Overview

overview

10

Static

static

5

GrandCrabV5.0.1.exe

windows7-x64

9

GrandCrabV5.0.1.exe

windows10-1703-x64

9

GrandCrabV5.0.1.exe

windows10-2004-x64

9

GrandCrabV5.0.1.exe

windows11-21h2-x64

9

Ransomware.exe

windows7-x64

6

Ransomware.exe

windows10-1703-x64

6

Ransomware.exe

windows10-2004-x64

6

Ransomware.exe

windows11-21h2-x64

6

fcr.exe

windows7-x64

10

fcr.exe

windows10-1703-x64

10

fcr.exe

windows10-2004-x64

10

fcr.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    15s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-07-2024 10:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fcr.exe

  • Size

    10KB

  • MD5

    f1927e7f90416bf39fc7991bbc57e1b3

  • SHA1

    2367249568ca4a34f8824a9313b03d16d1d7c0bc

  • SHA256

    539b0b5d54757e8a2b754ecdc2939eb7cf9db0ed1728e0eca407500222668505

  • SHA512

    a0ac1811c8944165ba1939e40fe965bba3f7473819cb6f5d1cd4b4e7c203685baec055a6c73359dd1b3ddc79cb05b42d8c7541c29ea466120233423c5a5fcc60

  • SSDEEP

    192:yrj2/2OzcYKNEmkmTjtiIKZIF/2oQlLkMBBm4C:j/2OzcJNEmkmTjkI/92oQjBU7

Score
10/10
evasionpersistenceransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\Program Files (x86)\How To Restore Files.txt

Ransom Note
Important !!! Your personal id - puTpFwE9gE6TmSNT Warning: all your files are infected with an unknown virus. To decrypt your files, you need to contact at [email protected]. The decoder card is received by bitcoin. You can buy bitcoins from the following links://blockchain.info/wallet Do not try to restore files your self, this will lead to the loss of files forever GUARANTEES!!! You can send us 2-3 encoded files. And attach for testing, we will return them to you for FREE

Signatures

  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Renames multiple (12091) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\fcr.exe
    "C:\Users\Admin\AppData\Local\Temp\fcr.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:724
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all
      2⤵
        PID:3360
    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:3940
    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:2716
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:16424
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:5292
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:17916
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
            • Modifies registry class
            PID:18140

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\$Recycle.Bin\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini
            Filesize

            1KB

            MD5

            96bf4292850451e21ecfdb891f46d8d3

            SHA1

            f90ae3e33073b77f7a2c6cca474e37b8dfc22d92

            SHA256

            ce5aa7da605e09a3382cdaf2ffd59a4867c2924fd2ff997669e88e9bb2e24b8c

            SHA512

            122171ee536e8c8c23480e9ab18f06921671f51bde7bcf2abb3ccf0b8159f779c01e8dc1c5a3c33432c33d1c5f110fcf112da36583f39551cb407204fbe8ef64

            Download Submit

          • C:\Program Files (x86)\How To Restore Files.txt
            Filesize

            493B

            MD5

            5b1a43d32964d48b963e156089fa18b0

            SHA1

            2ac52637729d35b96eb284913d03fd314000c3d1

            SHA256

            c3386f9162c66c0610b34c6c32451e79ee7ff930800103f50b86e21c116872c8

            SHA512

            8f31be74abed380be6a33e731ed0093eecacdd6e4f8732cef522dddba083028555fada074b4f8a703fb899017dfb7a6bba468cac084b806ea1b6f3f024d001c3

            Download Submit

          • C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml
            Filesize

            3.3MB

            MD5

            34c4d5b5f583088996b1ea9ee197a508

            SHA1

            ef2bf7fb898985c0341388e95e19945acef13153

            SHA256

            9d835ac0fd6b9e0ed189facce005509c933b0c97cf18d6399cd54763e90f0ac6

            SHA512

            e26fc6238771c3d1323d2eb5893171bb09f3777fd975a913ab2bf5729176f4a9a1f741cb28ae15275c1692f7a2e4605db02c7c714b8918a3bc37801110038b00

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
            Filesize

            9KB

            MD5

            69ad3d1c62c0f7cdac4c20f88bdcdb7a

            SHA1

            9c2f12e0b6abe238ca01a94bcb0a84d05058e695

            SHA256

            2e6a53de21eecf9d25a30f199bb1eab7caf857b39d1b5d04a685ebf57b30b711

            SHA512

            f1cc9ecc43b10eff27fc08de50c114550daf37984924e02624c18407395fff160144f3deaec2cd66f65cc2cb9639b6dd10392a0d482e05bf04e73b92dab6e1e4

            Download Submit