Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22/05/2024, 00:59
General
-
Target
71cc349fe48d7af4c73c3156186da277026693eba256ed8902663ed6266fcbe7.exe
-
Size
248KB
-
MD5
e3078d826ea583f84b2cfad185a6e74f
-
SHA1
76a2d13aeedd497739fed093a7ad98fcc75d4f11
-
SHA256
71cc349fe48d7af4c73c3156186da277026693eba256ed8902663ed6266fcbe7
-
SHA512
25281728d906a5ce2a41a3ccc56e65286840e2f6f42441f9b8ad831d0a0c4b7231e7ddbf7b695fd914d015f37a104437a0a1ff280d3a8e135f4f808f36326411
-
SSDEEP
6144:Mr3529M1kD9cvq40Y4HG/Nrtk/kG6nsTLcte:G4Qk5PmtK/R0mcte
Malware Config
Signatures
-
GandCrab payload 3 IoCs
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Detects Reflective DLL injection artifacts 3 IoCs
-
Detects ransomware indicator 2 IoCs
-
Gandcrab Payload 3 IoCs
-
Drops file in Windows directory 1 IoCs
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\71cc349fe48d7af4c73c3156186da277026693eba256ed8902663ed6266fcbe7.exe"C:\Users\Admin\AppData\Local\Temp\71cc349fe48d7af4c73c3156186da277026693eba256ed8902663ed6266fcbe7.exe"1⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 4882⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3220 -ip 32201⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5d994087faa9e4be322a9e7bbea1523f8
SHA16a78b2af1289e935e3fb3ffd6e74c60aefb66af3
SHA2565107c1d8219f3b4604abeb5e48b33545f582b62fd0b519145e9ad96cb8c8df4d
SHA5129f6400123fad5cc22bf554db07066590854b23ae910593df7ff1b7f6c886b93d87791d770da85cf99143ef4009278ab2268fc500429b18b84306b57e1b9208d1
-
Filesize
176KB
-
Filesize
1024KB
-
Filesize
92KB
-
Filesize
7.3MB
-
Filesize
176KB