Overview

overview

10

Static

static

3

freehacks.exe

windows7-x64

10

Resubmissions

24-01-2025 18:40

250124-xa9rgaskbs 10

24-01-2025 18:35

250124-w8pzaa1rhw 10

24-01-2025 12:51

250124-p3g8xs1jel 10

24-01-2025 12:32

250124-pqtq7azmhk 10

24-01-2025 07:13

250124-h2fkdawnft 10

22-01-2025 14:16

250122-rk6jxaznbz 10

08-12-2024 13:45

241208-q2cgqavpby 10

03-12-2024 09:57

241203-ly26rawjfj 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    freehacks.exe

  • Size

    105.5MB

  • Sample

    250124-w8pzaa1rhw

  • MD5

    4647bc264b4344c7ca47ae9adc130ba9

  • SHA1

    08280768ffd55e06203fc8f13d3e6f1745c7ee0c

  • SHA256

    742e3f0ca6967c947c99cbbff7f3eaa7f5059a1bba1714a20afee3d85312a439

  • SHA512

    9d2a9f90746e74819c441da86086fc716f2e9f54fbf77e4a1cfec2badb1d64b9fe0ba3e3f5304ad797613c27cb038fbddc551d4824b6445ab5f8d063e1424981

  • SSDEEP

    3145728:iZGbexf7I4RniT0BEI43vBrYwY+pOhdFs8rBb:isbexTi64/Bbp0KG

Score
10/10
gandcrabhawkeyewannacryaspackv2backdoorbootkitdefense_evasiondiscoveryexecutionimpactkeyloggerpersistenceransomwarespywarestealertrojanupxworm

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2039016743-699959520-214465309-1000\KBBOLUBOR-MANUAL.txt

