Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

2b186f91be...JC.exe

windows7-x64

10

2b186f91be...JC.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/08/2023, 15:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2b186f91be83719e9a70de7ad4c43485_mafia_JC.exe

  • Size

    308KB

  • MD5

    2b186f91be83719e9a70de7ad4c43485

  • SHA1

    6e45adf201c98fcafc07e6efdda3c0bf8edb0bce

  • SHA256

    04d453ffa9e7ae419c72e6640e98190edbf2bb1567ed0fdcf9e589c46c62c953

  • SHA512

    53aea8d2fce3d1e7e4ee2db0c35457964502141a2ce94fa9bac080f6b63b92b0c4b3f615b6cc3b9c87dbb2bb09b916c183987aa2318cb3fde7dfc04e8455a9d7

  • SSDEEP

    6144:wzL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:WDHNam62ZdKmZmuPH

Score
10/10
gandcrabbackdoorransomware

Malware Config

Signatures

  • GandCrab payload 2 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2b186f91be83719e9a70de7ad4c43485_mafia_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\2b186f91be83719e9a70de7ad4c43485_mafia_JC.exe"
    1⤵
      PID:2780
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 480
        2⤵
        • Program crash
        PID:4616
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2780 -ip 2780
      1⤵
        PID:3816

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2780-134-0x000000000AB70000-0x000000000AC70000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/2780-135-0x0000000000400000-0x0000000001400000-memory.dmp

        Filesize

        16.0MB

        Download

      • memory/2780-137-0x000000000C720000-0x000000000C737000-memory.dmp

        Filesize

        92KB

        Download