Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-11-2024 02:26
General
-
Target
2024-11-13_108b06b6e6a8f2a4a96e5fbf6f2c6876_gandcrab.exe
-
Size
70KB
-
MD5
108b06b6e6a8f2a4a96e5fbf6f2c6876
-
SHA1
2130b22167293695d368f2c12473a79bb09d04f7
-
SHA256
21c8dc2776c3e6c234d8bb0798373388be698b19f8731c602399a2c43928a567
-
SHA512
2c81df551456f8fc23970dfb47bbf595fe1ea007d328fad8abed78557640b31036daac0c07f73aafa74f044f8fc8baa923ba4747ec5e92acbfb221a7eb738927
-
SSDEEP
1536:yZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:5d5BJHMqqDL2/Ovvdr
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-13_108b06b6e6a8f2a4a96e5fbf6f2c6876_gandcrab.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-13_108b06b6e6a8f2a4a96e5fbf6f2c6876_gandcrab.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses