Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
25/08/2023, 16:18
Static task
static1
Behavioral task
behavioral1
Sample
9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe
-
Size
319KB
-
MD5
9dfdbc6d22d2d4113a6d13bc35d44b8b
-
SHA1
48f9a61935ffc50c4d9a516b323a0bbafab51c04
-
SHA256
36b57a1787d8ab232c2e994008e2342d279335f6b81a7588654aa72ffa8cad4f
-
SHA512
8d7ec19650383a36d774a514f470d4f042ee9fa30d9d89da6b060b31302f600bc1cae3606a9e2fb53a762166010b5050ccb9088ee8afd7fdb0c2fa611cc61043
-
SSDEEP
3072:SLFqoITs8+GgzXKhp6vFcBNTjbL617AL6MfUL1OeV7LGyH0Bme3BdcpFbMT9O:SLFAYz7z6hp2W1L61ALCOk7LhdeROuO
Malware Config
Signatures
-
GandCrab payload 4 IoCs
resource yara_rule behavioral1/memory/1672-1-0x0000000000400000-0x0000000004B6E000-memory.dmp family_gandcrab behavioral1/memory/1672-3-0x0000000000250000-0x0000000000267000-memory.dmp family_gandcrab behavioral1/memory/1672-10-0x0000000000400000-0x0000000004B6E000-memory.dmp family_gandcrab behavioral1/memory/1672-12-0x0000000000250000-0x0000000000267000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Unexpected DNS network traffic destination 63 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\sdteqgfxlmz = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\jkstvh.exe\"" 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe File opened (read-only) \??\K: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe File opened (read-only) \??\L: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe File opened (read-only) \??\M: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe File opened (read-only) \??\N: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe File opened (read-only) \??\Y: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe File opened (read-only) \??\A: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe File opened (read-only) \??\B: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe File opened (read-only) \??\G: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe File opened (read-only) \??\H: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe File opened (read-only) \??\I: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe File opened (read-only) \??\T: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe File opened (read-only) \??\U: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe File opened (read-only) \??\J: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe File opened (read-only) \??\O: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe File opened (read-only) \??\P: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe File opened (read-only) \??\Q: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe File opened (read-only) \??\R: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe File opened (read-only) \??\S: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe File opened (read-only) \??\V: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe File opened (read-only) \??\W: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe File opened (read-only) \??\X: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe File opened (read-only) \??\Z: 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe -
Suspicious use of SetWindowsHookAW 64 IoCs
pid Process 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1672 wrote to memory of 2104 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 28 PID 1672 wrote to memory of 2104 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 28 PID 1672 wrote to memory of 2104 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 28 PID 1672 wrote to memory of 2104 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 28 PID 1672 wrote to memory of 2932 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 30 PID 1672 wrote to memory of 2932 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 30 PID 1672 wrote to memory of 2932 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 30 PID 1672 wrote to memory of 2932 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 30 PID 1672 wrote to memory of 1504 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 34 PID 1672 wrote to memory of 1504 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 34 PID 1672 wrote to memory of 1504 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 34 PID 1672 wrote to memory of 1504 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 34 PID 1672 wrote to memory of 1268 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 36 PID 1672 wrote to memory of 1268 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 36 PID 1672 wrote to memory of 1268 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 36 PID 1672 wrote to memory of 1268 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 36 PID 1672 wrote to memory of 2968 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 38 PID 1672 wrote to memory of 2968 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 38 PID 1672 wrote to memory of 2968 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 38 PID 1672 wrote to memory of 2968 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 38 PID 1672 wrote to memory of 2768 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 40 PID 1672 wrote to memory of 2768 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 40 PID 1672 wrote to memory of 2768 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 40 PID 1672 wrote to memory of 2768 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 40 PID 1672 wrote to memory of 2552 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 42 PID 1672 wrote to memory of 2552 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 42 PID 1672 wrote to memory of 2552 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 42 PID 1672 wrote to memory of 2552 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 42 PID 1672 wrote to memory of 2544 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 44 PID 1672 wrote to memory of 2544 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 44 PID 1672 wrote to memory of 2544 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 44 PID 1672 wrote to memory of 2544 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 44 PID 1672 wrote to memory of 780 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 46 PID 1672 wrote to memory of 780 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 46 PID 1672 wrote to memory of 780 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 46 PID 1672 wrote to memory of 780 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 46 PID 1672 wrote to memory of 552 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 48 PID 1672 wrote to memory of 552 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 48 PID 1672 wrote to memory of 552 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 48 PID 1672 wrote to memory of 552 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 48 PID 1672 wrote to memory of 1816 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 50 PID 1672 wrote to memory of 1816 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 50 PID 1672 wrote to memory of 1816 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 50 PID 1672 wrote to memory of 1816 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 50 PID 1672 wrote to memory of 2384 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 52 PID 1672 wrote to memory of 2384 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 52 PID 1672 wrote to memory of 2384 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 52 PID 1672 wrote to memory of 2384 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 52 PID 1672 wrote to memory of 2032 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 54 PID 1672 wrote to memory of 2032 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 54 PID 1672 wrote to memory of 2032 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 54 PID 1672 wrote to memory of 2032 1672 9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe 54
Processes
-
C:\Users\Admin\AppData\Local\Temp\9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\9dfdbc6d22d2d4113a6d13bc35d44b8b_mafia_JC.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookAW
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2104
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2932
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1504
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1268
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2968
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2768
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2552
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2544
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:780
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:552
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1816
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2384
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2032
-