General

  • Target

    935c044fedc6d2d19904dbcffb555921_JaffaCakes118

  • Size

    73KB

  • Sample

    240604-cmb1raad87

  • MD5

    935c044fedc6d2d19904dbcffb555921

  • SHA1

    4a29a684a5e1b69e87f7abf86f9a89daa8260085

  • SHA256

    185f897af1c8d88f3cb9ca8f688c8ea49ba6cc9bb20e6b03d57ba6bb162eb654

  • SHA512

    69e719643d04d4f785f047214cbb36711dd440ed5a12879021099f09a8f95ff172b2d181fef6c4f9241663b915bfc73b431a25b43b264e2f8f5ad8a7060bc5f7

  • SSDEEP

    1536:Z55u555555555pmgSeGDjtQhnwmmB0ybMqqU+2bbbAV2/S2mr3IdE8mne0Avu5rJ:xMSjOnrmBTMqqDL2/mr3IdE8we0Avu5F

Score
10/10

Malware Config

Extracted

Family

gandcrab

C2

http://gdcbghvjyqy7jclk.onion.top/

Targets

    • Target

      935c044fedc6d2d19904dbcffb555921_JaffaCakes118

    • Size

      73KB

    • MD5

      935c044fedc6d2d19904dbcffb555921

    • SHA1

      4a29a684a5e1b69e87f7abf86f9a89daa8260085

    • SHA256

      185f897af1c8d88f3cb9ca8f688c8ea49ba6cc9bb20e6b03d57ba6bb162eb654

    • SHA512

      69e719643d04d4f785f047214cbb36711dd440ed5a12879021099f09a8f95ff172b2d181fef6c4f9241663b915bfc73b431a25b43b264e2f8f5ad8a7060bc5f7

    • SSDEEP

      1536:Z55u555555555pmgSeGDjtQhnwmmB0ybMqqU+2bbbAV2/S2mr3IdE8mne0Avu5rJ:xMSjOnrmBTMqqDL2/mr3IdE8we0Avu5F

    Score
    6/10
    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Tasks