Overview

overview

10

Static

static

10

3ba5152a38...ad.exe

windows7_x64

6

3ba5152a38...ad.exe

windows10-2004_x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3ba5152a38dc00935f95cf0e5bcc8ff6e05b8348a922e3d6618d4559be5b39ad

  • Size

    70KB

  • Sample

    220703-l5n8gaggg7

  • MD5

    c604ccb2ab7e844db65546474321b179

  • SHA1

    d2107520142e5ec3e7f477dbb4e6f17ee2fb00e6

  • SHA256

    3ba5152a38dc00935f95cf0e5bcc8ff6e05b8348a922e3d6618d4559be5b39ad

  • SHA512

    9af45c4d9f6fbd209b7922b69c0a5142ee08ab3ff4b9d73911506fc968b553668eeca1b9db6e84610875d47b8ede38b461829a71faf585f8c649d2f10c355734

Score
10/10
gandcrabpersistence

Malware Config

Targets

    • Target

      3ba5152a38dc00935f95cf0e5bcc8ff6e05b8348a922e3d6618d4559be5b39ad

    • Size

      70KB

    • MD5

      c604ccb2ab7e844db65546474321b179

    • SHA1

      d2107520142e5ec3e7f477dbb4e6f17ee2fb00e6

    • SHA256

      3ba5152a38dc00935f95cf0e5bcc8ff6e05b8348a922e3d6618d4559be5b39ad

    • SHA512

      9af45c4d9f6fbd209b7922b69c0a5142ee08ab3ff4b9d73911506fc968b553668eeca1b9db6e84610875d47b8ede38b461829a71faf585f8c649d2f10c355734

    Score
    6/10
    persistence

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks