Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/01/2025, 02:26

General

  • Target

    2025-01-13_43d135ff50d5ddd77f26d9c2fcf84ec4_gandcrab.exe

  • Size

    201KB

  • MD5

    43d135ff50d5ddd77f26d9c2fcf84ec4

  • SHA1

    7aceff4cdf7d76e63c2a62c280cb9acfecfc60a8

  • SHA256

    6e018e47e10d531e21d71bafc3e0bfa958b32bb4abe788408f81107c815030a2

  • SHA512

    32caeca2bdbf36c44df7f23e957cdd3e20addfd97f09a40dbeea8e300fc36a948e6b62398b1729107d165e4d9e5e00d7be1fd25f8f0c6f076c3c2242d32ce46e

  • SSDEEP

    6144:iXjOnr6gqqDL64vduLiEpbpQJio8eiZNgoo2FWTOy2:iTOnYqn6cuLiExpQJ98eCgoo2oTO3

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-13_43d135ff50d5ddd77f26d9c2fcf84ec4_gandcrab.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-13_43d135ff50d5ddd77f26d9c2fcf84ec4_gandcrab.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3400
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2988
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup emsisoft.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5060
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4768
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2364
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup emsisoft.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3416
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3816
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1608
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup emsisoft.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3032
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4820
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3064
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup emsisoft.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3760
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4812
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2892
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup emsisoft.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4376

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads