Analysis

  • max time kernel
    132s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-05-2024 18:25

General

  • Target

    2024-05-05_50080218a2937634415c58950715df58_gandcrab.exe

  • Size

    99KB

  • MD5

    50080218a2937634415c58950715df58

  • SHA1

    d72ff534710dbe9a77514b0ac4bc5527e9da59b0

  • SHA256

    ff52334ad2fc76d76f0afc68dbfe3ec4831ec906d94714c453cd765d6a75dbbf

  • SHA512

    639c5eaaadcec87093640821f76b8f8a71505421f5b8a2a740a501761e3fc97de1dfb10cc93df8528dde4918b43f09f7653ea46a8a432a6794c85c7133ef99af

  • SSDEEP

    1536:yZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZC:5d5BJHMqqDL2/OvvdrmYvQd2a

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-05_50080218a2937634415c58950715df58_gandcrab.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-05_50080218a2937634415c58950715df58_gandcrab.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:1120

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads