Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/01/2025, 21:31

General

  • Target

    2025-01-22_99c191cac545f6b3601b5c744c32fa9a_bkransomware_karagany.exe

  • Size

    143KB

  • MD5

    99c191cac545f6b3601b5c744c32fa9a

  • SHA1

    7ef3aa2363238042ac17f9de02442ca8a1c31d15

  • SHA256

    2f4962d6a260640aa67ae12bb7d32d9233e47b58f81c325054aa936fadf0fca9

  • SHA512

    660281888171850af0f4e286d319b29e908ccf5573361fa4d591df754a5f1e12b453141f104c26b62f97b331b6160a96a6d32658931e115aa7af1ee030c91e11

  • SSDEEP

    3072:G+HcL204CfIfPQ+kS62FxyjEoZ/+5l7Vjp9:LMIfvkSjx4EQ/+Np9

Malware Config

Signatures

  • GandCrab payload 4 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • Gandcrab family
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-22_99c191cac545f6b3601b5c744c32fa9a_bkransomware_karagany.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-22_99c191cac545f6b3601b5c744c32fa9a_bkransomware_karagany.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2472
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2888
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      2⤵
        PID:2712
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup ransomware.bit ns1.corp-servers.ru
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2900
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup zonealarm.bit ns1.corp-servers.ru
        2⤵
          PID:2792
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup ransomware.bit ns2.corp-servers.ru
          2⤵
            PID:1328
          • C:\Windows\SysWOW64\nslookup.exe
            nslookup zonealarm.bit ns2.corp-servers.ru
            2⤵
              PID:2720
            • C:\Windows\SysWOW64\nslookup.exe
              nslookup ransomware.bit ns1.corp-servers.ru
              2⤵
                PID:2628
              • C:\Windows\SysWOW64\nslookup.exe
                nslookup zonealarm.bit ns1.corp-servers.ru
                2⤵
                • System Location Discovery: System Language Discovery
                PID:2136
              • C:\Windows\SysWOW64\nslookup.exe
                nslookup ransomware.bit ns2.corp-servers.ru
                2⤵
                • System Location Discovery: System Language Discovery
                PID:2252
              • C:\Windows\SysWOW64\nslookup.exe
                nslookup zonealarm.bit ns2.corp-servers.ru
                2⤵
                • System Location Discovery: System Language Discovery
                PID:1852
              • C:\Windows\SysWOW64\nslookup.exe
                nslookup ransomware.bit ns1.corp-servers.ru
                2⤵
                  PID:3016
                • C:\Windows\SysWOW64\nslookup.exe
                  nslookup zonealarm.bit ns1.corp-servers.ru
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:2844
                • C:\Windows\SysWOW64\nslookup.exe
                  nslookup ransomware.bit ns2.corp-servers.ru
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:1096
                • C:\Windows\SysWOW64\nslookup.exe
                  nslookup zonealarm.bit ns2.corp-servers.ru
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:2960
                • C:\Windows\SysWOW64\nslookup.exe
                  nslookup ransomware.bit ns1.corp-servers.ru
                  2⤵
                    PID:3004
                  • C:\Windows\SysWOW64\nslookup.exe
                    nslookup zonealarm.bit ns1.corp-servers.ru
                    2⤵
                      PID:2880
                    • C:\Windows\SysWOW64\nslookup.exe
                      nslookup ransomware.bit ns2.corp-servers.ru
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:1208
                    • C:\Windows\SysWOW64\nslookup.exe
                      nslookup zonealarm.bit ns2.corp-servers.ru
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:1832
                    • C:\Windows\SysWOW64\nslookup.exe
                      nslookup ransomware.bit ns1.corp-servers.ru
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:2552
                    • C:\Windows\SysWOW64\nslookup.exe
                      nslookup zonealarm.bit ns1.corp-servers.ru
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:604
                    • C:\Windows\SysWOW64\nslookup.exe
                      nslookup ransomware.bit ns2.corp-servers.ru
                      2⤵
                        PID:588
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup zonealarm.bit ns2.corp-servers.ru
                        2⤵
                          PID:1736
                        • C:\Windows\SysWOW64\nslookup.exe
                          nslookup ransomware.bit ns1.corp-servers.ru
                          2⤵
                            PID:1496
                          • C:\Windows\SysWOW64\nslookup.exe
                            nslookup zonealarm.bit ns1.corp-servers.ru
                            2⤵
                            • System Location Discovery: System Language Discovery
                            PID:2144
                          • C:\Windows\SysWOW64\nslookup.exe
                            nslookup ransomware.bit ns2.corp-servers.ru
                            2⤵
                              PID:2096
                            • C:\Windows\SysWOW64\nslookup.exe
                              nslookup zonealarm.bit ns2.corp-servers.ru
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:2588
                            • C:\Windows\SysWOW64\nslookup.exe
                              nslookup ransomware.bit ns1.corp-servers.ru
                              2⤵
                                PID:1976
                              • C:\Windows\SysWOW64\nslookup.exe
                                nslookup zonealarm.bit ns1.corp-servers.ru
                                2⤵
                                  PID:2564
                                • C:\Windows\SysWOW64\nslookup.exe
                                  nslookup ransomware.bit ns2.corp-servers.ru
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1772
                                • C:\Windows\SysWOW64\nslookup.exe
                                  nslookup zonealarm.bit ns2.corp-servers.ru
                                  2⤵
                                    PID:1392
                                  • C:\Windows\SysWOW64\nslookup.exe
                                    nslookup ransomware.bit ns1.corp-servers.ru
                                    2⤵
                                      PID:1580
                                    • C:\Windows\SysWOW64\nslookup.exe
                                      nslookup zonealarm.bit ns1.corp-servers.ru
                                      2⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1384
                                    • C:\Windows\SysWOW64\nslookup.exe
                                      nslookup ransomware.bit ns2.corp-servers.ru
                                      2⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2316
                                    • C:\Windows\SysWOW64\nslookup.exe
                                      nslookup zonealarm.bit ns2.corp-servers.ru
                                      2⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:796
                                    • C:\Windows\SysWOW64\nslookup.exe
                                      nslookup ransomware.bit ns1.corp-servers.ru
                                      2⤵
                                        PID:1428
                                      • C:\Windows\SysWOW64\nslookup.exe
                                        nslookup zonealarm.bit ns1.corp-servers.ru
                                        2⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2456
                                      • C:\Windows\SysWOW64\nslookup.exe
                                        nslookup ransomware.bit ns2.corp-servers.ru
                                        2⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1504
                                      • C:\Windows\SysWOW64\nslookup.exe
                                        nslookup zonealarm.bit ns2.corp-servers.ru
                                        2⤵
                                          PID:2024
                                        • C:\Windows\SysWOW64\nslookup.exe
                                          nslookup ransomware.bit ns1.corp-servers.ru
                                          2⤵
                                            PID:2512
                                          • C:\Windows\SysWOW64\nslookup.exe
                                            nslookup zonealarm.bit ns1.corp-servers.ru
                                            2⤵
                                              PID:2264
                                            • C:\Windows\SysWOW64\nslookup.exe
                                              nslookup ransomware.bit ns2.corp-servers.ru
                                              2⤵
                                                PID:2420
                                              • C:\Windows\SysWOW64\nslookup.exe
                                                nslookup zonealarm.bit ns2.corp-servers.ru
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:1592
                                              • C:\Windows\SysWOW64\nslookup.exe
                                                nslookup ransomware.bit ns1.corp-servers.ru
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:2192
                                              • C:\Windows\SysWOW64\nslookup.exe
                                                nslookup zonealarm.bit ns1.corp-servers.ru
                                                2⤵
                                                  PID:2800
                                                • C:\Windows\SysWOW64\nslookup.exe
                                                  nslookup ransomware.bit ns2.corp-servers.ru
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2056
                                                • C:\Windows\SysWOW64\nslookup.exe
                                                  nslookup zonealarm.bit ns2.corp-servers.ru
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2724
                                                • C:\Windows\SysWOW64\nslookup.exe
                                                  nslookup ransomware.bit ns1.corp-servers.ru
                                                  2⤵
                                                    PID:2332
                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                    nslookup zonealarm.bit ns1.corp-servers.ru
                                                    2⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2708
                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                    nslookup ransomware.bit ns2.corp-servers.ru
                                                    2⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2372
                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                    nslookup zonealarm.bit ns2.corp-servers.ru
                                                    2⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2604
                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                    nslookup ransomware.bit ns1.corp-servers.ru
                                                    2⤵
                                                      PID:2640
                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                      nslookup zonealarm.bit ns1.corp-servers.ru
                                                      2⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2660
                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                      nslookup ransomware.bit ns2.corp-servers.ru
                                                      2⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1952
                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                      nslookup zonealarm.bit ns2.corp-servers.ru
                                                      2⤵
                                                        PID:2872
                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                        nslookup ransomware.bit ns1.corp-servers.ru
                                                        2⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1572
                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                        nslookup zonealarm.bit ns1.corp-servers.ru
                                                        2⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2884
                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                        nslookup ransomware.bit ns2.corp-servers.ru
                                                        2⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2940
                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                        nslookup zonealarm.bit ns2.corp-servers.ru
                                                        2⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1960
                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                        nslookup ransomware.bit ns1.corp-servers.ru
                                                        2⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1808
                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                        nslookup zonealarm.bit ns1.corp-servers.ru
                                                        2⤵
                                                          PID:1812
                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                          nslookup ransomware.bit ns2.corp-servers.ru
                                                          2⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1696
                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                          nslookup zonealarm.bit ns2.corp-servers.ru
                                                          2⤵
                                                            PID:2140
                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                            nslookup ransomware.bit ns1.corp-servers.ru
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2996
                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                            nslookup zonealarm.bit ns1.corp-servers.ru
                                                            2⤵
                                                              PID:2088
                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                              nslookup ransomware.bit ns2.corp-servers.ru
                                                              2⤵
                                                                PID:2104
                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                nslookup zonealarm.bit ns2.corp-servers.ru
                                                                2⤵
                                                                  PID:1820
                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                  nslookup ransomware.bit ns1.corp-servers.ru
                                                                  2⤵
                                                                    PID:632
                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                    nslookup zonealarm.bit ns1.corp-servers.ru
                                                                    2⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:628
                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                    nslookup ransomware.bit ns2.corp-servers.ru
                                                                    2⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:1760
                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                    nslookup zonealarm.bit ns2.corp-servers.ru
                                                                    2⤵
                                                                      PID:2648
                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                      nslookup ransomware.bit ns1.corp-servers.ru
                                                                      2⤵
                                                                        PID:1028
                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                        nslookup zonealarm.bit ns1.corp-servers.ru
                                                                        2⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:1552
                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                        nslookup ransomware.bit ns2.corp-servers.ru
                                                                        2⤵
                                                                          PID:1676
                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                          nslookup zonealarm.bit ns2.corp-servers.ru
                                                                          2⤵
                                                                            PID:1700
                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                            nslookup ransomware.bit ns1.corp-servers.ru
                                                                            2⤵
                                                                              PID:2176
                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                              nslookup zonealarm.bit ns1.corp-servers.ru
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2468
                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                              nslookup ransomware.bit ns2.corp-servers.ru
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1516
                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                              nslookup zonealarm.bit ns2.corp-servers.ru
                                                                              2⤵
                                                                                PID:2248
                                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                                nslookup ransomware.bit ns1.corp-servers.ru
                                                                                2⤵
                                                                                  PID:2396
                                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                                  nslookup zonealarm.bit ns1.corp-servers.ru
                                                                                  2⤵
                                                                                    PID:892
                                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                                    nslookup ransomware.bit ns2.corp-servers.ru
                                                                                    2⤵
                                                                                      PID:1600
                                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                                      nslookup zonealarm.bit ns2.corp-servers.ru
                                                                                      2⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2796
                                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                                      nslookup ransomware.bit ns1.corp-servers.ru
                                                                                      2⤵
                                                                                        PID:2808
                                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                                        nslookup zonealarm.bit ns1.corp-servers.ru
                                                                                        2⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:3056
                                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                                        nslookup ransomware.bit ns2.corp-servers.ru
                                                                                        2⤵
                                                                                          PID:2904
                                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                                          nslookup zonealarm.bit ns2.corp-servers.ru
                                                                                          2⤵
                                                                                            PID:2700
                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                            nslookup ransomware.bit ns1.corp-servers.ru
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2632
                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                            nslookup zonealarm.bit ns1.corp-servers.ru
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2780
                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                            nslookup ransomware.bit ns2.corp-servers.ru
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2612
                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                            nslookup zonealarm.bit ns2.corp-servers.ru
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:1280
                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                            nslookup ransomware.bit ns1.corp-servers.ru
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2652
                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                            nslookup zonealarm.bit ns1.corp-servers.ru
                                                                                            2⤵
                                                                                              PID:1620
                                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                                              nslookup ransomware.bit ns2.corp-servers.ru
                                                                                              2⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:692
                                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                                              nslookup zonealarm.bit ns2.corp-servers.ru
                                                                                              2⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:1272
                                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                                              nslookup ransomware.bit ns1.corp-servers.ru
                                                                                              2⤵
                                                                                                PID:2856
                                                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                                                nslookup zonealarm.bit ns1.corp-servers.ru
                                                                                                2⤵
                                                                                                  PID:2868
                                                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                                                  nslookup ransomware.bit ns2.corp-servers.ru
                                                                                                  2⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:2972
                                                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                                                  nslookup zonealarm.bit ns2.corp-servers.ru
                                                                                                  2⤵
                                                                                                    PID:1212
                                                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                                                    nslookup ransomware.bit ns1.corp-servers.ru
                                                                                                    2⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:1844
                                                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                                                    nslookup zonealarm.bit ns1.corp-servers.ru
                                                                                                    2⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:1972
                                                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                                                    nslookup ransomware.bit ns2.corp-servers.ru
                                                                                                    2⤵
                                                                                                      PID:2132
                                                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                                                      nslookup zonealarm.bit ns2.corp-servers.ru
                                                                                                      2⤵
                                                                                                        PID:3036
                                                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                                                        nslookup ransomware.bit ns1.corp-servers.ru
                                                                                                        2⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:536
                                                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                                                        nslookup zonealarm.bit ns1.corp-servers.ru
                                                                                                        2⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:1316
                                                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                                                        nslookup ransomware.bit ns2.corp-servers.ru
                                                                                                        2⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:2688
                                                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                                                        nslookup zonealarm.bit ns2.corp-servers.ru
                                                                                                        2⤵
                                                                                                          PID:2072
                                                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                                                          nslookup ransomware.bit ns1.corp-servers.ru
                                                                                                          2⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:2592
                                                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                                                          nslookup zonealarm.bit ns1.corp-servers.ru
                                                                                                          2⤵
                                                                                                            PID:1360
                                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                                            nslookup ransomware.bit ns2.corp-servers.ru
                                                                                                            2⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:944
                                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                                            nslookup zonealarm.bit ns2.corp-servers.ru
                                                                                                            2⤵
                                                                                                              PID:2220
                                                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                                                              nslookup ransomware.bit ns1.corp-servers.ru
                                                                                                              2⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:2256
                                                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                                                              nslookup zonealarm.bit ns1.corp-servers.ru
                                                                                                              2⤵
                                                                                                                PID:1116
                                                                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                nslookup ransomware.bit ns2.corp-servers.ru
                                                                                                                2⤵
                                                                                                                  PID:2404
                                                                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                  nslookup zonealarm.bit ns2.corp-servers.ru
                                                                                                                  2⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:568
                                                                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                  nslookup ransomware.bit ns1.corp-servers.ru
                                                                                                                  2⤵
                                                                                                                    PID:580
                                                                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                    nslookup zonealarm.bit ns1.corp-servers.ru
                                                                                                                    2⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:2044
                                                                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                    nslookup ransomware.bit ns2.corp-servers.ru
                                                                                                                    2⤵
                                                                                                                      PID:896
                                                                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                      nslookup zonealarm.bit ns2.corp-servers.ru
                                                                                                                      2⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:1532
                                                                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                      nslookup ransomware.bit ns1.corp-servers.ru
                                                                                                                      2⤵
                                                                                                                        PID:1172

                                                                                                                    Network

                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads

                                                                                                                    • memory/1936-1-0x00000000000E0000-0x00000000000F7000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      92KB

                                                                                                                    • memory/1936-0-0x00000000008B0000-0x00000000008D7CC4-memory.dmp

                                                                                                                      Filesize

                                                                                                                      159KB

                                                                                                                    • memory/1936-2-0x00000000008C2000-0x00000000008D5000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      76KB

                                                                                                                    • memory/1936-3-0x00000000008B0000-0x00000000008D7CC4-memory.dmp

                                                                                                                      Filesize

                                                                                                                      159KB