Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28-09-2024 16:29
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe
Resource
win10v2004-20240910-en
General
-
Target
2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe
-
Size
97KB
-
MD5
bc5c8cbbe66ca3ea05604509d334e617
-
SHA1
084ed6abd5ded9948bf7d0a41b3c99cb35208426
-
SHA256
79300246f195358830de5994005b0398924482e774a3244748c3b71d98b8ebaf
-
SHA512
47fbbf0479247c0fb94f1644ebd0c170dea89d29349181a125b4afbd5eb39367951b35a9e225dc5b790a9384e359b2fc96eec0853fb0156c4b87fa2cf8ce94f0
-
SSDEEP
1536:ufuwLvvKeqM0TRl79lvhWAwVl5OpqIyedIVjC3E8dzcrHuTcxLUllPR:umwLXnqM0Nl795twDIyeeBG+HUiUj
Malware Config
Extracted
C:\Users\IRGHI-MANUAL.txt
gandcrab
http://gandcrabmfe6mnef.onion/8ff12e803809f69d
Signatures
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (260) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\3809f1703809f692114.lock 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\IRGHI-MANUAL.txt 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened (read-only) \??\U: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened (read-only) \??\V: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened (read-only) \??\R: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened (read-only) \??\W: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened (read-only) \??\E: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened (read-only) \??\G: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened (read-only) \??\I: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened (read-only) \??\O: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened (read-only) \??\P: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened (read-only) \??\Q: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened (read-only) \??\A: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened (read-only) \??\B: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened (read-only) \??\H: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened (read-only) \??\M: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened (read-only) \??\X: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened (read-only) \??\Z: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened (read-only) \??\K: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened (read-only) \??\L: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened (read-only) \??\N: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened (read-only) \??\S: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened (read-only) \??\T: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened (read-only) \??\Y: 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\bxmeoengtf.bmp" 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe -
Drops file in Program Files directory 28 IoCs
description ioc Process File opened for modification C:\Program Files\MountBlock.ram 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened for modification C:\Program Files\PublishMount.ex_ 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened for modification C:\Program Files\UninstallMount.hta 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File created C:\Program Files\3809f1703809f692114.lock 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened for modification C:\Program Files\MountCompare.txt 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File created C:\Program Files (x86)\3809f1703809f692114.lock 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened for modification C:\Program Files\InstallRemove.aiff 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\3809f1703809f692114.lock 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File created C:\Program Files (x86)\IRGHI-MANUAL.txt 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened for modification C:\Program Files\DenyRegister.wmf 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\IRGHI-MANUAL.txt 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened for modification C:\Program Files\AssertUndo.pps 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened for modification C:\Program Files\MountSearch.php 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened for modification C:\Program Files\OpenUse.rle 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened for modification C:\Program Files\ResetSend.rle 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened for modification C:\Program Files\NewExit.wpl 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened for modification C:\Program Files\ReceiveSend.pcx 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened for modification C:\Program Files\SubmitGet.xlsx 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\3809f1703809f692114.lock 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File created C:\Program Files\IRGHI-MANUAL.txt 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened for modification C:\Program Files\TraceSkip.edrwx 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\IRGHI-MANUAL.txt 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened for modification C:\Program Files\RepairStart.mpg 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened for modification C:\Program Files\StopConnect.jpeg 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened for modification C:\Program Files\UnpublishApprove.ttf 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\IRGHI-MANUAL.txt 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\3809f1703809f692114.lock 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe File opened for modification C:\Program Files\FindSkip.zip 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2480 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1364 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe 1364 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2240 vssvc.exe Token: SeRestorePrivilege 2240 vssvc.exe Token: SeAuditPrivilege 2240 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1364 wrote to memory of 1140 1364 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe 31 PID 1364 wrote to memory of 1140 1364 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe 31 PID 1364 wrote to memory of 1140 1364 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe 31 PID 1364 wrote to memory of 1140 1364 2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe 31 PID 1140 wrote to memory of 2480 1140 cmd.exe 33 PID 1140 wrote to memory of 2480 1140 cmd.exe 33 PID 1140 wrote to memory of 2480 1140 cmd.exe 33 PID 1140 wrote to memory of 2480 1140 cmd.exe 33 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe"1⤵
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:2480
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2240
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD51ac2c1dd30c124db962eb79c4e249a50
SHA179e906bca6dde33694a9c6447ae1667ed4503d42
SHA256247ab5a2577134b1d3374653a543524078169f2323dd0c7c4af4765aba7145f8
SHA512658d542d2f05f1c27bc5974afd08aa77c52e8e8004fc91f04dcffae6ee5ce342a458c575f2cf98587f77d31d55f6fb776247c923146b7e85f061de2574fd6be5