Analysis
-
max time kernel
313s -
max time network
318s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
20-11-2024 13:10
General
-
Target
017b236bf38a1cf9a52fc0bdee2d5f23f038b00f9811c8a58b8b66b1c756b8d6.exe
-
Size
97KB
-
MD5
125923ce61dffa8276a2a77e84d2832a
-
SHA1
1801bb09f18b2b491e0e1831c2765a96efc1e493
-
SHA256
017b236bf38a1cf9a52fc0bdee2d5f23f038b00f9811c8a58b8b66b1c756b8d6
-
SHA512
aac5ef5260702228a165e72f4721d7df414e33b92a64c8b00c440c9e15ae85aead9fe2d978eea72733f1df84eea9d06fdff04e69ff4f67b0592a1c4a3ae1b433
-
SSDEEP
1536:ufuwLvvKeqM0TRl79lvhWAwVl5OpqIyedIVjC3E87zcrHuTcxLUllPR:umwLXnqM0Nl795twDIyeeB8+HUiUj
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\UONNYODF-MANUAL.txt
gandcrab
http://gandcrabmfe6mnef.onion/91f1a8a1ef4f068c
Signatures
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Gandcrab family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (285) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 23 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\017b236bf38a1cf9a52fc0bdee2d5f23f038b00f9811c8a58b8b66b1c756b8d6.exe"C:\Users\Admin\AppData\Local\Temp\017b236bf38a1cf9a52fc0bdee2d5f23f038b00f9811c8a58b8b66b1c756b8d6.exe"1⤵
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD597affccdd7cd14b510042d5354077655
SHA1b821b257bc38d594ebfb61507cd44185910aca09
SHA2564cc2e6d8873d9a55fcc5a51476aaf7c03146eb6b810fcd1fc704c38f12e7a65b
SHA512786a21d14c2dae73c45a07dab84232b3562a2472da7c8f4ef8b37e2afee0b92c2b8d74aa59fbfb63e737cea4bba6e6c15e8881ae489292e214178b2d9628aa33