gandcrab | 05b1c3db49c3fb2cd683817f76705ddadf11d03cb6a515c3219739b182a7c782 | Triage

Sharing

General

Target

2025-01-02_c25cc93004f685a4be45cc9189977e67_gandcrab
Size

1.0MB
Sample

250102-lgswraylhk
MD5

c25cc93004f685a4be45cc9189977e67
SHA1

275a53ac38b380e1ea7fb0587bbc55894642bc17
SHA256

05b1c3db49c3fb2cd683817f76705ddadf11d03cb6a515c3219739b182a7c782
SHA512

de36847f25f04750722adefdc707db46332896e01445b7253979e1d25b11d7967e49a55e7ce95e6c37cffc2b4003d11886695e82d819cdf727e77cb040fc406d
SSDEEP

24576:Pp+6k0hGigXBH4snfDLhfxTdLXWVjpUVAs7ImLKrVA16yiLo+aegfN:wyGigXBHvfD1f3Li9UVlerVWhN

Score

10^/10

gandcrab discovery persistence

Malware Config

Targets

- Target
  
  2025-01-02_c25cc93004f685a4be45cc9189977e67_gandcrab
- Size
  
  1.0MB
- MD5
  
  c25cc93004f685a4be45cc9189977e67
- SHA1
  
  275a53ac38b380e1ea7fb0587bbc55894642bc17
- SHA256
  
  05b1c3db49c3fb2cd683817f76705ddadf11d03cb6a515c3219739b182a7c782
- SHA512
  
  de36847f25f04750722adefdc707db46332896e01445b7253979e1d25b11d7967e49a55e7ce95e6c37cffc2b4003d11886695e82d819cdf727e77cb040fc406d
- SSDEEP
  
  24576:Pp+6k0hGigXBH4snfDLhfxTdLXWVjpUVAs7ImLKrVA16yiLo+aegfN:wyGigXBHvfD1f3Li9UVlerVWhN
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence