Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-06-2024 19:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe
-
Size
91KB
-
MD5
9c59dda483facf2ffc068442e0dfe91d
-
SHA1
8151fec10267140e71a20f2a348d7b125cd7f4b8
-
SHA256
6e85c16717cd78817d56611151b9180eb06ca48268244a649eaf30de6e16bc87
-
SHA512
838dde099a696a6c327dcad0718bf1dd01fd2d2a35a438b1fe1576cfe32c2e9188b4c1a3a480f7dd1c4dd683ffaf9bc931e4b8b379d9cacc3b120b03c1e61a2c
-
SSDEEP
1536:WGdg6A8xXaHuX39Ev8hGijIa7DdfQZblriWU8BFXOsWjcdS6ItKT0S:JZqCZjIGmrLrJItKT0S
Malware Config
Extracted
F:\$RECYCLE.BIN\S-1-5-21-2297530677-1229052932-2803917579-1000\KRAB-DECRYPT.txt
http://gandcrabmfe6mnef.onion/9dd94b9e4673f81c
Signatures
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1372 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exedescription ioc process File opened (read-only) \??\U: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened (read-only) \??\Y: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened (read-only) \??\E: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened (read-only) \??\N: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened (read-only) \??\I: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened (read-only) \??\K: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened (read-only) \??\M: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened (read-only) \??\T: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened (read-only) \??\Z: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened (read-only) \??\B: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened (read-only) \??\H: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened (read-only) \??\J: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened (read-only) \??\L: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened (read-only) \??\O: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened (read-only) \??\P: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened (read-only) \??\W: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened (read-only) \??\X: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened (read-only) \??\A: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened (read-only) \??\G: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened (read-only) \??\S: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened (read-only) \??\V: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened (read-only) \??\Q: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened (read-only) \??\R: 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe -
Drops file in Program Files directory 30 IoCs
Processes:
2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exedescription ioc process File created C:\Program Files\KRAB-DECRYPT.txt 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened for modification C:\Program Files\OpenRename.mov 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened for modification C:\Program Files\UndoReceive.scf 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File created C:\Program Files (x86)\KRAB-DECRYPT.txt 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File created C:\Program Files\4673fff14673f81c41b.lock 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened for modification C:\Program Files\AssertUninstall.pptx 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened for modification C:\Program Files\RenameHide.bmp 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened for modification C:\Program Files\SendOpen.m1v 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\4673fff14673f81c41b.lock 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened for modification C:\Program Files\UseMount.pub 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened for modification C:\Program Files\SelectDisable.raw 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened for modification C:\Program Files\UnlockSkip.dib 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\4673fff14673f81c41b.lock 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened for modification C:\Program Files\GetRemove.vbe 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened for modification C:\Program Files\HideOpen.csv 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened for modification C:\Program Files\ShowLock.rm 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened for modification C:\Program Files\WatchRead.css 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened for modification C:\Program Files\EnterConfirm.avi 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened for modification C:\Program Files\RestoreEnter.AAC 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\4673fff14673f81c41b.lock 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\KRAB-DECRYPT.txt 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened for modification C:\Program Files\PushSelect.css 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened for modification C:\Program Files\UninstallUnlock.ppsm 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File created C:\Program Files (x86)\4673fff14673f81c41b.lock 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\KRAB-DECRYPT.txt 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened for modification C:\Program Files\RedoDeny.vssx 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened for modification C:\Program Files\RegisterSplit.emz 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened for modification C:\Program Files\ResetPing.csv 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File opened for modification C:\Program Files\UnpublishImport.xhtml 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\KRAB-DECRYPT.txt 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1872 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exepid process 2112 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe 2112 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes:
wmic.exevssvc.exedescription pid process Token: SeIncreaseQuotaPrivilege 452 wmic.exe Token: SeSecurityPrivilege 452 wmic.exe Token: SeTakeOwnershipPrivilege 452 wmic.exe Token: SeLoadDriverPrivilege 452 wmic.exe Token: SeSystemProfilePrivilege 452 wmic.exe Token: SeSystemtimePrivilege 452 wmic.exe Token: SeProfSingleProcessPrivilege 452 wmic.exe Token: SeIncBasePriorityPrivilege 452 wmic.exe Token: SeCreatePagefilePrivilege 452 wmic.exe Token: SeBackupPrivilege 452 wmic.exe Token: SeRestorePrivilege 452 wmic.exe Token: SeShutdownPrivilege 452 wmic.exe Token: SeDebugPrivilege 452 wmic.exe Token: SeSystemEnvironmentPrivilege 452 wmic.exe Token: SeRemoteShutdownPrivilege 452 wmic.exe Token: SeUndockPrivilege 452 wmic.exe Token: SeManageVolumePrivilege 452 wmic.exe Token: 33 452 wmic.exe Token: 34 452 wmic.exe Token: 35 452 wmic.exe Token: SeIncreaseQuotaPrivilege 452 wmic.exe Token: SeSecurityPrivilege 452 wmic.exe Token: SeTakeOwnershipPrivilege 452 wmic.exe Token: SeLoadDriverPrivilege 452 wmic.exe Token: SeSystemProfilePrivilege 452 wmic.exe Token: SeSystemtimePrivilege 452 wmic.exe Token: SeProfSingleProcessPrivilege 452 wmic.exe Token: SeIncBasePriorityPrivilege 452 wmic.exe Token: SeCreatePagefilePrivilege 452 wmic.exe Token: SeBackupPrivilege 452 wmic.exe Token: SeRestorePrivilege 452 wmic.exe Token: SeShutdownPrivilege 452 wmic.exe Token: SeDebugPrivilege 452 wmic.exe Token: SeSystemEnvironmentPrivilege 452 wmic.exe Token: SeRemoteShutdownPrivilege 452 wmic.exe Token: SeUndockPrivilege 452 wmic.exe Token: SeManageVolumePrivilege 452 wmic.exe Token: 33 452 wmic.exe Token: 34 452 wmic.exe Token: 35 452 wmic.exe Token: SeBackupPrivilege 1164 vssvc.exe Token: SeRestorePrivilege 1164 vssvc.exe Token: SeAuditPrivilege 1164 vssvc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.execmd.exedescription pid process target process PID 2112 wrote to memory of 452 2112 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe wmic.exe PID 2112 wrote to memory of 452 2112 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe wmic.exe PID 2112 wrote to memory of 452 2112 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe wmic.exe PID 2112 wrote to memory of 452 2112 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe wmic.exe PID 2112 wrote to memory of 1372 2112 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe cmd.exe PID 2112 wrote to memory of 1372 2112 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe cmd.exe PID 2112 wrote to memory of 1372 2112 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe cmd.exe PID 2112 wrote to memory of 1372 2112 2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe cmd.exe PID 1372 wrote to memory of 1872 1372 cmd.exe timeout.exe PID 1372 wrote to memory of 1872 1372 cmd.exe timeout.exe PID 1372 wrote to memory of 1872 1372 cmd.exe timeout.exe PID 1372 wrote to memory of 1872 1372 cmd.exe timeout.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout -c 5 & del "C:\Users\Admin\AppData\Local\Temp\2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe" /f /q2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout -c 53⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\$RECYCLE.BIN\S-1-5-21-2297530677-1229052932-2803917579-1000\KRAB-DECRYPT.txtFilesize
7KB
MD57608ed2b9795abdd4fb624a87ac359c1
SHA19d1bbf35aac4bef88e95afd1c57c50f312ce1709
SHA256828cefa90d14b895a0459e3df36a184240e7ddb0555b01a65ac74b12463fe079
SHA51277a615d7467d19ff5b3d13bae9cea72bda184aaa10cd8bd683bc15ebfbefce90583d16a48f054650969c3268cabfafaa17e9160118c2e3b803a6f5fc0de98d61