Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
17/02/2024, 23:34
General
-
Target
2024-02-17_abf4da7721ac448d94da8d59972f2366_gandcrab.exe
-
Size
70KB
-
MD5
abf4da7721ac448d94da8d59972f2366
-
SHA1
7375b1525ab9fd2d3345018809a4bc7cef1e3fe8
-
SHA256
084f7de01e490ecde749d62c2eb1b21ad1778a0b63da2d672696d4c37d381ed3
-
SHA512
079647aafe8eb2136f2164399179e8a9dd393100766472394d2e7470da226935b17d6ada29da98288253d2dca7d148b69659dc33a3cf5ffff6aa278abc886945
-
SSDEEP
1536:VZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:Ed5BJHMqqDL2/Ovvdr
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-17_abf4da7721ac448d94da8d59972f2366_gandcrab.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-17_abf4da7721ac448d94da8d59972f2366_gandcrab.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses