Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 13:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe
-
Size
250KB
-
MD5
aee0d5c778c40d2b6015c142a2151445
-
SHA1
8cfe28ec8baa0f79749097dedc61da337f44f841
-
SHA256
f4719a9f752727c9f9cb069c9ebee31598a5e8455b776c9364139b523648e268
-
SHA512
569bdfc263b5507d42ebc22bed24f55b37535acf7c203f0175b5e31bbb6b7c976c69213202e51efd1d2de3daacef6470c24ba814c310889c95502f322dd8b306
-
SSDEEP
3072:e/yK5d0Gj0+nY3uEBLvBNfdUR2/qFnB8o2+vU3WuvIBuj00nReaXkuSQ7cdOd3:e/y20Gj0r+EBFrkvlU3RvIUDOIN
Malware Config
Signatures
-
GandCrab payload 4 IoCs
resource yara_rule behavioral1/memory/2364-7-0x0000000000400000-0x0000000000444000-memory.dmp family_gandcrab behavioral1/memory/2364-5-0x0000000000260000-0x0000000000277000-memory.dmp family_gandcrab behavioral1/memory/2364-4-0x0000000000400000-0x0000000000444000-memory.dmp family_gandcrab behavioral1/memory/2364-16-0x0000000000260000-0x0000000000277000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Detects Reflective DLL injection artifacts 4 IoCs
resource yara_rule behavioral1/memory/2364-7-0x0000000000400000-0x0000000000444000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/2364-5-0x0000000000260000-0x0000000000277000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/2364-4-0x0000000000400000-0x0000000000444000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/2364-16-0x0000000000260000-0x0000000000277000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader -
Detects ransomware indicator 4 IoCs
resource yara_rule behavioral1/memory/2364-7-0x0000000000400000-0x0000000000444000-memory.dmp SUSP_RANSOMWARE_Indicator_Jul20 behavioral1/memory/2364-5-0x0000000000260000-0x0000000000277000-memory.dmp SUSP_RANSOMWARE_Indicator_Jul20 behavioral1/memory/2364-4-0x0000000000400000-0x0000000000444000-memory.dmp SUSP_RANSOMWARE_Indicator_Jul20 behavioral1/memory/2364-16-0x0000000000260000-0x0000000000277000-memory.dmp SUSP_RANSOMWARE_Indicator_Jul20 -
Gandcrab Payload 4 IoCs
resource yara_rule behavioral1/memory/2364-7-0x0000000000400000-0x0000000000444000-memory.dmp Gandcrab behavioral1/memory/2364-5-0x0000000000260000-0x0000000000277000-memory.dmp Gandcrab behavioral1/memory/2364-4-0x0000000000400000-0x0000000000444000-memory.dmp Gandcrab behavioral1/memory/2364-16-0x0000000000260000-0x0000000000277000-memory.dmp Gandcrab -
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wsxonvjyuhu = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\zwnexi.exe\"" 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe File opened (read-only) \??\I: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe File opened (read-only) \??\J: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe File opened (read-only) \??\P: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe File opened (read-only) \??\R: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe File opened (read-only) \??\U: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe File opened (read-only) \??\Y: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe File opened (read-only) \??\B: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe File opened (read-only) \??\L: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe File opened (read-only) \??\S: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe File opened (read-only) \??\W: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe File opened (read-only) \??\A: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe File opened (read-only) \??\E: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe File opened (read-only) \??\H: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe File opened (read-only) \??\M: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe File opened (read-only) \??\N: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe File opened (read-only) \??\O: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe File opened (read-only) \??\Q: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe File opened (read-only) \??\V: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe File opened (read-only) \??\K: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe File opened (read-only) \??\T: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe File opened (read-only) \??\X: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe File opened (read-only) \??\Z: 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2552 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 28 PID 2364 wrote to memory of 2552 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 28 PID 2364 wrote to memory of 2552 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 28 PID 2364 wrote to memory of 2552 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 28 PID 2364 wrote to memory of 2684 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 30 PID 2364 wrote to memory of 2684 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 30 PID 2364 wrote to memory of 2684 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 30 PID 2364 wrote to memory of 2684 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 30 PID 2364 wrote to memory of 2784 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 33 PID 2364 wrote to memory of 2784 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 33 PID 2364 wrote to memory of 2784 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 33 PID 2364 wrote to memory of 2784 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 33 PID 2364 wrote to memory of 2056 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 34 PID 2364 wrote to memory of 2056 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 34 PID 2364 wrote to memory of 2056 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 34 PID 2364 wrote to memory of 2056 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 34 PID 2364 wrote to memory of 2524 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 36 PID 2364 wrote to memory of 2524 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 36 PID 2364 wrote to memory of 2524 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 36 PID 2364 wrote to memory of 2524 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 36 PID 2364 wrote to memory of 3016 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 38 PID 2364 wrote to memory of 3016 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 38 PID 2364 wrote to memory of 3016 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 38 PID 2364 wrote to memory of 3016 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 38 PID 2364 wrote to memory of 1996 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 40 PID 2364 wrote to memory of 1996 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 40 PID 2364 wrote to memory of 1996 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 40 PID 2364 wrote to memory of 1996 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 40 PID 2364 wrote to memory of 2384 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 44 PID 2364 wrote to memory of 2384 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 44 PID 2364 wrote to memory of 2384 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 44 PID 2364 wrote to memory of 2384 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 44 PID 2364 wrote to memory of 1480 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 47 PID 2364 wrote to memory of 1480 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 47 PID 2364 wrote to memory of 1480 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 47 PID 2364 wrote to memory of 1480 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 47 PID 2364 wrote to memory of 1540 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 49 PID 2364 wrote to memory of 1540 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 49 PID 2364 wrote to memory of 1540 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 49 PID 2364 wrote to memory of 1540 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 49 PID 2364 wrote to memory of 2888 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 51 PID 2364 wrote to memory of 2888 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 51 PID 2364 wrote to memory of 2888 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 51 PID 2364 wrote to memory of 2888 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 51 PID 2364 wrote to memory of 2088 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 53 PID 2364 wrote to memory of 2088 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 53 PID 2364 wrote to memory of 2088 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 53 PID 2364 wrote to memory of 2088 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 53 PID 2364 wrote to memory of 1104 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 55 PID 2364 wrote to memory of 1104 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 55 PID 2364 wrote to memory of 1104 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 55 PID 2364 wrote to memory of 1104 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 55 PID 2364 wrote to memory of 472 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 56 PID 2364 wrote to memory of 472 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 56 PID 2364 wrote to memory of 472 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 56 PID 2364 wrote to memory of 472 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 56 PID 2364 wrote to memory of 1652 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 58 PID 2364 wrote to memory of 1652 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 58 PID 2364 wrote to memory of 1652 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 58 PID 2364 wrote to memory of 1652 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 58 PID 2364 wrote to memory of 1172 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 60 PID 2364 wrote to memory of 1172 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 60 PID 2364 wrote to memory of 1172 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 60 PID 2364 wrote to memory of 1172 2364 2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe 60
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-18_aee0d5c778c40d2b6015c142a2151445_karagany_mafia.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2552
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2684
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2784
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2056
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2524
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:3016
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1996
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2384
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1480
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1540
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2888
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2088
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1104
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:472
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1652
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1172
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2436
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1804
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2256
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2000
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1912
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1836
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1100
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:3068
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:112
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1812
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:956
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1580
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2808
-