Family

gandcrab

Ransom Note
---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .KBBOLUBOR The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/216b8f61ff7a206a | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAMlhWhkTfnJsAog7PM3IVXmeNzI6ZFwE009i3yddFVW4WFQt+7vmc2Bz1tQ9j7Xh9CgRf0tXrRdxdwhHCbnsYkjtpPDxWsv1QjoIgL856xgkt8oNmlxA0/ny1+Vv4EBAM/jMWb6yVAtrgykVcX3/1fobhv/xMT+0jW60Nigy824e7K47V/jUDGPUPxhMAj/dVq8iE4Wo2ymzMFpecMw1NMhLxKxuioHMSwws/7DaY92bzkAB6a8lGJEqYrIWk6wveIDWqfc8nNwprazf+Sx+I9IaX12DRjBp7o1bI7yvWaqsMUsTUNcpNsJxl/dMIwYNOGdt8jh8S/ECeUsqBIfhVj7PmNDl1SFlmBqSWfbzPBELlIHvaksWW36WifJ0SFM8zyHEQCIJS09wFEs57T+lZnG0FNE9Y00FOf3qgCW1Pfu1YbOEoyRr0oy/sSKdedBNTA2AJ/isOEjRZx5AklGWqSgf2AGnSJKeo6+hef7gXI1PD7nGXl31Q/qxAYePQXW2N/REayzMts1UjPlETIjK/p8Z+kyfZkqsd7L5DGwKpShMP92z1o85KOp0KkB4aKiJqYA3KvGwulUQMHTIyvevSsj8t2BTkj9af7nAQyuwx6FMojWvMR7KJSP3knljUrbrpD/zzIINeLKFK1HiybDhqyP/WizgKG/5cVUYTlTrlhMyyfsdCcX3D9vHxG9qPGfkEFtvvDzwUqSyFNtOeKK1jOH8ylKYkaTu5166Ola0FUZBJsqMgEtrBZB96cme0HTovAAmsd5dCvlZpvEJ7uyDIuaZeKS6IVAoDL5LPsU++YwXYviJ50RBNkS5D9WvFWKo/ekAxPaAGRQAez/JhJkhUZmUjZsKPJxzqlz4gGX1AzOu6ZVcDpXDeLsuisflx6A9kQR19HcspAThBjlPh7FPNraro80NaVPnq2Ok/j/gvsJ1ajtL43dx1V7JMhHuGhVeybnqc7SNoEh8IRxYuW+bYG7OSui5rXaca/i1L/FDRzyeHIjYSGHRlE+wv44HwR+SvZ81NHdk8MMs4sicAtQNHpL4jRPU7gzlk+V+3pXfwOlRdzWosGEfrx+HSEtrkMhFHGpm30Vb3Z1tmfpIFl6wxt6aofS8jgl+cbecVGqX/HVDe9ApG0Qk9yrynopwlZzFfZsh0+7uHWYW/sjUXJUBDR0gFtBVwZVRc9n8IvW+MFrHToAmttDeMoVz2e4hxc0HhFN6RwMWubm8aKyiKO+1kTd/meOzMZQmfe1JR3YXrG17yZfOmnRQrXFscyI4fqqOy4ib9w6D/Br/ZnsRZT9p27I7UkoC/58sc9GydGYi8CvBbj287AfCWGfKvSM0dYiZVSf+ovePFrZSjfxGpDGgnm8ktRcXDvfxw0R74a+bX9yrjMMj1QCSgUcRZER5N9YhIfb1NmE3j71yYo/XLs2kddeB+mxz6hXA731MgrM9PJKKWNPHRfOQ++rxtBM89DQKZdAoDx1b3lA6vfw/SZO0at5/Lh2VZh8n0DBFJEuQeqahSRKC0WNhlsAHbaogCit7KnqvJFiM/C1Uy1H0SWcEk6j27m2MnrwdPHRhMRvAVXy5343ULs7Nlz6W7q3pyHX6HVE6Xxb9becjzZJGBch+OB2NxQR2mlQUHL4PFYJfxD+GsKFoqlbQzUmLDIewhpVwCjfMHJTmyF1FaLtlq0DW/9TdZL1jm3RQde61giNFeWWhkLOJJv1LLTYgT72Ml/ZmDZhvdR+SMcGpeXwfFIbZObfU1XIyjci4RQBJUkC/Hw/6HZS5vKDi5cRsA0kaviKp0/tog7EMoerbO0DPT70p0W4aDFYabkrEb5g9rQIoxF/xJMShBQJswDVPhYkR0h8GO0e29uvbqNMkeAMIjWmXlq2tTHGvAIEtd4vlKLL27V9hIbWVeXWSiYAwQkB80/sAanfa4mDNf+ldkHwwwUd/JHvPo599NHsG+aArjG8bNulXBlrSLEtcjdHnAGj3xuJC2N16HAv8PXSiPHRAbTMzkBdDhDccEl4ZSvZ63Y0ELtO4tXk18Mn6eOx3jXG+BLryFFxgaZltYdsNj/2wp1vCbgWmU8dOLVsW42oh/IVLwWsPIOPPju05HpCy+PunsFc2cB0u/iJHdu/T+8QBQODse3p+K6jAT1WHIyLWk/WB2C02CDgT3bl2scNjY0DAfKj9Zt5NaCrJ/22kiKVUjWsglj8/00+nMm8rMc5YUZomYfGLKSGXyK97BYOwFET1qp7kkW3OGTg= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDu9NXJOJDfAvGVt+DZRXLIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMoT7rCZdO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2mU0R7+dxfWLoypoW25ypHEnKnMMuBl1Cmehqo5VrrnNSZu19KSVzOtTAymPz79ICyGBkpCKj0RQwVePfN00RSBCDEtLyJL9AFBnJqqMY/R7a3Z7HLmYWRjkeAP9/yrfNzLOzjDaO2rwVWxuZ2TzbJpvbdL0N0zPfgSzCzhqApoTPFpp2CPDOx6ihEudzoNVoM6j2VyOmqqBpvYrwCrtwyqi8O1f+lXjmS7ql4GuxOgTOwQUyhb/ofzNwkLQejqrjTwFji9zPbKPSghI2dWKf+5gkQvDGihIFeEvlEtyM6ANvhxdQRIFj1CUHPyeWMbZ0K1g0/7uRQeyoEinT3CrvrP9dFPEuVIcosLqYb4AnecHqVubCDEZSsSLSNnIyaZEI9b5008FGYczrSlaIGDBHFzoGoqA9wiUaNxMzG ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/216b8f61ff7a206a

Targets

    • Target

      freehacks.exe

    • Size

      105.5MB

    • MD5

      4647bc264b4344c7ca47ae9adc130ba9

    • SHA1

      08280768ffd55e06203fc8f13d3e6f1745c7ee0c

    • SHA256

      742e3f0ca6967c947c99cbbff7f3eaa7f5059a1bba1714a20afee3d85312a439

    • SHA512

      9d2a9f90746e74819c441da86086fc716f2e9f54fbf77e4a1cfec2badb1d64b9fe0ba3e3f5304ad797613c27cb038fbddc551d4824b6445ab5f8d063e1424981

    • SSDEEP

      3145728:iZGbexf7I4RniT0BEI43vBrYwY+pOhdFs8rBb:isbexTi64/Bbp0KG

    Score
    10/10
    gandcrabhawkeyewannacryaspackv2backdoorbootkitdefense_evasiondiscoveryexecutionimpactkeyloggerpersistenceransomwarespywarestealertrojanupxworm

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Gandcrab family

      gandcrab

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • Hawkeye family

      hawkeye

    • Modifies WinLogon for persistence

      persistence

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Wannacry family

      wannacry

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

      defense_evasion

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • System Binary Proxy Execution: Verclsid

      Adversaries may abuse Verclsid to proxy execution of malicious code.

      defense_evasion

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Direct Volume Access

1
T1006

File and Directory Permissions Modification

2
T1222

Windows File and Directory Permissions Modification

1
T1222.001

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

3
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

System Binary Proxy Execution

1
T1218

Verclsid

1
T1218.012

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2
T1490

Tasks