gandcrab | 8a89fe27b9ec94bbbfbf40ccc46d0a11c20453ac32153d3abc51ddc43a7d8606 | Triage

Sharing

General

Target

2025-01-23_13d17e94a99624f0c41e948a9756cee4_gandcrab
Size

70KB
Sample

250123-bwl2mswpdk
MD5

13d17e94a99624f0c41e948a9756cee4
SHA1

d6f985f0ce58877ba6760495b58b4c6e5fee8ba7
SHA256

8a89fe27b9ec94bbbfbf40ccc46d0a11c20453ac32153d3abc51ddc43a7d8606
SHA512

676b2bf19ff7a46b3adefd042a8cedf2a041250aef6c8f7b6661002cbb9c221dd46b88d0c2655e2351cc7366959d36cb662f34c145e4eb2cc4a20d2bd2dd4e70
SSDEEP

1536:7zzzzzzzzADypczUk+lkZJWMqqUM2Ovvd67:0d5BJWMqqMOvvd

Score

10^/10

gandcrab discovery persistence

Malware Config

Targets

- Target
  
  2025-01-23_13d17e94a99624f0c41e948a9756cee4_gandcrab
- Size
  
  70KB
- MD5
  
  13d17e94a99624f0c41e948a9756cee4
- SHA1
  
  d6f985f0ce58877ba6760495b58b4c6e5fee8ba7
- SHA256
  
  8a89fe27b9ec94bbbfbf40ccc46d0a11c20453ac32153d3abc51ddc43a7d8606
- SHA512
  
  676b2bf19ff7a46b3adefd042a8cedf2a041250aef6c8f7b6661002cbb9c221dd46b88d0c2655e2351cc7366959d36cb662f34c145e4eb2cc4a20d2bd2dd4e70
- SSDEEP
  
  1536:7zzzzzzzzADypczUk+lkZJWMqqUM2Ovvd67:0d5BJWMqqMOvvd
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence