Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
24-01-2025 08:24
General
-
Target
2025-01-24_1ade068ec1d544f1cc223a11172b73e7_gandcrab.exe
-
Size
70KB
-
MD5
1ade068ec1d544f1cc223a11172b73e7
-
SHA1
29086181323b23bf6318333ef5dd4a684b7d4f80
-
SHA256
98348f9c87f3a9815dac385200f9354fe1234db9a072dba828a2fb80d9277680
-
SHA512
7575050536bfa27076bc0cc076a9e213ada898052bd3d09b0bd8720558dc96e62b3891d92f9484ca5f3ce6ce5e8c996c5bfb9237492ba4e254d93ff8e9dc05b6
-
SSDEEP
1536:ZZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:wd5BJHMqqDL2/Ovvdr
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-24_1ade068ec1d544f1cc223a11172b73e7_gandcrab.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-24_1ade068ec1d544f1cc223a11172b73e7_gandcrab.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses