000000000250000-0x0000000000267000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Unexpected DNS network traffic destination 33 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 05f70f150a8f19exeexeexeex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ajnudvrolhp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\iixzkv.exe\"" 05f70f150a8f19exeexeexeex.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\I: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\J: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\L: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\Q: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\S: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\T: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\B: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\Y: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\G: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\O: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\E: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\H: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\M: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\P: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\V: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\A: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\N: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\R: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\U: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\W: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\X: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\Z: 05f70f150a8f19exeexeexeex.exe File opened (read-only) \??\K: 05f70f150a8f19exeexeexeex.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 05f70f150a8f19exeexeexeex.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 05f70f150a8f19exeexeexeex.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 05f70f150a8f19exeexeexeex.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2384 05f70f150a8f19exeexeexeex.exe 2384 05f70f150a8f19exeexeexeex.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 2384 wrote to memory of 3064 2384 05f70f150a8f19exeexeexeex.exe 28 PID 2384 wrote to memory of 3064 2384 05f70f150a8f19exeexeexeex.exe 28 PID 2384 wrote to memory of 3064 2384 05f70f150a8f19exeexeexeex.exe 28 PID 2384 wrote to memory of 3064 2384 05f70f150a8f19exeexeexeex.exe 28 PID 2384 wrote to memory of 2148 2384 05f70f150a8f19exeexeexeex.exe 30 PID 2384 wrote to memory of 2148 2384 05f70f150a8f19exeexeexeex.exe 30 PID 2384 wrote to memory of 2148 2384 05f70f150a8f19exeexeexeex.exe 30 PID 2384 wrote to memory of 2148 2384 05f70f150a8f19exeexeexeex.exe 30 PID 2384 wrote to memory of 1220 2384 05f70f150a8f19exeexeexeex.exe 32 PID 2384 wrote to memory of 1220 2384 05f70f150a8f19exeexeexeex.exe 32 PID 2384 wrote to memory of 1220 2384 05f70f150a8f19exeexeexeex.exe 32 PID 2384 wrote to memory of 1220 2384 05f70f150a8f19exeexeexeex.exe 32 PID 2384 wrote to memory of 1144 2384 05f70f150a8f19exeexeexeex.exe 34 PID 2384 wrote to memory of 1144 2384 05f70f150a8f19exeexeexeex.exe 34 PID 2384 wrote to memory of 1144 2384 05f70f150a8f19exeexeexeex.exe 34 PID 2384 wrote to memory of 1144 2384 05f70f150a8f19exeexeexeex.exe 34 PID 2384 wrote to memory of 2268 2384 05f70f150a8f19exeexeexeex.exe 36 PID 2384 wrote to memory of 2268 2384 05f70f150a8f19exeexeexeex.exe 36 PID 2384 wrote to memory of 2268 2384 05f70f150a8f19exeexeexeex.exe 36 PID 2384 wrote to memory of 2268 2384 05f70f150a8f19exeexeexeex.exe 36 PID 2384 wrote to memory of 1796 2384 05f70f150a8f19exeexeexeex.exe 38 PID 2384 wrote to memory of 1796 2384 05f70f150a8f19exeexeexeex.exe 38 PID 2384 wrote to memory of 1796 2384 05f70f150a8f19exeexeexeex.exe 38 PID 2384 wrote to memory of 1796 2384 05f70f150a8f19exeexeexeex.exe 38 PID 2384 wrote to memory of 2124 2384 05f70f150a8f19exeexeexeex.exe 40 PID 2384 wrote to memory of 2124 2384 05f70f150a8f19exeexeexeex.exe 40 PID 2384 wrote to memory of 2124 2384 05f70f150a8f19exeexeexeex.exe 40 PID 2384 wrote to memory of 2124 2384 05f70f150a8f19exeexeexeex.exe 40 PID 2384 wrote to memory of 2300 2384 05f70f150a8f19exeexeexeex.exe 42 PID 2384 wrote to memory of 2300 2384 05f70f150a8f19exeexeexeex.exe 42 PID 2384 wrote to memory of 2300 2384 05f70f150a8f19exeexeexeex.exe 42 PID 2384 wrote to memory of 2300 2384 05f70f150a8f19exeexeexeex.exe 42 PID 2384 wrote to memory of 2668 2384 05f70f150a8f19exeexeexeex.exe 44 PID 2384 wrote to memory of 2668 2384 05f70f150a8f19exeexeexeex.exe 44 PID 2384 wrote to memory of 2668 2384 05f70f150a8f19exeexeexeex.exe 44 PID 2384 wrote to memory of 2668 2384 05f70f150a8f19exeexeexeex.exe 44 PID 2384 wrote to memory of 2624 2384 05f70f150a8f19exeexeexeex.exe 46 PID 2384 wrote to memory of 2624 2384 05f70f150a8f19exeexeexeex.exe 46 PID 2384 wrote to memory of 2624 2384 05f70f150a8f19exeexeexeex.exe 46 PID 2384 wrote to memory of 2624 2384 05f70f150a8f19exeexeexeex.exe 46 PID 2384 wrote to memory of 2748 2384 05f70f150a8f19exeexeexeex.exe 48 PID 2384 wrote to memory of 2748 2384 05f70f150a8f19exeexeexeex.exe 48 PID 2384 wrote to memory of 2748 2384 05f70f150a8f19exeexeexeex.exe 48 PID 2384 wrote to memory of 2748 2384 05f70f150a8f19exeexeexeex.exe 48 PID 2384 wrote to memory of 2588 2384 05f70f150a8f19exeexeexeex.exe 50 PID 2384 wrote to memory of 2588 2384 05f70f150a8f19exeexeexeex.exe 50 PID 2384 wrote to memory of 2588 2384 05f70f150a8f19exeexeexeex.exe 50 PID 2384 wrote to memory of 2588 2384 05f70f150a8f19exeexeexeex.exe 50 PID 2384 wrote to memory of 2768 2384 05f70f150a8f19exeexeexeex.exe 52 PID 2384 wrote to memory of 2768 2384 05f70f150a8f19exeexeexeex.exe 52 PID 2384 wrote to memory of 2768 2384 05f70f150a8f19exeexeexeex.exe 52 PID 2384 wrote to memory of 2768 2384 05f70f150a8f19exeexeexeex.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\05f70f150a8f19exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\05f70f150a8f19exeexeexeex.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:3064
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2148
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1220
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1144
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2268
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1796
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2124
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2300
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2668
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2624
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2748
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2588
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2768
-