Analysis
-
max time kernel
40s -
max time network
38s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-11-2024 17:54
General
-
Target
RNSM00328.7z
-
Size
655KB
-
MD5
8700b06be6294762c61a224f8238d9db
-
SHA1
1ab220e0142fdb6ac5a561134905e19faf796566
-
SHA256
da339696b9080919ca4df03e3ae91451043b92e22d6eb05a9caa88b2b60e6dd6
-
SHA512
99c45cca0cb9eb25db56671ea821dc1b6512acafee2c08747fa1b419897531808cf63e0f69e6373c12a788a89d9f8d898c38f039fbc28d280c6d747ea4418f2f
-
SSDEEP
12288:Q/K65pEPkpLNV1hfwSU9ejI0KbwrFbRGZ2xkTmaTI:Qy652spJpfBU9ejA6tS2xImac
Malware Config
Extracted
C:\MSOCache\KRAB-DECRYPT.txt
http://gandcrabmfe6mnef.onion/94e0a739109c8777
Signatures
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Gandcrab family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (326) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 5 IoCs
-
Loads dropped DLL 8 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 43 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
NSIS installer 2 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00328.7z"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\00328\Trojan-Ransom.Win32.Purga.hf-da1cc6a846326aa237ae0d8db950d960f411e33157debaf6e826772213bb6098.exe"C:\Users\Admin\Desktop\00328\Trojan-Ransom.Win32.Purga.hf-da1cc6a846326aa237ae0d8db950d960f411e33157debaf6e826772213bb6098.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Desktop\00328\Trojan-Ransom.Win32.Globim.ge-683ea0257ab6310dc5a6a65acc63737259eb044f0a000ba58d63e8e75533ae72.exe"C:\Users\Admin\Desktop\00328\Trojan-Ransom.Win32.Globim.ge-683ea0257ab6310dc5a6a65acc63737259eb044f0a000ba58d63e8e75533ae72.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 282⤵
- Loads dropped DLL
- Program crash
-
-
C:\Users\Admin\Desktop\00328\Trojan-Ransom.Win32.GandCrypt.cqo-60b862503ba4a49bd19e492f979cc56f0017ae773c825848422730a88d1efe61.exe"C:\Users\Admin\Desktop\00328\Trojan-Ransom.Win32.GandCrypt.cqo-60b862503ba4a49bd19e492f979cc56f0017ae773c825848422730a88d1efe61.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Desktop\00328\Trojan-Ransom.Win32.Globim.ge-683ea0257ab6310dc5a6a65acc63737259eb044f0a000ba58d63e8e75533ae72.exe"C:\Users\Admin\Desktop\00328\Trojan-Ransom.Win32.Globim.ge-683ea0257ab6310dc5a6a65acc63737259eb044f0a000ba58d63e8e75533ae72.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 3202⤵
- Loads dropped DLL
- Program crash
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\00328\KRAB-DECRYPT.txt1⤵
-
C:\Users\Admin\Desktop\00328\Trojan-Ransom.Win32.Purga.hf-da1cc6a846326aa237ae0d8db950d960f411e33157debaf6e826772213bb6098.exe"C:\Users\Admin\Desktop\00328\Trojan-Ransom.Win32.Purga.hf-da1cc6a846326aa237ae0d8db950d960f411e33157debaf6e826772213bb6098.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5d4aa211240fe42c87b0168b79a426ac2
SHA15fbe8df64dcd65fd9163960be9e8fb67f5feda33
SHA2567670e4b5d546c501fe5bf39812a26bda71f34bd2b826708aed01d14f4bb73f32
SHA5120e9288129f839fbf7be243b260e792d89a3dc6dd551065f45abdc861f1ea85e714c95b74a72c80448058afe6dfdbe0b8ecf5a7043d3dcf381096d1fe4f41178f
-
Filesize
620KB
MD5656cc69b46593e3b3c8ea6a7a1ba014e
SHA18a8332b36643046c59de0f6fcb09b330f622ca02
SHA25660b862503ba4a49bd19e492f979cc56f0017ae773c825848422730a88d1efe61
SHA5125304105332ca0d5b2d1db58e634e0363516d352a6885b1019fe63aeadd9ba1ee397915d9dc0c80bf92d50b0685f3a9a690499372eedb4d08e7f7836f1d451552
-
Filesize
155KB
MD5cc20143aa35e089367573b78d088d428
SHA126bbe3845ab534084ded8354740c0ce03277ab74
SHA256683ea0257ab6310dc5a6a65acc63737259eb044f0a000ba58d63e8e75533ae72
SHA512b47aac3f7626796ab0f4478137c54162004a09333bf6761db9a9458f4c3c732e7b2219b6759c86aa8052b0bbf18a8a4fa26ff08b5a6baaad2d0244aaae4e88f8
-
Filesize
821KB
MD567bcba43a06d7d11d8cf7e44acd7fd21
SHA106f933753de3c825d488b1ced4ba90343ce4532e
SHA256da1cc6a846326aa237ae0d8db950d960f411e33157debaf6e826772213bb6098
SHA512a2435ea29047d973b8b0fe78a1c80154039a92b4f3af04bdf970713a4f601c7964211eee182d131f2e71031e2a2a11f95cc9e07549ccb16a4d74e10e5b9eb81a
-
Filesize
848KB
-
Filesize
892KB
-
Filesize
892KB
-
Filesize
848KB