Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
07-09-2023 14:12
General
-
Target
4fb989bc0ffe2ad50811ff1784f8bf4e1c1aaaee0001e0c8aeb2f8f83b065a00.exe
-
Size
349KB
-
MD5
eb7138741adc746f8953a3db50d9e235
-
SHA1
c0adbd63648052edacdf65f74ce1ce9701125570
-
SHA256
4fb989bc0ffe2ad50811ff1784f8bf4e1c1aaaee0001e0c8aeb2f8f83b065a00
-
SHA512
41d4a0aadbe055f6b22ead1bcc407a53e02075218e48aae18d2df5bf23f87fad0c8609725fa60e89de6fc67041acd41303c0505d1b88ddc06b7ed916a5981f8a
-
SSDEEP
6144:YPNS/+PNS/t7VggtOXOICLcF8t+JKrllVtqfLJC:YPPPiHcXOIFyqwjtqfLQ
Malware Config
Extracted
C:\MSOCache\OUBFQI-DECRYPT.txt
http://gandcrabmfe6mnef.onion/cc0c4e2b858daf20
Signatures
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (343) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 38 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies system certificate store 2 TTPs 9 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 44 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fb989bc0ffe2ad50811ff1784f8bf4e1c1aaaee0001e0c8aeb2f8f83b065a00.exe"C:\Users\Admin\AppData\Local\Temp\4fb989bc0ffe2ad50811ff1784f8bf4e1c1aaaee0001e0c8aeb2f8f83b065a00.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4fb989bc0ffe2ad50811ff1784f8bf4e1c1aaaee0001e0c8aeb2f8f83b065a00.exe"C:\Users\Admin\AppData\Local\Temp\4fb989bc0ffe2ad50811ff1784f8bf4e1c1aaaee0001e0c8aeb2f8f83b065a00.exe"2⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5585f32a1c3e4ba6d3d121364f1fb135f
SHA12273482eb3d84487b5b2e25e9318afff6026f19a
SHA256503a71e0d772a3cdbc7d1febc49a47b24438a2617f490f5dc0c4a65eb813a533
SHA512250466b2f15c59177ba8be3758796d69849d1bf7157973120b7767791b94942d3418879de619dfb7314f371aae0808b2d9c9796c34e3796cca523677033e7977
-
Filesize
344B
MD5483e73d4d410e44af1ab38efb46427b3
SHA13b683d8a18e8acaeb14a6599be8b2c7f30062d37
SHA256314e585ca1e01aa4833fc6ccd4e65205817b0b7d3bdce6419d5a09de431e641d
SHA512b8ce29ed86b3f7e09e6d23daa1fbbafed9de781f48f276c1b7e0f7a4b43eafde8d1be6cbf4c045c58f0dcb022dae3b174f66ca4813b1114c82bb9755b5084609
-
Filesize
344B
MD56a8ea1dbd57002bed85791e61d195f27
SHA18f83e7eb6440bed4b40f695f2c068417ae1f538d
SHA256d41bcfe8aeddb375f2eb08dc2b7d53acef6c2a214a284a0452a1a3a37774eaf0
SHA5126ff1896a9148c5aebf22472ec7de6d4dd1989d11af6568fdf68386489e936409927759b600565271907908db69acc82ded34d0502b057ed65e5ccd269f762674
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
6.9MB
-
Filesize
360KB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB