gandcrab | 8347c2b3f3315e17055023e882c0d72eb84ee8862fc6b41b5d3aad57f825d367

General

Target

a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
Size

312KB
MD5

a2815d956ba0141912ba7323c1ee04d2
SHA1

fe4a397e72815abc02cbb671f04e787c07238442
SHA256

8347c2b3f3315e17055023e882c0d72eb84ee8862fc6b41b5d3aad57f825d367
SHA512

71c428ed57f795a2f163694f5695d3fcc5ee70ed993f91c4e9e9d40eb3779c9726265b92e6c048d29e243bc1a3f627aec5266a1e57f5b8e5541dbc3e2bb5948a
SSDEEP

3072:ob9chCbs07hdRhduItP/emDHBNTXn7BS4FI0rzBNZ237Qct7PX432gwbNTfSmovy:o3s0DwyemtpnFD/c7QUA32bNTFeHDi

Score

10^/10

gandcrab backdoor persistence ransomware

Malware Config

Signatures

GandCrab payload 4 IoCs

resource	yara_rule
behavioral1/memory/836-4-0x00000000012E0000-0x00000000012F7000-memory.dmp	family_gandcrab
behavioral1/memory/836-3-0x0000000000400000-0x00000000012D3000-memory.dmp	family_gandcrab
behavioral1/memory/836-6-0x0000000000400000-0x00000000012D3000-memory.dmp	family_gandcrab
behavioral1/memory/836-15-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\elwagdgrkix = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\bshtgg.exe\""	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
File opened (read-only)	\??\A:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
File opened (read-only)	\??\G:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
File opened (read-only)	\??\J:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
File opened (read-only)	\??\V:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
File opened (read-only)	\??\R:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
File opened (read-only)	\??\U:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
File opened (read-only)	\??\W:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
File opened (read-only)	\??\Y:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
File opened (read-only)	\??\B:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
File opened (read-only)	\??\I:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
File opened (read-only)	\??\L:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
File opened (read-only)	\??\M:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
File opened (read-only)	\??\E:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
File opened (read-only)	\??\Q:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
File opened (read-only)	\??\S:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
File opened (read-only)	\??\P:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
File opened (read-only)	\??\T:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
File opened (read-only)	\??\X:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
File opened (read-only)	\??\H:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
File opened (read-only)	\??\K:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
File opened (read-only)	\??\N:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
File opened (read-only)	\??\O:	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2652	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	28
PID 836 wrote to memory of 2652	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	28
PID 836 wrote to memory of 2652	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	28
PID 836 wrote to memory of 2652	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	28
PID 836 wrote to memory of 2536	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	30
PID 836 wrote to memory of 2536	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	30
PID 836 wrote to memory of 2536	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	30
PID 836 wrote to memory of 2536	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	30
PID 836 wrote to memory of 760	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	34
PID 836 wrote to memory of 760	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	34
PID 836 wrote to memory of 760	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	34
PID 836 wrote to memory of 760	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	34
PID 836 wrote to memory of 2948	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	36
PID 836 wrote to memory of 2948	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	36
PID 836 wrote to memory of 2948	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	36
PID 836 wrote to memory of 2948	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	36
PID 836 wrote to memory of 2252	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	38
PID 836 wrote to memory of 2252	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	38
PID 836 wrote to memory of 2252	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	38
PID 836 wrote to memory of 2252	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	38
PID 836 wrote to memory of 2324	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	40
PID 836 wrote to memory of 2324	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	40
PID 836 wrote to memory of 2324	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	40
PID 836 wrote to memory of 2324	836	a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe	40

C:\Users\Admin\AppData\Local\Temp\a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a2815d956ba0141912ba7323c1ee04d2_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\nslookup.exe
  nslookup carder.bit ns1.wowservers.ru
  2⤵
  PID:2652
- C:\Windows\SysWOW64\nslookup.exe
  nslookup ransomware.bit ns2.wowservers.ru
  2⤵
  PID:2536
- C:\Windows\SysWOW64\nslookup.exe
  nslookup carder.bit ns2.wowservers.ru
  2⤵
  PID:760
- C:\Windows\SysWOW64\nslookup.exe
  nslookup ransomware.bit ns1.wowservers.ru
  2⤵
  PID:2948
- C:\Windows\SysWOW64\nslookup.exe
  nslookup carder.bit ns1.wowservers.ru
  2⤵
  PID:2252
- C:\Windows\SysWOW64\nslookup.exe
  nslookup ransomware.bit ns2.wowservers.ru
  2⤵
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-1-0x0000000000290000-0x0000000000390000-memory.dmp

Filesize
1024KB

Download
memory/836-2-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/836-4-0x00000000012E0000-0x00000000012F7000-memory.dmp

Filesize
92KB

Download
memory/836-3-0x0000000000400000-0x00000000012D3000-memory.dmp

Filesize
14.8MB

Download
memory/836-6-0x0000000000400000-0x00000000012D3000-memory.dmp

Filesize
14.8MB

Download
memory/836-15-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/836-14-0x0000000000290000-0x0000000000390000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads