ef1b2bfcc96ea784598e4b3767a95d2e3458947a38a9e72acc1429b3fcf268bd

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25-08-2023 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90f4d9485f345239140761faf794087e_gandcrab_JC.exe
Size

70KB
MD5

90f4d9485f345239140761faf794087e
SHA1

a0c9653e23a1eef38d0e131ac8853e826cfa574f
SHA256

ef1b2bfcc96ea784598e4b3767a95d2e3458947a38a9e72acc1429b3fcf268bd
SHA512

4ff596ba2c243ec2d58ad18f5ac167d39c364d380ebd8ad15dc28fd656975e64f33cacde3c12e6346b5e62060f2d4ee512c0127bdd05041ddce1f90d7f5bd157
SSDEEP

1536:bZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:ad5BJHMqqDL2/Ovvdr

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lxhcqotnzby = "C:\\Users\\Admin\\AppData\\Local\\Temp\\90f4d9485f345239140761faf794087e_gandcrab_JC.exe"	90f4d9485f345239140761faf794087e_gandcrab_JC.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
File opened (read-only)	\??\O:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
File opened (read-only)	\??\R:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
File opened (read-only)	\??\T:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
File opened (read-only)	\??\V:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
File opened (read-only)	\??\W:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
File opened (read-only)	\??\E:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
File opened (read-only)	\??\J:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
File opened (read-only)	\??\X:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
File opened (read-only)	\??\S:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
File opened (read-only)	\??\U:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
File opened (read-only)	\??\M:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
File opened (read-only)	\??\P:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
File opened (read-only)	\??\K:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
File opened (read-only)	\??\N:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
File opened (read-only)	\??\Y:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
File opened (read-only)	\??\H:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
File opened (read-only)	\??\I:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
File opened (read-only)	\??\G:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
File opened (read-only)	\??\Q:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
File opened (read-only)	\??\Z:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
File opened (read-only)	\??\A:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
File opened (read-only)	\??\B:	90f4d9485f345239140761faf794087e_gandcrab_JC.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2456	90f4d9485f345239140761faf794087e_gandcrab_JC.exe
2456	90f4d9485f345239140761faf794087e_gandcrab_JC.exe

C:\Users\Admin\AppData\Local\Temp\90f4d9485f345239140761faf794087e_gandcrab_JC.exe
"C:\Users\Admin\AppData\Local\Temp\90f4d9485f345239140761faf794087e_gandcrab_JC.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
PID:2456