Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-01-2025 09:27
General
-
Target
2025-01-23_1f9b3dc32aca55b7088e1f476c3c5d52_gandcrab.exe
-
Size
70KB
-
MD5
1f9b3dc32aca55b7088e1f476c3c5d52
-
SHA1
4f4a29c68b0de4677a86d7ea7da76b2c57e652b6
-
SHA256
a4cc1b46272ef15184fb3919253d2823d32d402b7cba34716418d7db550d6eb2
-
SHA512
bbfa42cdf1eb74b5b7e09e841fc54489d6cb5f8d8e2818f642b9125ba06cff2cbafb69dfcc129548a2df6bbf188f58eb71880d76ce6b476075a91ca562e84f8f
-
SSDEEP
1536:nZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:Od5BJHMqqDL2/Ovvdr
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-23_1f9b3dc32aca55b7088e1f476c3c5d52_gandcrab.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-23_1f9b3dc32aca55b7088e1f476c3c5d52_gandcrab.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses