Analysis
-
max time kernel
92s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-12-2024 06:30
General
-
Target
675c5b27af9009f66e92d8b4188bdb84838b7b167614841df47b5c470f4f0f9bN.exe
-
Size
231KB
-
MD5
1e5310906b2196362596f361e7fd55c0
-
SHA1
3d9e2fcd9a0b53c8493dfea67e04bf8adfdd1402
-
SHA256
675c5b27af9009f66e92d8b4188bdb84838b7b167614841df47b5c470f4f0f9b
-
SHA512
ac7e25075199e0664f8a0caaa4f994c4bd6bcd3e49f27b0a2bd89832d528115dfd3041450c8e52055546bca1d4e6c186262783df04c22f6cad10419ef2f236bb
-
SSDEEP
3072:RPgE0E5wfNm5RQ9vGeriZuxqrzmT0MKgM2Au2c5L97zPy+yc4WABa/KC:RPgEifAIOe6eOqAMKgMy5B7G25
Malware Config
Signatures
-
GandCrab payload 3 IoCs
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Gandcrab family
-
Drops file in Windows directory 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 20 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\675c5b27af9009f66e92d8b4188bdb84838b7b167614841df47b5c470f4f0f9bN.exe"C:\Users\Admin\AppData\Local\Temp\675c5b27af9009f66e92d8b4188bdb84838b7b167614841df47b5c470f4f0f9bN.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 4682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4720 -ip 47201⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5b16d8340c3be30d2f41b9c0e2b1f6257
SHA116a040d7653e5da8184498c63151eb87c866a940
SHA256494febd6c46ca0a8a5fae8164fae6d5a3485b6b767f35d8d70d378e025416b33
SHA5125eab1adcb3421f4e944a9e9b1f55a510fa399d5b30c3f9408c7e3bf7224a2d622166f3393ba951be80372667770198a31383b3f5b6f7109f7c704bfe52c3fe20
-
Filesize
1024KB
-
Filesize
176KB
-
Filesize
7.3MB
-
Filesize
92KB
-
Filesize
176KB