Analysis
- max time kernel
149s - max time network
133s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/04/2026, 12:20
Behavioral task
behavioral1
Sample
tf-march2011-windows.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
tf-march2011-windows.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target tf-march2011-windows.exe
- Size 2.0MB
- Sample260404-phyeeabz8n
- SHA256 e57c55a7d8a7b9977a85f8540e61b229cef443c0ec1f0ad66a9fa07b5fc5d1d5
- MD5 c228b035a3604b74f698272dcf7c50a8
- SHA1 b9ba275f1441a374c69cf6b93f5ef6a8bb2816a7
- SHA512 4c3970493cc1fb07a57604ab0b5d94aca9f049cb27b23b6f72c4167260039f0dacd9f8c6fbed40937ad625d6001806a10d30caeaef823b0b315f2476f50536b5
- SSDEEP 49152:nTuRUF9hMdONNy52gW6dVrwzowF0mVHhd1FbH3vZ/E:nTj3NNyZLV+bCsz1pH3BE
- TLSH T119A533ECA93ADE57C1F24736140A17AFBBB397605A52811136273E8EE8F9317DE34442
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
- Gandcrab family
- Loads dropped DLL 1 IoCs
pid Process 4512 tf-march2011-windows.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$62.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Examples\example_data tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$25.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\RedrawTree$1.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\RedrawTree$6.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\RedrawTree$7.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Images\nextcard.gif tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Manual\tf-march2011-manual.pdf tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\ExtractFromReport$5.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$13.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$58.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$84.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Examples\example_distances tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Images\icon16.gif tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\DistancePreviewDialog$1.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\License$3.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$60.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$102.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\ComposedParameterDialog$2.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\Editor$1.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\NameCompatibility.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$114.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\SampleStatistics$1.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\SitewiseLikelihoods$2.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Images\detect.gif tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\FindReplace$5.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\GenerateStartTrees.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$15.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$32.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\Treefinder$1.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Images\paste.gif tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Images\problem.gif tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Kernel\htests.tl tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$101.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$10.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\JoinReports$1.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\License$1.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\TestTopologies.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Images\prevpage.gif tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Kernel\plot.tl tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$48.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$79.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$85.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Examples\example_calibration_2 tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\ChooseDataDialog.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\Treefinder$57.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$9.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\ProblemText.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Examples\example_model tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Images\propose.gif tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\ComposedParameterDialog$1.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$125.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$11.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$161.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$69.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PositionDisplay.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\Reconstruct$7.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\RedrawTree$4.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\Treefinder$11.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\Treefinder$35.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Images\icon.png tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$110.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$158.class tf-march2011-windows.exe File created C:\Program Files (x86)\Treefinder\Classes\PSRenderer$41.class tf-march2011-windows.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tf-march2011-windows.exe - NSIS installer 1 IoCs
resource yara_rule behavioral2/files/0x001900000002b397-516.dat nsis_installer_2
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Treefinder\treefinder.exe
- Size 34KB
- SHA256 999b5cada72492038fc7a92b13545956a7107c7431595f2f2465b57eeb65a8dd
- MD5 05b355eb57478b55ae12c10ca3b853c4
- SHA1 b412bcfc7ee9ffab210776f748f262b09ec95e9e
- SHA512 1d4523cbacaee31019b6259bd9661009bb8443562e89b6449c4c89d3cd371eb2c299ea6fab348238abdd9873f18cc97c2a33695b33778f8c3176e050909adc4e
- SSDEEP 768:uHJd0TpH2+bQ2dUWVX9Hfv1JMWmtLEJOyuBxG0D3mjfS3XJ9KVty:upgpHzb9dZVX9fHMvG0D3XJ8g
- TLSH T18DF29E1B66C089B7D5D24A310577EB7DE7B7CEC502562A431BA43F6F3D32893C919282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsk6AEB.tmp\UserInfo.dll
- Size 4KB
- SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
- MD5 7579ade7ae1747a31960a228ce02e666
- SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
- SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
- TLSH T1E181857B92E50DF3D0A447BB00D71CE70226DC701769411E89472A8924E572BFE2EB06
- MD5 SHA1 SHA512 TLSH