Overview

overview

10

Static

static

5

GrandCrabV5.0.1.exe

windows7-x64

9

GrandCrabV5.0.1.exe

windows10-1703-x64

9

GrandCrabV5.0.1.exe

windows10-2004-x64

9

GrandCrabV5.0.1.exe

windows11-21h2-x64

9

Ransomware.exe

windows7-x64

6

Ransomware.exe

windows10-1703-x64

6

Ransomware.exe

windows10-2004-x64

6

Ransomware.exe

windows11-21h2-x64

6

fcr.exe

windows7-x64

10

fcr.exe

windows10-1703-x64

10

fcr.exe

windows10-2004-x64

10

fcr.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    15s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/07/2024, 10:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fcr.exe
  • Size 10KB
  • Sample240716-mvb1ts1fre
  • SHA256 539b0b5d54757e8a2b754ecdc2939eb7cf9db0ed1728e0eca407500222668505
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
evasionpersistenceransomwarespywarestealertrojan

Malware Config

Extracted

Path

  • C:\Program Files (x86)\How To Restore Files.txt

Ransom Note
  • Important !!! Your personal id - puTpFwE9gE6TmSNT Warning: all your files are infected with an unknown virus. To decrypt your files, you need to contact at [email protected]. The decoder card is received by bitcoin. You can buy bitcoins from the following links://blockchain.info/wallet Do not try to restore files your self, this will lead to the loss of files forever GUARANTEES!!! You can send us 2-3 encoded files. And attach for testing, we will return them to you for FREE

Signatures

  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Renames multiple (12091) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\fcr.exe
    "C:\Users\Admin\AppData\Local\Temp\fcr.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:724
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all
      2⤵
        PID:3360
    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:3940
    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:2716
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:16424
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:5292
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:17916
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
            • Modifies registry class
            PID:18140

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                desktop.ini
                • Path C:\$Recycle.Bin\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini
                • Size 1KB
                • SHA256 ce5aa7da605e09a3382cdaf2ffd59a4867c2924fd2ff997669e88e9bb2e24b8c
                • MD5 SHA1 SHA512
                Submit Download

                How To Restore Files.txt
                • Path C:\Program Files (x86)\How To Restore Files.txt
                • Size 493B
                • SHA256 c3386f9162c66c0610b34c6c32451e79ee7ff930800103f50b86e21c116872c8
                • MD5 SHA1 SHA512
                Submit Download

                Manifest.xml
                • Path C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml
                • Size 3.3MB
                • SHA256 9d835ac0fd6b9e0ed189facce005509c933b0c97cf18d6399cd54763e90f0ac6
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                CortanaUnifiedTileModelCache.dat
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
                • Size 9KB
                • SHA256 2e6a53de21eecf9d25a30f199bb1eab7caf857b39d1b5d04a685ebf57b30b711
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download