Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
15/08/2023, 19:27
Static task
static1
Behavioral task
behavioral1
Sample
048cb225a11c893a85927060a02558c4_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
048cb225a11c893a85927060a02558c4_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
048cb225a11c893a85927060a02558c4_mafia_JC.exe
-
Size
300KB
-
MD5
048cb225a11c893a85927060a02558c4
-
SHA1
e89ba7393230ffba0043a85bd56334450a5f0604
-
SHA256
c6b4382f29d3906f732907b5673d5ce5373498279c20942374b1f180f4b70ce1
-
SHA512
f535649ab648fc68d5ec6ce6dc4dc5257966a17ebf979cec0362e42ba23c04946ddd455cdf1f3e4e380ab3fc4bc80b05b68f5680e676a8960921af5a9be2c90a
-
SSDEEP
6144:3vEANMO1UnseVgkV0xwvfxnhLTiusLe1740B:cuM0Unsna5mut40B
Malware Config
Signatures
-
GandCrab payload 4 IoCs
resource yara_rule behavioral1/memory/1952-55-0x0000000000400000-0x0000000003B9B000-memory.dmp family_gandcrab behavioral1/memory/1952-56-0x00000000002C0000-0x00000000002D7000-memory.dmp family_gandcrab behavioral1/memory/1952-64-0x0000000000400000-0x0000000003B9B000-memory.dmp family_gandcrab behavioral1/memory/1952-65-0x00000000002C0000-0x00000000002D7000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tvwdbdmavpq = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\tdvjeq.exe\"" 048cb225a11c893a85927060a02558c4_mafia_JC.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: 048cb225a11c893a85927060a02558c4_mafia_JC.exe File opened (read-only) \??\T: 048cb225a11c893a85927060a02558c4_mafia_JC.exe File opened (read-only) \??\U: 048cb225a11c893a85927060a02558c4_mafia_JC.exe File opened (read-only) \??\W: 048cb225a11c893a85927060a02558c4_mafia_JC.exe File opened (read-only) \??\A: 048cb225a11c893a85927060a02558c4_mafia_JC.exe File opened (read-only) \??\I: 048cb225a11c893a85927060a02558c4_mafia_JC.exe File opened (read-only) \??\M: 048cb225a11c893a85927060a02558c4_mafia_JC.exe File opened (read-only) \??\E: 048cb225a11c893a85927060a02558c4_mafia_JC.exe File opened (read-only) \??\Q: 048cb225a11c893a85927060a02558c4_mafia_JC.exe File opened (read-only) \??\R: 048cb225a11c893a85927060a02558c4_mafia_JC.exe File opened (read-only) \??\V: 048cb225a11c893a85927060a02558c4_mafia_JC.exe File opened (read-only) \??\X: 048cb225a11c893a85927060a02558c4_mafia_JC.exe File opened (read-only) \??\Z: 048cb225a11c893a85927060a02558c4_mafia_JC.exe File opened (read-only) \??\B: 048cb225a11c893a85927060a02558c4_mafia_JC.exe File opened (read-only) \??\J: 048cb225a11c893a85927060a02558c4_mafia_JC.exe File opened (read-only) \??\N: 048cb225a11c893a85927060a02558c4_mafia_JC.exe File opened (read-only) \??\L: 048cb225a11c893a85927060a02558c4_mafia_JC.exe File opened (read-only) \??\O: 048cb225a11c893a85927060a02558c4_mafia_JC.exe File opened (read-only) \??\P: 048cb225a11c893a85927060a02558c4_mafia_JC.exe File opened (read-only) \??\Y: 048cb225a11c893a85927060a02558c4_mafia_JC.exe File opened (read-only) \??\G: 048cb225a11c893a85927060a02558c4_mafia_JC.exe File opened (read-only) \??\H: 048cb225a11c893a85927060a02558c4_mafia_JC.exe File opened (read-only) \??\K: 048cb225a11c893a85927060a02558c4_mafia_JC.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe -
Suspicious use of SetWindowsHookAW 64 IoCs
pid Process 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1952 wrote to memory of 2360 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 28 PID 1952 wrote to memory of 2360 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 28 PID 1952 wrote to memory of 2360 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 28 PID 1952 wrote to memory of 2360 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 28 PID 1952 wrote to memory of 2920 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 30 PID 1952 wrote to memory of 2920 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 30 PID 1952 wrote to memory of 2920 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 30 PID 1952 wrote to memory of 2920 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 30 PID 1952 wrote to memory of 2876 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 34 PID 1952 wrote to memory of 2876 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 34 PID 1952 wrote to memory of 2876 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 34 PID 1952 wrote to memory of 2876 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 34 PID 1952 wrote to memory of 2844 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 36 PID 1952 wrote to memory of 2844 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 36 PID 1952 wrote to memory of 2844 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 36 PID 1952 wrote to memory of 2844 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 36 PID 1952 wrote to memory of 2700 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 38 PID 1952 wrote to memory of 2700 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 38 PID 1952 wrote to memory of 2700 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 38 PID 1952 wrote to memory of 2700 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 38 PID 1952 wrote to memory of 2780 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 40 PID 1952 wrote to memory of 2780 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 40 PID 1952 wrote to memory of 2780 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 40 PID 1952 wrote to memory of 2780 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 40 PID 1952 wrote to memory of 2564 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 42 PID 1952 wrote to memory of 2564 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 42 PID 1952 wrote to memory of 2564 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 42 PID 1952 wrote to memory of 2564 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 42 PID 1952 wrote to memory of 1452 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 44 PID 1952 wrote to memory of 1452 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 44 PID 1952 wrote to memory of 1452 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 44 PID 1952 wrote to memory of 1452 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 44 PID 1952 wrote to memory of 1520 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 46 PID 1952 wrote to memory of 1520 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 46 PID 1952 wrote to memory of 1520 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 46 PID 1952 wrote to memory of 1520 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 46 PID 1952 wrote to memory of 2392 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 48 PID 1952 wrote to memory of 2392 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 48 PID 1952 wrote to memory of 2392 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 48 PID 1952 wrote to memory of 2392 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 48 PID 1952 wrote to memory of 864 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 50 PID 1952 wrote to memory of 864 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 50 PID 1952 wrote to memory of 864 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 50 PID 1952 wrote to memory of 864 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 50 PID 1952 wrote to memory of 3028 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 52 PID 1952 wrote to memory of 3028 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 52 PID 1952 wrote to memory of 3028 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 52 PID 1952 wrote to memory of 3028 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 52 PID 1952 wrote to memory of 2640 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 54 PID 1952 wrote to memory of 2640 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 54 PID 1952 wrote to memory of 2640 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 54 PID 1952 wrote to memory of 2640 1952 048cb225a11c893a85927060a02558c4_mafia_JC.exe 54
Processes
-
C:\Users\Admin\AppData\Local\Temp\048cb225a11c893a85927060a02558c4_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\048cb225a11c893a85927060a02558c4_mafia_JC.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookAW
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2360
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2920
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2876
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2844
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2700
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2780
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2564
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1452
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1520
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2392
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:864
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:3028
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2640
-