Analysis
-
max time kernel
142s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
08-07-2022 04:41
Static task
static1
Behavioral task
behavioral1
Sample
41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe
Resource
win10v2004-20220414-en
General
-
Target
41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe
-
Size
231KB
-
MD5
1d364a0c31c32d46b5efe2598125818f
-
SHA1
11404f54bd4a3168a152b9af177f13bc481fa576
-
SHA256
41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf
-
SHA512
3e39a071666b0f6c00c86a445e401898b22bf2de99e8c632a89032364620acef8bc016dce0bd522172421f1b97197ef7e673c4e840b41c37ca4a029753c82fe8
Malware Config
Signatures
-
GandCrab payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3332-132-0x0000000000400000-0x0000000000B49000-memory.dmp family_gandcrab behavioral2/memory/3332-134-0x0000000000CB0000-0x0000000000CC7000-memory.dmp family_gandcrab behavioral2/memory/3332-136-0x0000000000400000-0x0000000000B49000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Drops file in Windows directory 1 IoCs
Processes:
41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exedescription ioc process File opened for modification C:\Windows\win.ini 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4176 3332 WerFault.exe 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe -
Checks SCSI registry key(s) 3 TTPs 10 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
Processes:
41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exedescription pid process Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe Token: SeLoadDriverPrivilege 3332 41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe"C:\Users\Admin\AppData\Local\Temp\41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe"1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 5562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3332 -ip 33321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3332-130-0x0000000000DDE000-0x0000000000DFA000-memory.dmpFilesize
112KB
-
memory/3332-131-0x0000000000400000-0x0000000000B49000-memory.dmpFilesize
7.3MB
-
memory/3332-132-0x0000000000400000-0x0000000000B49000-memory.dmpFilesize
7.3MB
-
memory/3332-134-0x0000000000CB0000-0x0000000000CC7000-memory.dmpFilesize
92KB
-
memory/3332-135-0x0000000000DDE000-0x0000000000DFA000-memory.dmpFilesize
112KB
-
memory/3332-136-0x0000000000400000-0x0000000000B49000-memory.dmpFilesize
7.3MB