Analysis
-
max time kernel
361s -
max time network
365s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
20-11-2024 13:10
General
-
Target
c83bf900eb759e5de5c8b0697a101ce81573874a440ac07ae4ecbc56c4f69331.exe
-
Size
97KB
-
MD5
cf90a464204a926eb549369ac7bf9bf6
-
SHA1
b6e9210c996d6e6bae6c4e996a00806607f6a6ed
-
SHA256
c83bf900eb759e5de5c8b0697a101ce81573874a440ac07ae4ecbc56c4f69331
-
SHA512
870f9b94ab07e87530693834c676d2c9b8deb5b5795361280c1ae21c9a136a9cdd620caec333c0c531fc360bce03e2d5940fc8b8abe2018a565d0eeb332734eb
-
SSDEEP
1536:ufuwLvvKeqM0TRl79lvhWAwVl5OpqIyedIVjC3E8czcrHuTcxLUllPR:umwLXnqM0Nl795twDIyeeBr+HUiUj
Malware Config
Extracted
F:\$RECYCLE.BIN\S-1-5-21-3551809350-4263495960-1443967649-1000\HYRJAC-MANUAL.txt
gandcrab
http://gandcrabmfe6mnef.onion/508ee86b4c4cf791
Signatures
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Gandcrab family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (313) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 39 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c83bf900eb759e5de5c8b0697a101ce81573874a440ac07ae4ecbc56c4f69331.exe"C:\Users\Admin\AppData\Local\Temp\c83bf900eb759e5de5c8b0697a101ce81573874a440ac07ae4ecbc56c4f69331.exe"1⤵
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD590b3b300f0f462a622ce86f17110cb44
SHA120cf690cbdc9e33c15887160d8bd07bdad614eb6
SHA25681a7d22ab55c78b73fee482ede1c7339250ebc1ceecd85bd94776f9b5a031615
SHA51228784f57f3515c20870b4f8fc07525a19448ee992d46c9ba5541cdd4052f456dd50c2e97ac8fd64cec93659b045a473d6756a9d798dfb9873e28042092ca776c