Analysis
-
max time kernel
134s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-11-2020 02:27
Static task
static1
Behavioral task
behavioral1
Sample
GandCrab.bin.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
GandCrab.bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
GandCrab.bin.exe
-
Size
183KB
-
MD5
07fadb006486953439ce0092651fd7a6
-
SHA1
e42431d37561cc695de03b85e8e99c9e31321742
-
SHA256
d77378dcc42b912e514d3bd4466cdda050dda9b57799a6c97f70e8489dd8c8d0
-
SHA512
5b09a07371bb5350b22c78aa3e7e673ba61ce72a964e072749a4633e2c15f416c05953cc6e6f6c586df010aa7f2c9c0ab87a014e4f732e5fdb2d58778a1fb437
Score
10/10
Malware Config
Signatures
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
GandCrab.bin.exedescription ioc Process File renamed C:\Users\Admin\Pictures\SwitchCompare.tif => C:\Users\Admin\Pictures\SwitchCompare.tif.ogcaa GandCrab.bin.exe File renamed C:\Users\Admin\Pictures\TraceImport.png => C:\Users\Admin\Pictures\TraceImport.png.ogcaa GandCrab.bin.exe File opened for modification C:\Users\Admin\Pictures\ApproveRedo.tiff GandCrab.bin.exe File renamed C:\Users\Admin\Pictures\ApproveRedo.tiff => C:\Users\Admin\Pictures\ApproveRedo.tiff.ogcaa GandCrab.bin.exe File renamed C:\Users\Admin\Pictures\OutDismount.crw => C:\Users\Admin\Pictures\OutDismount.crw.ogcaa GandCrab.bin.exe File renamed C:\Users\Admin\Pictures\RevokeEdit.crw => C:\Users\Admin\Pictures\RevokeEdit.crw.ogcaa GandCrab.bin.exe -
Drops startup file 2 IoCs
Processes:
GandCrab.bin.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\OGCAA-DECRYPT.html GandCrab.bin.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\94ce57af94ce50434c.lock GandCrab.bin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
GandCrab.bin.exedescription ioc Process File opened (read-only) \??\V: GandCrab.bin.exe File opened (read-only) \??\B: GandCrab.bin.exe File opened (read-only) \??\P: GandCrab.bin.exe File opened (read-only) \??\T: GandCrab.bin.exe File opened (read-only) \??\O: GandCrab.bin.exe File opened (read-only) \??\Q: GandCrab.bin.exe File opened (read-only) \??\W: GandCrab.bin.exe File opened (read-only) \??\A: GandCrab.bin.exe File opened (read-only) \??\F: GandCrab.bin.exe File opened (read-only) \??\M: GandCrab.bin.exe File opened (read-only) \??\I: GandCrab.bin.exe File opened (read-only) \??\J: GandCrab.bin.exe File opened (read-only) \??\K: GandCrab.bin.exe File opened (read-only) \??\L: GandCrab.bin.exe File opened (read-only) \??\N: GandCrab.bin.exe File opened (read-only) \??\E: GandCrab.bin.exe File opened (read-only) \??\G: GandCrab.bin.exe File opened (read-only) \??\H: GandCrab.bin.exe File opened (read-only) \??\S: GandCrab.bin.exe File opened (read-only) \??\X: GandCrab.bin.exe File opened (read-only) \??\Z: GandCrab.bin.exe File opened (read-only) \??\R: GandCrab.bin.exe File opened (read-only) \??\U: GandCrab.bin.exe File opened (read-only) \??\Y: GandCrab.bin.exe -
Modifies service 2 TTPs 4 IoCs
Processes:
vssvc.exedescription ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
GandCrab.bin.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\pidor.bmp" GandCrab.bin.exe -
Drops file in Program Files directory 15 IoCs
Processes:
GandCrab.bin.exedescription ioc Process File opened for modification C:\Program Files\GetSync.docx GandCrab.bin.exe File opened for modification C:\Program Files\SkipUnprotect.ex_ GandCrab.bin.exe File created C:\Program Files (x86)\OGCAA-DECRYPT.html GandCrab.bin.exe File opened for modification C:\Program Files\GrantResolve.odp GandCrab.bin.exe File opened for modification C:\Program Files\TestJoin.wma GandCrab.bin.exe File opened for modification C:\Program Files\UnprotectClear.vsx GandCrab.bin.exe File opened for modification C:\Program Files\DismountResize.aiff GandCrab.bin.exe File opened for modification C:\Program Files\RepairExit.vsdm GandCrab.bin.exe File opened for modification C:\Program Files\ResumeResize.vdw GandCrab.bin.exe File opened for modification C:\Program Files\UnprotectExpand.mpeg GandCrab.bin.exe File created C:\Program Files\OGCAA-DECRYPT.html GandCrab.bin.exe File created C:\Program Files\94ce57af94ce50434c.lock GandCrab.bin.exe File opened for modification C:\Program Files\DisconnectRedo.vbe GandCrab.bin.exe File opened for modification C:\Program Files\RepairRequest.7z GandCrab.bin.exe File created C:\Program Files (x86)\94ce57af94ce50434c.lock GandCrab.bin.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
GandCrab.bin.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GandCrab.bin.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier GandCrab.bin.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GandCrab.bin.exe -
Processes:
GandCrab.bin.exedescription ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e GandCrab.bin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 GandCrab.bin.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
GandCrab.bin.exepid Process 508 GandCrab.bin.exe 508 GandCrab.bin.exe 508 GandCrab.bin.exe 508 GandCrab.bin.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
wmic.exevssvc.exedescription pid Process Token: SeIncreaseQuotaPrivilege 2196 wmic.exe Token: SeSecurityPrivilege 2196 wmic.exe Token: SeTakeOwnershipPrivilege 2196 wmic.exe Token: SeLoadDriverPrivilege 2196 wmic.exe Token: SeSystemProfilePrivilege 2196 wmic.exe Token: SeSystemtimePrivilege 2196 wmic.exe Token: SeProfSingleProcessPrivilege 2196 wmic.exe Token: SeIncBasePriorityPrivilege 2196 wmic.exe Token: SeCreatePagefilePrivilege 2196 wmic.exe Token: SeBackupPrivilege 2196 wmic.exe Token: SeRestorePrivilege 2196 wmic.exe Token: SeShutdownPrivilege 2196 wmic.exe Token: SeDebugPrivilege 2196 wmic.exe Token: SeSystemEnvironmentPrivilege 2196 wmic.exe Token: SeRemoteShutdownPrivilege 2196 wmic.exe Token: SeUndockPrivilege 2196 wmic.exe Token: SeManageVolumePrivilege 2196 wmic.exe Token: 33 2196 wmic.exe Token: 34 2196 wmic.exe Token: 35 2196 wmic.exe Token: 36 2196 wmic.exe Token: SeIncreaseQuotaPrivilege 2196 wmic.exe Token: SeSecurityPrivilege 2196 wmic.exe Token: SeTakeOwnershipPrivilege 2196 wmic.exe Token: SeLoadDriverPrivilege 2196 wmic.exe Token: SeSystemProfilePrivilege 2196 wmic.exe Token: SeSystemtimePrivilege 2196 wmic.exe Token: SeProfSingleProcessPrivilege 2196 wmic.exe Token: SeIncBasePriorityPrivilege 2196 wmic.exe Token: SeCreatePagefilePrivilege 2196 wmic.exe Token: SeBackupPrivilege 2196 wmic.exe Token: SeRestorePrivilege 2196 wmic.exe Token: SeShutdownPrivilege 2196 wmic.exe Token: SeDebugPrivilege 2196 wmic.exe Token: SeSystemEnvironmentPrivilege 2196 wmic.exe Token: SeRemoteShutdownPrivilege 2196 wmic.exe Token: SeUndockPrivilege 2196 wmic.exe Token: SeManageVolumePrivilege 2196 wmic.exe Token: 33 2196 wmic.exe Token: 34 2196 wmic.exe Token: 35 2196 wmic.exe Token: 36 2196 wmic.exe Token: SeBackupPrivilege 2392 vssvc.exe Token: SeRestorePrivilege 2392 vssvc.exe Token: SeAuditPrivilege 2392 vssvc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
GandCrab.bin.exedescription pid Process procid_target PID 508 wrote to memory of 2196 508 GandCrab.bin.exe 79 PID 508 wrote to memory of 2196 508 GandCrab.bin.exe 79 PID 508 wrote to memory of 2196 508 GandCrab.bin.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\GandCrab.bin.exe"C:\Users\Admin\AppData\Local\Temp\GandCrab.bin.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Windows\SysWOW64\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2196
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:2392