Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/04/2026, 12:12
Behavioral task
behavioral1
Sample
tf-march2011-windows.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
tf-march2011-windows.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target tf-march2011-windows.exe
- Size 2.0MB
- Sample260404-pdbpvafx2s
- SHA256 e57c55a7d8a7b9977a85f8540e61b229cef443c0ec1f0ad66a9fa07b5fc5d1d5
- MD5 c228b035a3604b74f698272dcf7c50a8
- SHA1 b9ba275f1441a374c69cf6b93f5ef6a8bb2816a7
- SHA512 4c3970493cc1fb07a57604ab0b5d94aca9f049cb27b23b6f72c4167260039f0dacd9f8c6fbed40937ad625d6001806a10d30caeaef823b0b315f2476f50536b5
- SSDEEP 49152:nTuRUF9hMdONNy52gW6dVrwzowF0mVHhd1FbH3vZ/E:nTj3NNyZLV+bCsz1pH3BE
- TLSH T119A533ECA93ADE57C1F24736140A17AFBBB397605A52811136273E8EE8F9317DE34442
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
- Gandcrab family
- Loads dropped DLL 1 IoCs
pid Process 4804 tf-march2011-windows.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$122.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\Bootstrap$2.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\ChooseDataDialog$1.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSNumber.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$113.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$17.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\Decoder.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\FindReplace$6.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$140.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$25.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\Treefinder$42.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$104.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$169.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$81.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PDialog$4.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$34.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Kernel\samplestat.tl tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\FindReplace.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\GenerateStartTrees.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\NameCompatibility.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$159.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\ProposeModel$4.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\SitewiseRates$5.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Kernel\kernel.tl tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Test\reconstr\phyml.tl tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\GenerateStartTrees$2.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$90.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$99.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Images\prevpage.gif tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$37.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\Page.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$76.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$77.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\Treefinder$20.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$15.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$151.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$66.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\Treefinder$33.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$45.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\Treefinder$17.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\Treefinder$49.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\Treefinder$8.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\YesNo$2.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Images\undo.gif tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$56.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\RedrawTree$3.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\Treefinder$21.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$134.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$16.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$161.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$137.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$84.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Test\reconstr\puzzle.tl tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$114.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$150.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\Model1.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$127.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$39.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$59.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$89.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\SequenceOrderDialog$2.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\Treefinder$14.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\Treefinder$36.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\BuildDistanceTree$2.class tf-march2011-windows.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tf-march2011-windows.exe - NSIS installer 1 IoCs
resource yara_rule behavioral2/files/0x001900000002b48b-516.dat nsis_installer_2
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Treefinder\treefinder.exe
- Size 34KB
- SHA256 999b5cada72492038fc7a92b13545956a7107c7431595f2f2465b57eeb65a8dd
- MD5 05b355eb57478b55ae12c10ca3b853c4
- SHA1 b412bcfc7ee9ffab210776f748f262b09ec95e9e
- SHA512 1d4523cbacaee31019b6259bd9661009bb8443562e89b6449c4c89d3cd371eb2c299ea6fab348238abdd9873f18cc97c2a33695b33778f8c3176e050909adc4e
- SSDEEP 768:uHJd0TpH2+bQ2dUWVX9Hfv1JMWmtLEJOyuBxG0D3mjfS3XJ9KVty:upgpHzb9dZVX9fHMvG0D3XJ8g
- TLSH T18DF29E1B66C089B7D5D24A310577EB7DE7B7CEC502562A431BA43F6F3D32893C919282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsl52C0.tmp\UserInfo.dll
- Size 4KB
- SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
- MD5 7579ade7ae1747a31960a228ce02e666
- SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
- SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
- TLSH T1E181857B92E50DF3D0A447BB00D71CE70226DC701769411E89472A8924E572BFE2EB06
- MD5 SHA1 SHA512 TLSH