575765f70bb78fac7a0625b550e045d3df23528643f738823b59a17ab4b6972e

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2023 15:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
Size

70KB
MD5

2b36f31ee2951ae803ae6831e7e96177
SHA1

ec332c4cb628d46969c315317ca5036236dfbec0
SHA256

575765f70bb78fac7a0625b550e045d3df23528643f738823b59a17ab4b6972e
SHA512

554eaf09aa8178ed29aad1332f98f9c9816894c6f5f58ca4897e6a6868b20b9b9bfd9a64f4d4e1211c3441c9c681c77f8c7c504696917eef3fc3f82803a6b690
SSDEEP

1536:vZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:Gd5BJHMqqDL2/Ovvdr

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kesoefyjfnr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe"	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
File opened (read-only)	\??\A:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
File opened (read-only)	\??\M:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
File opened (read-only)	\??\O:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
File opened (read-only)	\??\X:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
File opened (read-only)	\??\Z:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
File opened (read-only)	\??\J:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
File opened (read-only)	\??\T:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
File opened (read-only)	\??\W:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
File opened (read-only)	\??\N:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
File opened (read-only)	\??\S:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
File opened (read-only)	\??\U:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
File opened (read-only)	\??\E:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
File opened (read-only)	\??\G:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
File opened (read-only)	\??\H:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
File opened (read-only)	\??\L:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
File opened (read-only)	\??\P:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
File opened (read-only)	\??\Q:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
File opened (read-only)	\??\V:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
File opened (read-only)	\??\Y:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
File opened (read-only)	\??\B:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
File opened (read-only)	\??\I:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
File opened (read-only)	\??\K:	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5016	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
5016	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
5016	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
5016	2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe

C:\Users\Admin\AppData\Local\Temp\2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2b36f31ee2951ae803ae6831e7e96177_gandcrab_JC.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
PID:5016