Analysis
-
max time kernel
95s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-12-2024 10:01
General
-
Target
7c5a55cfa74b375f2194e29633da183d764a9381d52af8e71bfc1c2a61fb8109.exe
-
Size
231KB
-
MD5
a2111a35365c5e7fd89b567412ca4ad6
-
SHA1
2a4a0c3880b90850a82552b72ec13ad3e793a444
-
SHA256
7c5a55cfa74b375f2194e29633da183d764a9381d52af8e71bfc1c2a61fb8109
-
SHA512
73122914c555107c8bf83bd9c954cac8a4c7da8ded849559a7966956a93126f2a641f81090d3be237dbbf473bc66bdc1be5ccc2dcef119329c83a842d2c60ca3
-
SSDEEP
3072:RPgE0E5wfNm5RQ9vGeriZuxqrzmT0MKgM2Au2c5L97zPy+yc4WABa/Km:RPgEifAIOe6eOqAMKgMy5B7G2z
Malware Config
Signatures
-
GandCrab payload 3 IoCs
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Gandcrab family
-
Drops file in Windows directory 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 20 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c5a55cfa74b375f2194e29633da183d764a9381d52af8e71bfc1c2a61fb8109.exe"C:\Users\Admin\AppData\Local\Temp\7c5a55cfa74b375f2194e29633da183d764a9381d52af8e71bfc1c2a61fb8109.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 4762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5088 -ip 50881⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
783B
MD5553cec13c08fc2b3ec7736207af77902
SHA103d74e9aa5ca6bd6ed0b8f616fddcfbd589a9b48
SHA256fc28529327f98110567ee20e4fdc0bcc23019fdeb36e5f5c84fa32ff62e26458
SHA5125796a7e18fc1daf689646c4f1de6af5c6cb799ac7391130a347432b5ae03036c19123244dab6e3d67036207aeb10411ac4ac4cfdddd8e2d046b98a214310a51d
-
Filesize
12KB
MD5f1ec35f74b55ffa6d5feead774601534
SHA1570b0166588ba9dfbd3b3350091d8ab3b791d14b
SHA256e8851408eb0aba6507f2d6c7ea767dc4241849fd973138c6a67de1b2e099d532
SHA512b0e065dee921acef630be068030728e25d34369458ec20b53e72b457022d33c383a6489b9fca4c200ee3b7464b56f05842ee1fb93a90f5598dae7d8ed8655072
-
Filesize
1024KB
-
Filesize
176KB
-
Filesize
7.3MB
-
Filesize
92KB
-
Filesize
176KB