Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/03/2024, 06:54

General

  • Target

    2024-03-24_cf9d9b77e54454b72e5a256d2991682a_mafia.exe

  • Size

    316KB

  • MD5

    cf9d9b77e54454b72e5a256d2991682a

  • SHA1

    c8da50f27ae20954a3a3042fb85d90d2fe5df4b5

  • SHA256

    f75bc7022fea1ee8747c049cc71b9106abbd6745817d4d08db08230a88379fd4

  • SHA512

    fa949ce4408cdaa70764299ae7913383bca72379f0f5d6d6c548d706d5a6337abf5068d656236bf3b4c970df92f44446dbfe995fb9e0b4289f55e7ee4613d48c

  • SSDEEP

    6144:UvExNMO1UnseVgkV0xwvfxnhLTiusLe1740/:DTM0Unsna5mut40/

Malware Config

Signatures

  • GandCrab payload 2 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • Detects Reflective DLL injection artifacts 2 IoCs
  • Detects ransomware indicator 1 IoCs
  • Gandcrab Payload 2 IoCs
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookAW 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-24_cf9d9b77e54454b72e5a256d2991682a_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-24_cf9d9b77e54454b72e5a256d2991682a_mafia.exe"
    1⤵
    • Suspicious use of SetWindowsHookAW
    PID:4724
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 480
      2⤵
      • Program crash
      PID:456
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4724 -ip 4724
    1⤵
      PID:4900

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4724-0-0x00000000058F0000-0x000000000590B000-memory.dmp

            Filesize

            108KB

          • memory/4724-1-0x0000000000400000-0x0000000003B9F000-memory.dmp

            Filesize

            55.6MB

          • memory/4724-2-0x00000000059C0000-0x00000000059D7000-memory.dmp

            Filesize

            92KB