Overview

overview

10

Static

static

3

01c3a92e6b...18.exe

windows7-x64

10

01c3a92e6b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    01c3a92e6bfdbb1b522ea1f383056916_JaffaCakes118

  • Size

    232KB

  • Sample

    240426-1x27padh3z

  • MD5

    01c3a92e6bfdbb1b522ea1f383056916

  • SHA1

    21e1f69ff6b6779637266f0a2b370fde31cb2c04

  • SHA256

    5c2f8813c81606611b85bf4c6aae1b2f4c183a68aa2ffff099fecdab0679a4ec

  • SHA512

    09de8a55c435ac10e3858b5013291e5c0aabea3c1833b76ed090b44f9971aec15d048458d59aabb25966e9152a79d264d765dd5f179bd07c0fea386e1093bced

  • SSDEEP

    6144:hEzzHWqTQ5qJMaH8vMPdqCd5hhNxucdZfbPqc:hEHH7Q5qTlqCd5hhNgAZjPqc

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      01c3a92e6bfdbb1b522ea1f383056916_JaffaCakes118

    • Size

      232KB

    • MD5

      01c3a92e6bfdbb1b522ea1f383056916

    • SHA1

      21e1f69ff6b6779637266f0a2b370fde31cb2c04

    • SHA256

      5c2f8813c81606611b85bf4c6aae1b2f4c183a68aa2ffff099fecdab0679a4ec

    • SHA512

      09de8a55c435ac10e3858b5013291e5c0aabea3c1833b76ed090b44f9971aec15d048458d59aabb25966e9152a79d264d765dd5f179bd07c0fea386e1093bced

    • SSDEEP

      6144:hEzzHWqTQ5qJMaH8vMPdqCd5hhNxucdZfbPqc:hEHH7Q5qTlqCd5hhNgAZjPqc

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks