Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-03-2024 12:57

General

  • Target

    malware-samples-master/Ransomware/Grandcrab/grandcab.exe

  • Size

    484KB

  • MD5

    97a449fed7d800a8a635592605ff8a67

  • SHA1

    2f339d8b2edb7c07126d9a3c37effe14966817c5

  • SHA256

    233437b647f9482a8a3ba51d0af69039bb58fb48609704a39db1f709a0e6aca6

  • SHA512

    85b4b260b801c54927f7b985d5f9fb891e44e5f72f9dcf9656684f8872339480ded94b4f3ba44d71fa491b88243f99155e3ecc7b3005fb5fbe24b1d10f47e4c3

  • SSDEEP

    12288:hEm67VkaivvtYku9hoVw7G/znXoABEg6s0u1Tw:dEivv+bGuuznXONq10

Malware Config

Signatures

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Program crash 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\malware-samples-master\Ransomware\Grandcrab\grandcab.exe
    "C:\Users\Admin\AppData\Local\Temp\malware-samples-master\Ransomware\Grandcrab\grandcab.exe"
    1⤵
    • Enumerates connected drives
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:4120
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 908
      2⤵
      • Program crash
      PID:3092
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 928
      2⤵
      • Program crash
      PID:3980
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4120 -ip 4120
    1⤵
      PID:804
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4120 -ip 4120
      1⤵
        PID:3004

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4120-0-0x0000000000660000-0x000000000066C000-memory.dmp

        Filesize

        48KB

      • memory/4120-1-0x0000000000670000-0x0000000000671000-memory.dmp

        Filesize

        4KB

      • memory/4120-2-0x0000000000660000-0x000000000066C000-memory.dmp

        Filesize

        48KB

      • memory/4120-3-0x0000000000670000-0x0000000000671000-memory.dmp

        Filesize

        4KB

      • memory/4120-4-0x0000000000670000-0x0000000000671000-memory.dmp

        Filesize

        4KB

      • memory/4120-5-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4120-8-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB