Overview

overview

10

Static

static

10

017b236bf3...d6.exe

windows7-x64

10

05676f2007...fb.exe

windows7-x64

3

0a025116a8...57.exe

windows7-x64

8

1.exe

windows7-x64

8

18674bbd9a...38.exe

windows7-x64

8

234901adb1...b2.exe

windows7-x64

10

2ae06537d1...b6.exe

windows7-x64

8

2c02c65090...91.exe

windows7-x64

7

3.exe

windows7-x64

10

329b3ddbf1...f9.exe

windows7-x64

10

336fe6e8bc...de.exe

windows7-x64

8

4bd31921c8...be.exe

windows7-x64

8

4e180437ef...a9.exe

windows7-x64

3

539b0b5d54...05.exe

windows7-x64

10

53bf3a0bff...35.exe

windows7-x64

8

5d63c27043...42.exe

windows7-x64

8

5d6e1eeab9...84.exe

windows7-x64

8

63136e1d44...b5.exe

windows7-x64

8

658110c095...6f.exe

windows7-x64

8

74cafa4165...c5.exe

windows7-x64

8

88bf025119...30.exe

windows7-x64

5

9fbf62bd6a...a0.exe

windows7-x64

9

a89591555b...df.exe

windows7-x64

10

add230a2e7...10.exe

windows7-x64

10

c83bf900eb...31.exe

windows7-x64

10

ccbf53569b...71.exe

windows7-x64

8

db725306e6...8b.exe

windows7-x64

10

e035a1741d...5f.exe

windows7-x64

7

e2f4dfe61d...f8.exe

windows7-x64

8

f10e957b92...41.exe

windows7-x64

8

Analysis

  • max time kernel
    362s
  • max time network
    368s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-11-2024 13:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    329b3ddbf1c00b7767f0ec39b90eb9f4f8bd98ace60e2f6b6fbfb9adf25e3ef9.exe

  • Size

    99KB

  • MD5

    78efe80384fa759964c9ea8bada3ac8d

  • SHA1

    6300dca046dee2d99f8429bdb9b5f3edc4d5ec1c

  • SHA256

    329b3ddbf1c00b7767f0ec39b90eb9f4f8bd98ace60e2f6b6fbfb9adf25e3ef9

  • SHA512

    faab33afd525d4dee0497096f8cd07c748d98d6b3337d0616740495e6dde2d3b6a4bfb4aadfc2ac032ea5d6e065fc17b0addb4a1fe01878868d39d5d7c282dbc

  • SSDEEP

    3072:UKwH7Fxw0GQi8SHa0jNwriVcJLLfO1MYU:XG3wq70pwrimxLB

Score
10/10
gandcrabbackdoorcredential_accessdefense_evasiondiscoveryexecutionimpactransomwarespywarestealer

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\URSFJHD-DECRYPT.txt

Family

gandcrab

Ransom Note
---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .URSFJHD The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/a248dd308431fbb | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAJ5rX1ayBqD2CLDH4qAyr9qmAQYWBiHOXR6CQOLPqna+oTgw7G7zt+0e4+Ne8DT95/FMdU4P68nbY9HYbHUAVmmlwouHCjvWZyvhUieT8NBn3TAfFZzND4g5hnVrelFLNao7Up9qdV1EzvfBRZOOi71nntA3mOOKt9B+f5V1RJH16c5qYTe4bLfsySCP6JPcQgnfFqZEaHtTzNMxvLXMezYxBpHIncrw6pefA60T4b8UkHXYhkNZlrUzwEuKpghmZhl9WV6AQPX4h1m+zaHf7x814+MuV8GZFgAbufdzp06+W4pyAthF/PDzrISXjrNTIgIJhJ35AGswuKdKiE3XOpXU5XC9Uiji1Gj6vtzrbcgLkwMcL4JYapZ6IKny1ybzgV9ec7niJmPpUg1kz2HQPq0mDwU96ew1Ggxt0v8qwgZ9J+hV4/NL8QB5FsZKdGVaIvit2ddXeAivTU17xVnfcCdJLLLgKmi5l9SqpVLnHrXRMj5YxsuDsjdvMj5c8W34/rNWZaAE7QSYrunlY0md+MgCp2IXENWNJOVF/lFHbGCI6qGZg7S1fYTmAv9HawIKAYzWiS80ZNYHkPVXh1/7bTvhyHcMBZF59o0/NVjfh4J1E9ZFZ2kMKxLk0/S/FgwWO/ZXyGRFu9BMqpCa1ARhecFo2JUQR3Mc1MgTRnCof66j+v48whcqg1Aq9TGRibsSzHyFPJAw4nFT4JOgKhaUHy+NPw4wsctmXcBbzMfA0UgU+VWTbGGrewDyQuRW/3d1T0CGgxTB65i6FTu3r/Z6eGE/PSHMu0JpbsuJ2qydQEwwl6YbZhqUVc4rbaf3X9UfUIiDM6s+QtbqzYh2VROSSc8CLb40EMSg5RQXwL/Q46/uu9QMeELZjJOD7XrfHeLnbD9V8FUYo/MCa7GJgTDZad44vOh5DTcRuwKruwuZ8GKqFqZ7WAohHGE9cg6moeT4Hi0quXZAgdUMuYdsWgH/9QYBkNvUlzHrgmvZx8zajq9UNePUZvNAW2MZUOqpKX3G+J5lB4wUU/lRgFOtSo1KzQbOIH93THVQtO2tbRNYO6gPRC4pHJFSWenIcOwTwbc5Hp8Ujr+dBquZ5X5vT5IRMUFqxcxP49Mm09EvTJWPbtEajg4IBNs1XYQth0p+2QgaahKmbkqakt464wae1C7pSgIVyqhq9FOK8wHC/sh6+xz1+Qx60UU9iXCUqgOQEb+NTAroln9IlQD8KyTXYcA0d9Gtj88ux6z3Of7OpIDlhEVVbhNy7tKTLJ3obLf1cYK+m6Ro0ghY/xF44RLIevRcD+PVvyRj2pHNtL8KHqj1bF+92D9qvys/dRu2/8EgCv+ozQ3rHpJUJFrrTj3s14xYGRg7Sko5aV0yAvIiafjJufyG7I5FBQaCZ0WuFTMDWOxSxKEEGZlVx7bM8OVJ9m3sIhmxUvv+IplqdRatlUDXJNxteMV36P4xgKTdr/s2ypQVn4nnJwhcdpyCy09+dYTPA/brZzG4iZZudwOXSN5qrHgW10qKXy5apPdnhNFG2h//WgpuWMKxOnz8OcqmUDdd6nXe6yj9hDTD6uZ8N6FyI7jSuWsrhH96Ex9Yrhjt8ARu+A/YglRFtG35IUPk8jcw7BktYSdqWs7GM5YuVqO0O/2P9av3SM396kEnqRq1h+xelZOzt0iBrQvXjHTfpV1S0XtmNPDu7kI0menVndnkLqG5wJn/jSpYeOeL1SqjIqaI2QbfWddI9SG8Yp+dCX71t8+ddE5ieDuDbpwFSNHTrP2+rL+ZFcfVifIwg5eIKF5pFo8SW22A0gltjlYCfbwIvbfI3SfcEXnhwGNWs7fu6ortHEIe/rJjPEPXv0C9YaR+eZRzinDyPJ+4/ML4t1i7AdxBH3BgcVUv5ubGIbpVw1UkXctUg2cHkFXqSOEKmm/xj4V8KHjFxV3OT81YgjmJWpwj2HIz/U/JysGVQSrp6+h895seqe50As+1OpBDrx1/t4osz57q9AOI5deGdRhmVeN6XEvPX7tnCVj5mXUSpzSVv9iX1jy5pUJcnYzqBTzTzs3GY2XlIAed3DPuOdUU+QXk43r64GvQa907fRbz3IiuQvInbK2U0/IlSmHuz8ABjLuQSUVTFv7bwE7b9pGjw+THmyFbUw0SCU/gBNSHblRE12dw+7IjDs7eEjfhDakLo4zOy5k3WFpp6aHoiLfcUXvFwCvGEPzrv6GKTRohUqGzUEwGMG8gPDBj+e15S9BDFKXdc00= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmD19NTJPpDOAuyVr+DGRWrIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2mU0R7+dxfWLoypoW25ypHEnKnMMuBl1Cmehqo5VrrnNSZu19KSVzOtTAymPz79ICyGBkpCKj0RQwVePfN00RSVyDHtL6JddBZBnBqrcY+R+i3NbHPmdWR2kfSP4vy6vM9LODjDaPvr3tWv+YKTznJt/bAL0J01/eNSzezgKAqoTvFqJ2HPDmx5ShGudnoMloV6iCVyemoqB5vY7wHrtkyoC8G1fylXjmX7rN4cOwygU+wTkywb+cfzdw/LWqjqbjWwFvi9DPXKP+ghY2cWKz+6gkLvCeiiYFcEv1EtSM9ANLhxdQDIBf1BEGWyeuMaJ0e1kg/veRBewAEgXTMCu/raNdAPEuVP8puLvsbtAnbcHaVpLCeEcCsErTNnIOad0Jyb8w0olGQczbSj6JSDB3FwYH5qABw ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/a248dd308431fbb

Signatures

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • Gandcrab family
    gandcrab
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (293) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 46 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\329b3ddbf1c00b7767f0ec39b90eb9f4f8bd98ace60e2f6b6fbfb9adf25e3ef9.exe
    "C:\Users\Admin\AppData\Local\Temp\329b3ddbf1c00b7767f0ec39b90eb9f4f8bd98ace60e2f6b6fbfb9adf25e3ef9.exe"
    1⤵
    • Drops startup file
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2640
    • C:\Windows\SysWOW64\wbem\wmic.exe
      "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2592
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\URSFJHD-DECRYPT.txt
    Filesize

    8KB

    MD5

    5827f0a33fa7c5f58099a32e7b3b9543

    SHA1

    b51e26920957dda34abadffc54b3a95452a19915

    SHA256

    d98161a390c78711c3a9fe0978b81a7b6ae1c7f73573eac38df60aab84ebeeb3

    SHA512

    b3bed2ba86ea2c52ba5ec0ef53626424c69e1482345afe8aecc3d87ef40f72a3dd6669c0fdd2e48c0380b88b18fa1e9db93fe16bb729aaf39b427e5257f4cd56

    Download Submit