General
-
Target
2024-10-21_a0c1b4301b5c438659f8af7b18f94a15_gandcrab
-
Size
93KB
-
Sample
241021-b3m8aatfrm
-
MD5
a0c1b4301b5c438659f8af7b18f94a15
-
SHA1
577c5c9c8a2310d25a51afaf3a0e91395b9b8784
-
SHA256
f5aaca5c1ceebd3facddb259a6b8a7b66479d4971e21b8ef12308cb9ec91a864
-
SHA512
4e285d99d1a332d17abfab8e28a8bbb99803f96db4e0be000ce55a8780a6f80f7a1235857eaf75ff975a5b0b8a41fc211c3a491835e96047cbb7262a75e328d8
-
SSDEEP
1536:i8I5zikGDU3YpVhzLLpcJCUZgp2kepphlBbhzOcrHuTcWN9:5MGkcwuVhvLeCEPkepPfhzjHU
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-21_a0c1b4301b5c438659f8af7b18f94a15_gandcrab.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-21_a0c1b4301b5c438659f8af7b18f94a15_gandcrab.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
F:\$RECYCLE.BIN\S-1-5-21-3290804112-2823094203-3137964600-1000\GACHOU-MANUAL.txt
gandcrab
http://gandcrabmfe6mnef.onion/c91b2a9e9f7ba6db
Extracted
F:\$RECYCLE.BIN\S-1-5-21-4089630652-1596403869-279772308-1000\CULLAHEGNS-MANUAL.txt
gandcrab
http://gandcrabmfe6mnef.onion/2a8c2e4668fbb7f3
Targets
-
-
Target
2024-10-21_a0c1b4301b5c438659f8af7b18f94a15_gandcrab
-
Size
93KB
-
MD5
a0c1b4301b5c438659f8af7b18f94a15
-
SHA1
577c5c9c8a2310d25a51afaf3a0e91395b9b8784
-
SHA256
f5aaca5c1ceebd3facddb259a6b8a7b66479d4971e21b8ef12308cb9ec91a864
-
SHA512
4e285d99d1a332d17abfab8e28a8bbb99803f96db4e0be000ce55a8780a6f80f7a1235857eaf75ff975a5b0b8a41fc211c3a491835e96047cbb7262a75e328d8
-
SSDEEP
1536:i8I5zikGDU3YpVhzLLpcJCUZgp2kepphlBbhzOcrHuTcWN9:5MGkcwuVhvLeCEPkepPfhzjHU
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (326) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1