Analysis
-
max time kernel
66s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
29-04-2024 09:34
General
-
Target
2024-04-29_cee06bb04094ed02ea7433579b52ed96_gandcrab.exe
-
Size
70KB
-
MD5
cee06bb04094ed02ea7433579b52ed96
-
SHA1
a2b4d2ba41fcb5c7a9de9a0927c74a5de565378d
-
SHA256
bea8e48be85b1b3f2fbd2aec0b1ef624ce33fa829ab7db316cee3ef07e8e7276
-
SHA512
92f5bc45a4d120c88e994eaa4044b35f4ed16e6cc96a8023bfe7bb75ef26026734746e79a3f54c2f2aeca6ccb1429bc474f6f87b7c9bed87dbbc384544b5a65f
-
SSDEEP
1536:kZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:7d5BJHMqqDL2/Ovvdr
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-29_cee06bb04094ed02ea7433579b52ed96_gandcrab.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-29_cee06bb04094ed02ea7433579b52ed96_gandcrab.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses