Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    12-11-2024 01:21

General

  • Target

    2024-11-12_108c7089d84208d623c7d62b55632254_gandcrab.exe

  • Size

    70KB

  • MD5

    108c7089d84208d623c7d62b55632254

  • SHA1

    0a723cf9aba28f35b1114569839ee365367bcd61

  • SHA256

    f6c85c6e9a1124a5cac64a92c91c23b4ac0c5a8becc03a4acf1948ee7952ecff

  • SHA512

    eda82a511df9eaea1289a99d38af44b3e8f059b93bb60ded2d1ece041a5fb282d598bc8a2eca9538ff29f0396020dfe28823d7be5e28e743957a20d32dd68d28

  • SSDEEP

    1536:oZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:nd5BJHMqqDL2/Ovvdr

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-12_108c7089d84208d623c7d62b55632254_gandcrab.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-12_108c7089d84208d623c7d62b55632254_gandcrab.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 124
      2⤵
      • Program crash
      PID:1304

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads