51581f0711464b1af9f9d2da2d3431a88776c6caa7d9bb1d80e50a4b447b9796

Analysis

max time kernel
88s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2023, 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gandcrab.exe
Size

70KB
MD5

53c39e4036f845fd7caa0e427bcfdb5f
SHA1

b14464cd6b60cf600b90b2c0a2c5acf0458ef0e2
SHA256

b1b9328574aaa69341e9b3ce07790d7d506106619443317e71d3921ce6769f76
SHA512

561f1b99602e18306e163e8943d7b2286c0bd50e42c591729ceda3eef0528a6ee13f6d6a9eff2a3574617f6152113247e956e41a0839e6a044a9d9c455af2c68
SSDEEP

1536:/ZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:Wd5BJHMqqDL2/Ovvdr

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\yiidjqeurjb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gandcrab.exe"	gandcrab.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	gandcrab.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	gandcrab.exe
File opened (read-only)	\??\F:	gandcrab.exe
File opened (read-only)	\??\H:	gandcrab.exe
File opened (read-only)	\??\I:	gandcrab.exe
File opened (read-only)	\??\L:	gandcrab.exe
File opened (read-only)	\??\N:	gandcrab.exe
File opened (read-only)	\??\O:	gandcrab.exe
File opened (read-only)	\??\A:	gandcrab.exe
File opened (read-only)	\??\Z:	gandcrab.exe
File opened (read-only)	\??\J:	gandcrab.exe
File opened (read-only)	\??\P:	gandcrab.exe
File opened (read-only)	\??\Q:	gandcrab.exe
File opened (read-only)	\??\V:	gandcrab.exe
File opened (read-only)	\??\X:	gandcrab.exe
File opened (read-only)	\??\Y:	gandcrab.exe
File opened (read-only)	\??\E:	gandcrab.exe
File opened (read-only)	\??\K:	gandcrab.exe
File opened (read-only)	\??\M:	gandcrab.exe
File opened (read-only)	\??\R:	gandcrab.exe
File opened (read-only)	\??\S:	gandcrab.exe
File opened (read-only)	\??\T:	gandcrab.exe
File opened (read-only)	\??\U:	gandcrab.exe
File opened (read-only)	\??\W:	gandcrab.exe
File opened (read-only)	\??\G:	gandcrab.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	gandcrab.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	gandcrab.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1508	gandcrab.exe
1508	gandcrab.exe
1508	gandcrab.exe
1508	gandcrab.exe

C:\Users\Admin\AppData\Local\Temp\gandcrab.exe
"C:\Users\Admin\AppData\Local\Temp\gandcrab.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads