Overview
overview
10Static
static
5GrandCrabV5.0.1.exe
windows7-x64
9GrandCrabV5.0.1.exe
windows10-1703-x64
9GrandCrabV5.0.1.exe
windows10-2004-x64
9GrandCrabV5.0.1.exe
windows11-21h2-x64
9Ransomware.exe
windows7-x64
6Ransomware.exe
windows10-1703-x64
6Ransomware.exe
windows10-2004-x64
6Ransomware.exe
windows11-21h2-x64
6fcr.exe
windows7-x64
10fcr.exe
windows10-1703-x64
10fcr.exe
windows10-2004-x64
10fcr.exe
windows11-21h2-x64
10Analysis
- max time kernel
4s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
16/07/2024, 10:46
Static task
static1
Behavioral task
behavioral1
Sample
GrandCrabV5.0.1.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
GrandCrabV5.0.1.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
GrandCrabV5.0.1.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
GrandCrabV5.0.1.exe
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
Ransomware.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral6
Sample
Ransomware.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral7
Sample
Ransomware.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Ransomware.exe
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
fcr.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral10
Sample
fcr.exe
Resource
win10-20240611-en
windows10-1703-x64
Behavioral task
behavioral11
Sample
fcr.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
fcr.exe
Resource
win11-20240709-en
windows11-21h2-x64
General
- Target Ransomware.exe
- Size 878KB
- Sample240716-mvb1ts1fre
- SHA256 e75e6de7b10900b328ff8f80504a191874ee8c45ca6df94c7ceb59e62cbb15ca
- MD5 7f29dfc164eff93e11d230a621901145
- SHA1 1d9f10518b95315cdc648ba415335ab510804f3e
- SHA512 0deeca68a6b0449daf33f86c9d0be54bf6c681583618f717cd9cb949a6d9b0a6bb339184df2fc9f21c6f36a8ac9f0e0a80f7b9416b985b1be6ef6149e1978678
- SSDEEP 12288:DCdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBga4TibtQ:DCdxte/80jYLT3U1jfsWaAibtQ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\m: Ransomware.exe File opened (read-only) \??\o: Ransomware.exe File opened (read-only) \??\p: Ransomware.exe File opened (read-only) \??\u: Ransomware.exe File opened (read-only) \??\g: Ransomware.exe File opened (read-only) \??\r: Ransomware.exe File opened (read-only) \??\t: Ransomware.exe File opened (read-only) \??\b: Ransomware.exe File opened (read-only) \??\i: Ransomware.exe File opened (read-only) \??\j: Ransomware.exe File opened (read-only) \??\k: Ransomware.exe File opened (read-only) \??\q: Ransomware.exe File opened (read-only) \??\v: Ransomware.exe File opened (read-only) \??\z: Ransomware.exe File opened (read-only) \??\a: Ransomware.exe File opened (read-only) \??\h: Ransomware.exe File opened (read-only) \??\l: Ransomware.exe File opened (read-only) \??\n: Ransomware.exe File opened (read-only) \??\s: Ransomware.exe File opened (read-only) \??\w: Ransomware.exe File opened (read-only) \??\x: Ransomware.exe File opened (read-only) \??\y: Ransomware.exe File opened (read-only) \??\e: Ransomware.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 740 Ransomware.exe 740 Ransomware.exe 740 Ransomware.exe 740 Ransomware.exe 740 Ransomware.exe 740 Ransomware.exe 740 Ransomware.exe - Suspicious use of SendNotifyMessage 7 IoCs
pid Process 740 Ransomware.exe 740 Ransomware.exe 740 Ransomware.exe 740 Ransomware.exe 740 Ransomware.exe 740 Ransomware.exe 740 Ransomware.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ransomware.exe"C:\Users\Admin\AppData\Local\Temp\Ransomware.exe"1⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:740
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:4876
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:4956