Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
158s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
09/07/2023, 11:12
Behavioral task
behavioral1
Sample
93f1059dac0c6cexeexeexeex.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
93f1059dac0c6cexeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
93f1059dac0c6cexeexeexeex.exe
-
Size
126KB
-
MD5
93f1059dac0c6cf2c479fb0082b8abd4
-
SHA1
501bce59628a1bf50bb5c019c0c598d261c00030
-
SHA256
7e72ec0fd0bef70368df45ea039c7f4b8aba55969d99b1e531b65b9356675b86
-
SHA512
2449600547c414d619fb5bc95058a0b89480b8ad9a34b82350a81a213b4c575754747dba0ab65bb20247ac67ea25637a480ae1398fe8306c8b14ee094b04e3e1
-
SSDEEP
1536:gZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAEMqqU+2bbbAV2/S2LNmHks:OBounVyFHFMqqDL2/LgHkc2oYvQd2a
Malware Config
Signatures
-
GandCrab payload 2 IoCs
resource yara_rule behavioral1/memory/1152-54-0x000000000F380000-0x000000000F39B000-memory.dmp family_gandcrab behavioral1/memory/1152-58-0x000000000F380000-0x000000000F39B000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
resource yara_rule behavioral1/memory/1152-54-0x000000000F380000-0x000000000F39B000-memory.dmp upx behavioral1/memory/1152-58-0x000000000F380000-0x000000000F39B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hhmztlrgppe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\93f1059dac0c6cexeexeexeex.exe" 93f1059dac0c6cexeexeexeex.exe Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 93f1059dac0c6cexeexeexeex.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\H: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\J: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\W: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\X: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\E: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\M: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\N: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\O: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\R: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\S: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\T: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\U: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\V: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\Y: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\Z: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\A: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\B: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\I: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\K: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\L: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\Q: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\G: 93f1059dac0c6cexeexeexeex.exe File opened (read-only) \??\P: 93f1059dac0c6cexeexeexeex.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 93f1059dac0c6cexeexeexeex.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 93f1059dac0c6cexeexeexeex.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 93f1059dac0c6cexeexeexeex.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1152 93f1059dac0c6cexeexeexeex.exe 1152 93f1059dac0c6cexeexeexeex.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1152 wrote to memory of 1948 1152 93f1059dac0c6cexeexeexeex.exe 30 PID 1152 wrote to memory of 1948 1152 93f1059dac0c6cexeexeexeex.exe 30 PID 1152 wrote to memory of 1948 1152 93f1059dac0c6cexeexeexeex.exe 30 PID 1152 wrote to memory of 1948 1152 93f1059dac0c6cexeexeexeex.exe 30 PID 1152 wrote to memory of 2096 1152 93f1059dac0c6cexeexeexeex.exe 32 PID 1152 wrote to memory of 2096 1152 93f1059dac0c6cexeexeexeex.exe 32 PID 1152 wrote to memory of 2096 1152 93f1059dac0c6cexeexeexeex.exe 32 PID 1152 wrote to memory of 2096 1152 93f1059dac0c6cexeexeexeex.exe 32 PID 1152 wrote to memory of 2120 1152 93f1059dac0c6cexeexeexeex.exe 34 PID 1152 wrote to memory of 2120 1152 93f1059dac0c6cexeexeexeex.exe 34 PID 1152 wrote to memory of 2120 1152 93f1059dac0c6cexeexeexeex.exe 34 PID 1152 wrote to memory of 2120 1152 93f1059dac0c6cexeexeexeex.exe 34 PID 1152 wrote to memory of 3004 1152 93f1059dac0c6cexeexeexeex.exe 36 PID 1152 wrote to memory of 3004 1152 93f1059dac0c6cexeexeexeex.exe 36 PID 1152 wrote to memory of 3004 1152 93f1059dac0c6cexeexeexeex.exe 36 PID 1152 wrote to memory of 3004 1152 93f1059dac0c6cexeexeexeex.exe 36 PID 1152 wrote to memory of 1752 1152 93f1059dac0c6cexeexeexeex.exe 38 PID 1152 wrote to memory of 1752 1152 93f1059dac0c6cexeexeexeex.exe 38 PID 1152 wrote to memory of 1752 1152 93f1059dac0c6cexeexeexeex.exe 38 PID 1152 wrote to memory of 1752 1152 93f1059dac0c6cexeexeexeex.exe 38 PID 1152 wrote to memory of 2192 1152 93f1059dac0c6cexeexeexeex.exe 40 PID 1152 wrote to memory of 2192 1152 93f1059dac0c6cexeexeexeex.exe 40 PID 1152 wrote to memory of 2192 1152 93f1059dac0c6cexeexeexeex.exe 40 PID 1152 wrote to memory of 2192 1152 93f1059dac0c6cexeexeexeex.exe 40 PID 1152 wrote to memory of 2228 1152 93f1059dac0c6cexeexeexeex.exe 42 PID 1152 wrote to memory of 2228 1152 93f1059dac0c6cexeexeexeex.exe 42 PID 1152 wrote to memory of 2228 1152 93f1059dac0c6cexeexeexeex.exe 42 PID 1152 wrote to memory of 2228 1152 93f1059dac0c6cexeexeexeex.exe 42 PID 1152 wrote to memory of 792 1152 93f1059dac0c6cexeexeexeex.exe 44 PID 1152 wrote to memory of 792 1152 93f1059dac0c6cexeexeexeex.exe 44 PID 1152 wrote to memory of 792 1152 93f1059dac0c6cexeexeexeex.exe 44 PID 1152 wrote to memory of 792 1152 93f1059dac0c6cexeexeexeex.exe 44 PID 1152 wrote to memory of 1184 1152 93f1059dac0c6cexeexeexeex.exe 46 PID 1152 wrote to memory of 1184 1152 93f1059dac0c6cexeexeexeex.exe 46 PID 1152 wrote to memory of 1184 1152 93f1059dac0c6cexeexeexeex.exe 46 PID 1152 wrote to memory of 1184 1152 93f1059dac0c6cexeexeexeex.exe 46 PID 1152 wrote to memory of 2064 1152 93f1059dac0c6cexeexeexeex.exe 48 PID 1152 wrote to memory of 2064 1152 93f1059dac0c6cexeexeexeex.exe 48 PID 1152 wrote to memory of 2064 1152 93f1059dac0c6cexeexeexeex.exe 48 PID 1152 wrote to memory of 2064 1152 93f1059dac0c6cexeexeexeex.exe 48 PID 1152 wrote to memory of 2560 1152 93f1059dac0c6cexeexeexeex.exe 50 PID 1152 wrote to memory of 2560 1152 93f1059dac0c6cexeexeexeex.exe 50 PID 1152 wrote to memory of 2560 1152 93f1059dac0c6cexeexeexeex.exe 50 PID 1152 wrote to memory of 2560 1152 93f1059dac0c6cexeexeexeex.exe 50 PID 1152 wrote to memory of 2276 1152 93f1059dac0c6cexeexeexeex.exe 52 PID 1152 wrote to memory of 2276 1152 93f1059dac0c6cexeexeexeex.exe 52 PID 1152 wrote to memory of 2276 1152 93f1059dac0c6cexeexeexeex.exe 52 PID 1152 wrote to memory of 2276 1152 93f1059dac0c6cexeexeexeex.exe 52 PID 1152 wrote to memory of 2736 1152 93f1059dac0c6cexeexeexeex.exe 54 PID 1152 wrote to memory of 2736 1152 93f1059dac0c6cexeexeexeex.exe 54 PID 1152 wrote to memory of 2736 1152 93f1059dac0c6cexeexeexeex.exe 54 PID 1152 wrote to memory of 2736 1152 93f1059dac0c6cexeexeexeex.exe 54 PID 1152 wrote to memory of 2724 1152 93f1059dac0c6cexeexeexeex.exe 56 PID 1152 wrote to memory of 2724 1152 93f1059dac0c6cexeexeexeex.exe 56 PID 1152 wrote to memory of 2724 1152 93f1059dac0c6cexeexeexeex.exe 56 PID 1152 wrote to memory of 2724 1152 93f1059dac0c6cexeexeexeex.exe 56 PID 1152 wrote to memory of 2476 1152 93f1059dac0c6cexeexeexeex.exe 58 PID 1152 wrote to memory of 2476 1152 93f1059dac0c6cexeexeexeex.exe 58 PID 1152 wrote to memory of 2476 1152 93f1059dac0c6cexeexeexeex.exe 58 PID 1152 wrote to memory of 2476 1152 93f1059dac0c6cexeexeexeex.exe 58 PID 1152 wrote to memory of 2900 1152 93f1059dac0c6cexeexeexeex.exe 60 PID 1152 wrote to memory of 2900 1152 93f1059dac0c6cexeexeexeex.exe 60 PID 1152 wrote to memory of 2900 1152 93f1059dac0c6cexeexeexeex.exe 60 PID 1152 wrote to memory of 2900 1152 93f1059dac0c6cexeexeexeex.exe 60
Processes
-
C:\Users\Admin\AppData\Local\Temp\93f1059dac0c6cexeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\93f1059dac0c6cexeexeexeex.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:1948
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2096
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:2120
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:3004
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:1752
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2192
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:2228
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:792
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:1184
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:2064
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:2560
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2276
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:2736
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2724
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:2476
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:2900
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:2496
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2604
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:2580
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2484
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:2544
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:2916
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:2000
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:984
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:2700
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1180
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:1832
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:2536
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:1008
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2660
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:1444
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1308
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:1800
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:2848
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:2792
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2840
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:844
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2076
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:1192
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:1648
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:564
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:572
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:1212
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:916
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:2952
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:2376
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:1884
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:1920
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:864
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2060
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:1504
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:2384
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:2124
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:3056
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:2044
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1696
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:696
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:996
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:2988
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2360
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:2880
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2936
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:2896
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:2744
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:2764
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2636
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:2524
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:3052
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:2084
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:1596
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:944
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:884
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:276
-