Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2023, 15:12
Static task
static1
Behavioral task
behavioral1
Sample
acaa77d5c0358b0c2b350af1b5ebee3c_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
acaa77d5c0358b0c2b350af1b5ebee3c_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
acaa77d5c0358b0c2b350af1b5ebee3c_mafia_JC.exe
-
Size
250KB
-
MD5
acaa77d5c0358b0c2b350af1b5ebee3c
-
SHA1
7780b929bcc446166ee31631cd24e4fea70d50a9
-
SHA256
f5d0c0989e2529775f748d73b87e5e9a457034ca0691607540d555fe937fde07
-
SHA512
610f7a6b91cc1c432aaa7020fe43a1affa79d8e5b07db2a30c34e4f90acc9ba89c28d874d058c854e0e16599edb23b8c27c599bac1dbb79a6f8fbc45bb55f04f
-
SSDEEP
6144:c+YrOIBjaklexBgiJ8sTSIkIpxIp8mDtfPBRwasxXq:UOCjaklYgVIpxIhDtR
Malware Config
Signatures
-
GandCrab payload 2 IoCs
resource yara_rule behavioral2/memory/2112-3-0x0000000000400000-0x0000000000444000-memory.dmp family_gandcrab behavioral2/memory/2112-5-0x00000000021E0000-0x00000000021F7000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1956 2112 WerFault.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\acaa77d5c0358b0c2b350af1b5ebee3c_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\acaa77d5c0358b0c2b350af1b5ebee3c_mafia_JC.exe"1⤵PID:2112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 4762⤵
- Program crash
PID:1956
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2112 -ip 21121⤵PID:4892