Analysis
-
max time kernel
357s -
max time network
358s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
20-11-2024 13:08
General
-
Target
c83bf900eb759e5de5c8b0697a101ce81573874a440ac07ae4ecbc56c4f69331.exe
-
Size
97KB
-
MD5
cf90a464204a926eb549369ac7bf9bf6
-
SHA1
b6e9210c996d6e6bae6c4e996a00806607f6a6ed
-
SHA256
c83bf900eb759e5de5c8b0697a101ce81573874a440ac07ae4ecbc56c4f69331
-
SHA512
870f9b94ab07e87530693834c676d2c9b8deb5b5795361280c1ae21c9a136a9cdd620caec333c0c531fc360bce03e2d5940fc8b8abe2018a565d0eeb332734eb
-
SSDEEP
1536:ufuwLvvKeqM0TRl79lvhWAwVl5OpqIyedIVjC3E8czcrHuTcxLUllPR:umwLXnqM0Nl795twDIyeeBr+HUiUj
Malware Config
Extracted
F:\$RECYCLE.BIN\OQKQWQJLJS-MANUAL.txt
gandcrab
http://gandcrabmfe6mnef.onion/53c0964b9bc3b089
Signatures
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Gandcrab family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (290) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 38 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c83bf900eb759e5de5c8b0697a101ce81573874a440ac07ae4ecbc56c4f69331.exe"C:\Users\Admin\AppData\Local\Temp\c83bf900eb759e5de5c8b0697a101ce81573874a440ac07ae4ecbc56c4f69331.exe"1⤵
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD52ba3431d4cec2fa52741f16fc8e5e331
SHA1bf81a85c535691788eb804d10422abbe9dc8ad51
SHA256e95dab6a0655ab1842f9004661a91de6ddc8414960ad58eb02dffdd72bb212f4
SHA512bd4c9c34e0757f89b68d75391ab202c4d31dd437eb1b508b8306548a67e978942811c9b2ea27d94b4a06a5b2cb92d4a08cd000bbfd1c62cb01b6bd5086cd6e35