Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/01/2025, 20:22

General

  • Target

    2025-01-27_289464682ffbab50ef170d7ec211e234_gandcrab.exe

  • Size

    97KB

  • MD5

    289464682ffbab50ef170d7ec211e234

  • SHA1

    3b33a7e5f5c7508ce921e74e65b26f356b7ef69b

  • SHA256

    4b52fdb64d00e8a232363483601649f8001da5c70155ae2628f4643d124451af

  • SHA512

    195fcd31c22fdb9552725d9bb6744a134d8196a9861506ca4a8bc684d74998223bb60a54ed2e6058aef232afb7e12fd64b440c9090610362c6a12bf8c65f4b29

  • SSDEEP

    1536:pZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAEMqqU+2bbbAV2/S2LNmHkD:VBounVyFHFMqqDL2/LgHkc2

Malware Config

Signatures

  • GandCrab payload 2 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • Gandcrab family
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-27_289464682ffbab50ef170d7ec211e234_gandcrab.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-27_289464682ffbab50ef170d7ec211e234_gandcrab.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2172
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.coin dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1492
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:860
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2784
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.coin dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2684
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2232
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2752
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.coin dns1.soprodns.ru
      2⤵
        PID:2608
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup nomoreransom.bit dns1.soprodns.ru
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2564
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup gandcrab.bit dns2.soprodns.ru
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2624
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup nomoreransom.coin dns2.soprodns.ru
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2996
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup nomoreransom.bit dns2.soprodns.ru
        2⤵
          PID:1808
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup gandcrab.bit dns1.soprodns.ru
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1948
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup nomoreransom.coin dns1.soprodns.ru
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2860
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup nomoreransom.bit dns1.soprodns.ru
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2444
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup gandcrab.bit dns2.soprodns.ru
          2⤵
          • System Location Discovery: System Language Discovery
          PID:868
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup nomoreransom.coin dns2.soprodns.ru
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1812
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup nomoreransom.bit dns2.soprodns.ru
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1528
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup gandcrab.bit dns1.soprodns.ru
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2868
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup nomoreransom.coin dns1.soprodns.ru
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2900
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup nomoreransom.bit dns1.soprodns.ru
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2908
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup gandcrab.bit dns2.soprodns.ru
          2⤵
            PID:2140
          • C:\Windows\SysWOW64\nslookup.exe
            nslookup nomoreransom.coin dns2.soprodns.ru
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2116
          • C:\Windows\SysWOW64\nslookup.exe
            nslookup nomoreransom.bit dns2.soprodns.ru
            2⤵
              PID:3040
            • C:\Windows\SysWOW64\nslookup.exe
              nslookup gandcrab.bit dns1.soprodns.ru
              2⤵
                PID:916
              • C:\Windows\SysWOW64\nslookup.exe
                nslookup nomoreransom.coin dns1.soprodns.ru
                2⤵
                • System Location Discovery: System Language Discovery
                PID:1940
              • C:\Windows\SysWOW64\nslookup.exe
                nslookup nomoreransom.bit dns1.soprodns.ru
                2⤵
                • System Location Discovery: System Language Discovery
                PID:552
              • C:\Windows\SysWOW64\nslookup.exe
                nslookup gandcrab.bit dns2.soprodns.ru
                2⤵
                • System Location Discovery: System Language Discovery
                PID:1856
              • C:\Windows\SysWOW64\nslookup.exe
                nslookup nomoreransom.coin dns2.soprodns.ru
                2⤵
                • System Location Discovery: System Language Discovery
                PID:2176
              • C:\Windows\SysWOW64\nslookup.exe
                nslookup nomoreransom.bit dns2.soprodns.ru
                2⤵
                • System Location Discovery: System Language Discovery
                PID:772
              • C:\Windows\SysWOW64\nslookup.exe
                nslookup gandcrab.bit dns1.soprodns.ru
                2⤵
                • System Location Discovery: System Language Discovery
                PID:836
              • C:\Windows\SysWOW64\nslookup.exe
                nslookup nomoreransom.coin dns1.soprodns.ru
                2⤵
                • System Location Discovery: System Language Discovery
                PID:1192
              • C:\Windows\SysWOW64\nslookup.exe
                nslookup nomoreransom.bit dns1.soprodns.ru
                2⤵
                • System Location Discovery: System Language Discovery
                PID:2236
              • C:\Windows\SysWOW64\nslookup.exe
                nslookup gandcrab.bit dns2.soprodns.ru
                2⤵
                • System Location Discovery: System Language Discovery
                PID:1556
              • C:\Windows\SysWOW64\nslookup.exe
                nslookup nomoreransom.coin dns2.soprodns.ru
                2⤵
                • System Location Discovery: System Language Discovery
                PID:2380
              • C:\Windows\SysWOW64\nslookup.exe
                nslookup nomoreransom.bit dns2.soprodns.ru
                2⤵
                  PID:2300
                • C:\Windows\SysWOW64\nslookup.exe
                  nslookup gandcrab.bit dns1.soprodns.ru
                  2⤵
                    PID:1300
                  • C:\Windows\SysWOW64\nslookup.exe
                    nslookup nomoreransom.coin dns1.soprodns.ru
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:2024
                  • C:\Windows\SysWOW64\nslookup.exe
                    nslookup nomoreransom.bit dns1.soprodns.ru
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:1156
                  • C:\Windows\SysWOW64\nslookup.exe
                    nslookup gandcrab.bit dns2.soprodns.ru
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:1104
                  • C:\Windows\SysWOW64\nslookup.exe
                    nslookup nomoreransom.coin dns2.soprodns.ru
                    2⤵
                      PID:2712
                    • C:\Windows\SysWOW64\nslookup.exe
                      nslookup nomoreransom.bit dns2.soprodns.ru
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:2204
                    • C:\Windows\SysWOW64\nslookup.exe
                      nslookup gandcrab.bit dns1.soprodns.ru
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:2596
                    • C:\Windows\SysWOW64\nslookup.exe
                      nslookup nomoreransom.coin dns1.soprodns.ru
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:2880
                    • C:\Windows\SysWOW64\nslookup.exe
                      nslookup nomoreransom.bit dns1.soprodns.ru
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:2696
                    • C:\Windows\SysWOW64\nslookup.exe
                      nslookup gandcrab.bit dns2.soprodns.ru
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:2672
                    • C:\Windows\SysWOW64\nslookup.exe
                      nslookup nomoreransom.coin dns2.soprodns.ru
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:2572
                    • C:\Windows\SysWOW64\nslookup.exe
                      nslookup nomoreransom.bit dns2.soprodns.ru
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:548
                    • C:\Windows\SysWOW64\nslookup.exe
                      nslookup gandcrab.bit dns1.soprodns.ru
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:2500
                    • C:\Windows\SysWOW64\nslookup.exe
                      nslookup nomoreransom.coin dns1.soprodns.ru
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:2524
                    • C:\Windows\SysWOW64\nslookup.exe
                      nslookup nomoreransom.bit dns1.soprodns.ru
                      2⤵
                        PID:2076
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup gandcrab.bit dns2.soprodns.ru
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:1320
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup nomoreransom.coin dns2.soprodns.ru
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:1164
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup nomoreransom.bit dns2.soprodns.ru
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:304
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup gandcrab.bit dns1.soprodns.ru
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:2016
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup nomoreransom.coin dns1.soprodns.ru
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:2804
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup nomoreransom.bit dns1.soprodns.ru
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:2660
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup gandcrab.bit dns2.soprodns.ru
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:600
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup nomoreransom.coin dns2.soprodns.ru
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:2120
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup nomoreransom.bit dns2.soprodns.ru
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:3036
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup gandcrab.bit dns1.soprodns.ru
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:2928
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup nomoreransom.coin dns1.soprodns.ru
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:1392
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup nomoreransom.bit dns1.soprodns.ru
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:1972
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup gandcrab.bit dns2.soprodns.ru
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:1516
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup nomoreransom.coin dns2.soprodns.ru
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:1704
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup nomoreransom.bit dns2.soprodns.ru
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:892
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup gandcrab.bit dns1.soprodns.ru
                        2⤵
                          PID:932
                        • C:\Windows\SysWOW64\nslookup.exe
                          nslookup nomoreransom.coin dns1.soprodns.ru
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:2656
                        • C:\Windows\SysWOW64\nslookup.exe
                          nslookup nomoreransom.bit dns1.soprodns.ru
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:2296
                        • C:\Windows\SysWOW64\nslookup.exe
                          nslookup gandcrab.bit dns2.soprodns.ru
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:2376
                        • C:\Windows\SysWOW64\nslookup.exe
                          nslookup nomoreransom.coin dns2.soprodns.ru
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:944
                        • C:\Windows\SysWOW64\nslookup.exe
                          nslookup nomoreransom.bit dns2.soprodns.ru
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:1476
                        • C:\Windows\SysWOW64\nslookup.exe
                          nslookup gandcrab.bit dns1.soprodns.ru
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:1060
                        • C:\Windows\SysWOW64\nslookup.exe
                          nslookup nomoreransom.coin dns1.soprodns.ru
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:2072
                        • C:\Windows\SysWOW64\nslookup.exe
                          nslookup nomoreransom.bit dns1.soprodns.ru
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:268

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • memory/2172-0-0x000000000F0E0000-0x000000000F0FB000-memory.dmp

                        Filesize

                        108KB

                      • memory/2172-4-0x000000000F0E0000-0x000000000F0FB000-memory.dmp

                        Filesize

                        108KB