Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
22/08/2023, 15:48
Static task
static1
Behavioral task
behavioral1
Sample
6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe
-
Size
308KB
-
MD5
6979b8ae8f01fca31d78927c6821cc40
-
SHA1
2065127b3b4c009a5bd8404a1f2f5b8a6001f09e
-
SHA256
e9fa4067b9b4f875f545db380cb84cd1438f0ce9f9927cf5e5e5d9ef16d14ed2
-
SHA512
5122394c8e337b2a13bd5a63b012853ea1c13025cb902c1ff9ed2cb62c962a5bce7a7c3ddf94ab967a8048d88090ef5fe68df4efd1a7ba0effd596fcb920a9a2
-
SSDEEP
3072:ymBr3balBclw29DXaPB2J9ot3nPIGX30caGhDgGCcc4Go0ER5IY0ms41:ymBrrDDX0tXT30vzHF4Go0+Fs41
Malware Config
Signatures
-
GandCrab payload 4 IoCs
resource yara_rule behavioral1/memory/2196-57-0x0000000000280000-0x0000000000296000-memory.dmp family_gandcrab behavioral1/memory/2196-58-0x0000000000400000-0x0000000000E86000-memory.dmp family_gandcrab behavioral1/memory/2196-65-0x0000000000400000-0x0000000000E86000-memory.dmp family_gandcrab behavioral1/memory/2196-67-0x0000000000280000-0x0000000000296000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mrvxyyzpvrb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe" 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe File opened (read-only) \??\L: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe File opened (read-only) \??\M: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe File opened (read-only) \??\T: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe File opened (read-only) \??\X: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe File opened (read-only) \??\E: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe File opened (read-only) \??\J: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe File opened (read-only) \??\O: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe File opened (read-only) \??\S: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe File opened (read-only) \??\U: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe File opened (read-only) \??\V: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe File opened (read-only) \??\I: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe File opened (read-only) \??\B: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe File opened (read-only) \??\H: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe File opened (read-only) \??\K: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe File opened (read-only) \??\R: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe File opened (read-only) \??\Z: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe File opened (read-only) \??\A: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe File opened (read-only) \??\P: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe File opened (read-only) \??\Q: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe File opened (read-only) \??\W: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe File opened (read-only) \??\Y: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe File opened (read-only) \??\N: 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2524 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 28 PID 2196 wrote to memory of 2524 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 28 PID 2196 wrote to memory of 2524 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 28 PID 2196 wrote to memory of 2524 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 28 PID 2196 wrote to memory of 2924 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 30 PID 2196 wrote to memory of 2924 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 30 PID 2196 wrote to memory of 2924 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 30 PID 2196 wrote to memory of 2924 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 30 PID 2196 wrote to memory of 2720 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 33 PID 2196 wrote to memory of 2720 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 33 PID 2196 wrote to memory of 2720 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 33 PID 2196 wrote to memory of 2720 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 33 PID 2196 wrote to memory of 3064 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 35 PID 2196 wrote to memory of 3064 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 35 PID 2196 wrote to memory of 3064 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 35 PID 2196 wrote to memory of 3064 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 35 PID 2196 wrote to memory of 2736 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 37 PID 2196 wrote to memory of 2736 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 37 PID 2196 wrote to memory of 2736 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 37 PID 2196 wrote to memory of 2736 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 37 PID 2196 wrote to memory of 2768 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 39 PID 2196 wrote to memory of 2768 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 39 PID 2196 wrote to memory of 2768 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 39 PID 2196 wrote to memory of 2768 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 39 PID 2196 wrote to memory of 2708 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 41 PID 2196 wrote to memory of 2708 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 41 PID 2196 wrote to memory of 2708 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 41 PID 2196 wrote to memory of 2708 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 41 PID 2196 wrote to memory of 2828 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 43 PID 2196 wrote to memory of 2828 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 43 PID 2196 wrote to memory of 2828 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 43 PID 2196 wrote to memory of 2828 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 43 PID 2196 wrote to memory of 3000 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 45 PID 2196 wrote to memory of 3000 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 45 PID 2196 wrote to memory of 3000 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 45 PID 2196 wrote to memory of 3000 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 45 PID 2196 wrote to memory of 1128 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 49 PID 2196 wrote to memory of 1128 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 49 PID 2196 wrote to memory of 1128 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 49 PID 2196 wrote to memory of 1128 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 49 PID 2196 wrote to memory of 1420 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 51 PID 2196 wrote to memory of 1420 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 51 PID 2196 wrote to memory of 1420 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 51 PID 2196 wrote to memory of 1420 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 51 PID 2196 wrote to memory of 780 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 53 PID 2196 wrote to memory of 780 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 53 PID 2196 wrote to memory of 780 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 53 PID 2196 wrote to memory of 780 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 53 PID 2196 wrote to memory of 1944 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 56 PID 2196 wrote to memory of 1944 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 56 PID 2196 wrote to memory of 1944 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 56 PID 2196 wrote to memory of 1944 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 56 PID 2196 wrote to memory of 2132 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 57 PID 2196 wrote to memory of 2132 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 57 PID 2196 wrote to memory of 2132 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 57 PID 2196 wrote to memory of 2132 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 57 PID 2196 wrote to memory of 2412 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 59 PID 2196 wrote to memory of 2412 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 59 PID 2196 wrote to memory of 2412 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 59 PID 2196 wrote to memory of 2412 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 59 PID 2196 wrote to memory of 1900 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 61 PID 2196 wrote to memory of 1900 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 61 PID 2196 wrote to memory of 1900 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 61 PID 2196 wrote to memory of 1900 2196 6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe 61
Processes
-
C:\Users\Admin\AppData\Local\Temp\6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe"C:\Users\Admin\AppData\Local\Temp\6979b8ae8f01fca31d78927c6821cc40_mafia_magniber_JC.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:2524
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:2924
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:2720
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:3064
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:2736
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:2768
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:2708
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:2828
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:3000
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:1128
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:1420
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:780
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:1944
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:2132
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:2412
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:1900
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:1896
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:1960
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:2700
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:1624
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:1812
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:1680
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:2308
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:3048
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:1544
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:2892
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:1232
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:1160
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:2240
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:2332
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:1204
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:1768
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:2292
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:1628
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:1576
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:1108
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:1008
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:1692
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:2056
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:988
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:2312
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:888
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:1540
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:2160
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:2420
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:2340
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:2836
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:2480
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:2740
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:2832
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:2840
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:2844
-