General
-
Target
GandCrab.exe
-
Size
291KB
-
Sample
241126-ja8mhsxnfq
-
MD5
e6b43b1028b6000009253344632e69c4
-
SHA1
e536b70e3ffe309f7ae59918da471d7bf4cadd1c
-
SHA256
bfb9db791b8250ffa8ebc48295c5dbbca757a5ed3bbb01de12a871b5cd9afd5a
-
SHA512
07da214314673407a7d3978ee6e1d20bf1e02f135bf557e86b50489ecc146014f2534515c1b613dba96e65489d8c82caaa8ed2e647684d61e5e86bd3e8251adf
-
SSDEEP
6144:nSRCSpUtLz+/enihebWBUOP3yIhLVMmi0CtG7go+I:SUOEnNnHbmP3yIE3tGX
Static task
static1
Behavioral task
behavioral1
Sample
GandCrab.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
GandCrab.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
F:\$RECYCLE.BIN\S-1-5-21-1846800975-3917212583-2893086201-1000\BEEAKK-MANUAL.txt
gandcrab
http://gandcrabmfe6mnef.onion/701bffa2e11ce655
Extracted
C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\JMPHDF-MANUAL.txt
gandcrab
http://gandcrabmfe6mnef.onion/3fab0b57f61e23b
Targets
-
-
Target
GandCrab.exe
-
Size
291KB
-
MD5
e6b43b1028b6000009253344632e69c4
-
SHA1
e536b70e3ffe309f7ae59918da471d7bf4cadd1c
-
SHA256
bfb9db791b8250ffa8ebc48295c5dbbca757a5ed3bbb01de12a871b5cd9afd5a
-
SHA512
07da214314673407a7d3978ee6e1d20bf1e02f135bf557e86b50489ecc146014f2534515c1b613dba96e65489d8c82caaa8ed2e647684d61e5e86bd3e8251adf
-
SSDEEP
6144:nSRCSpUtLz+/enihebWBUOP3yIhLVMmi0CtG7go+I:SUOEnNnHbmP3yIE3tGX
-
Gandcrab family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (278) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1