Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
18/01/2024, 22:58
General
-
Target
2024-01-18_7e0e1667c56b5cdb2e15b1d587cb3bec_mafia.exe
-
Size
351KB
-
MD5
7e0e1667c56b5cdb2e15b1d587cb3bec
-
SHA1
00af78ee959a02f48fbc5a9d21289797da49badb
-
SHA256
00611d90e3cfc5db22ce7ddab3e26bc7b0aee03ba5c57a88834e6c29fe59277e
-
SHA512
4fda9c1b70fafb72c95dc8a5c7efebf68e06cf797df52d2d0944921fbcf982cc713de11ba4c06db2141b07166ba6d7ee254d5753f7c20713ca22e54131e9ae5f
-
SSDEEP
3072:rpNMs+Kr1wbWGjl0xjsNNeVKBNVBxKT46xl+wndfIQQOaC3QBn7/hsb2BhGZ1/Nb:rpNMsLWEjsXjBATRpuuwnGD/Nj6a
Malware Config
Signatures
-
GandCrab payload 3 IoCs
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Detects Reflective DLL injection artifacts 3 IoCs
-
Detects ransomware indicator 2 IoCs
-
Gandcrab Payload 3 IoCs
-
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Program crash 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-18_7e0e1667c56b5cdb2e15b1d587cb3bec_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-18_7e0e1667c56b5cdb2e15b1d587cb3bec_mafia.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 10482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2108 -ip 21081⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
92KB
-
Filesize
1024KB
-
Filesize
92KB