Analysis
-
max time kernel
51s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
19-06-2024 19:43
General
-
Target
2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe
-
Size
91KB
-
MD5
9c59dda483facf2ffc068442e0dfe91d
-
SHA1
8151fec10267140e71a20f2a348d7b125cd7f4b8
-
SHA256
6e85c16717cd78817d56611151b9180eb06ca48268244a649eaf30de6e16bc87
-
SHA512
838dde099a696a6c327dcad0718bf1dd01fd2d2a35a438b1fe1576cfe32c2e9188b4c1a3a480f7dd1c4dd683ffaf9bc931e4b8b379d9cacc3b120b03c1e61a2c
-
SSDEEP
1536:WGdg6A8xXaHuX39Ev8hGijIa7DdfQZblriWU8BFXOsWjcdS6ItKT0S:JZqCZjIGmrLrJItKT0S
Score
10/10
Malware Config
Extracted
Path
F:\$RECYCLE.BIN\S-1-5-21-1337824034-2731376981-3755436523-1000\KRAB-DECRYPT.txt
Ransom Note
---= GANDCRAB V4 =---
Attention!
All your files, documents, photos, databases and other important files are encrypted and have the extension: .KRAB
The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
| 0. Download Tor browser - https://www.torproject.org/
| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/ca083b2b468e870
| 4. Follow the instructions on this page
----------------------------------------------------------------------------------------
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
ATTENTION!
IN ORDER TO PREVENT DATA DAMAGE:
* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW
---BEGIN GANDCRAB KEY---
lAQAAIZKGfMrGcLHWia8a0brcPrPr82hYN6s+5OPnmwhGQehnl3aXNFVvmWk56iNz97uYqg7BFuD61tgLj2ZVM7F5ezo9Xq2gSTYd7uJ1VtobDY1mgMxI+Fw6oD1vV8tN1UxBSH36/7jGU013MszYN+COu0SXEKEzHpN2Stcwakg5/mtY4fyAtKAV0E7XFju8hJuqk1CHlTztWh27BUDgSCgO/RNh/sC8H+1YFs8g1a5JquPy3A1v4KVxQdfNPlA7mw6NjCYUohmUxsOepbqIo14hd/mceJ20Ho9P4dtCAJ2m2iywr1YbDQIhYJaIXNmc5KkW8vzToKcwWWk5dkT8H+YdFTM92gHzxtDjf6rrPtLqEn+YqJSxOzJainDT9sRaAALtX9OQx2gyrI3M2jhz4c0HH0wiraITKP7f3Am6NfoWY2lMk7177pFWnSgUEHZHa8T95zM2PC/h0Cg48fI8Cs/+i4g4JcJJRB8uMih8JHYjjJyoh4GVqA/4tX/RqyO2A1a1CnnxOXYO2zs2kZWZ7Z0YiQ3kxy4Thil8aAwVBOAZkQpz8VyNKr9qsVOmZTzrNCaB/koe32QN1bMLoQh9wgS0Zs0bu0kf4QolF8mzsjhVgpKEESdgR8cqgJyBnC5TQYQOQSqX6uT/5ztmASR85oQIPEXyfYBlJn/CrGqek0Cffy9TdNBw3+6iHwqcAWyLU7IsVZ+kknFgYdiLGW2+TrkFv5rHveZ9zWgkksCexpeaNLIv4Gs4etvHAQR2fhP/LZeLP5m9zZetswSPu0NT0OyWz3XEL7dE2gHax41O/AciniYzZmRNSaoPjYdvxd2R0h9EIUmUno7X1Qf3FfJvb5GyUkWoc28nhh6v1ht5xtzoAf5HfOCP3yHNj3QtAUxjhcy5E6Vjq0rixnyR/KAH+Lx30o3CGNzduvBEZ6nFVrYlVZsok9XPzKSs6KOpamrFPwmvThAAhr/yHbXodZ5s7986gEZHQwxuseYWMQhNxUybQkdHJXoeBDcNvlPvoQ/ctpksYKRiHPBCpbBjXbShdoF7M0vnv/Pe7MIwkeyIbYD10PW4dOh5kLhgEa9Jul54ExnClaLcThUeWKcCjuyG3ydh8w9EmxU0kkm++brnejH3l88L7Hb//LRxHOPR8V52CADfZH7S8ZQDTm9sUCRHJgSnTmyopUng/yxZtSZbhiWuFOpw7bHjMzDXeZ1+pSLtia8P1uBvn8RlH/KwzmY0UTZpzcCtZX4l6LSIGnCZprVw3hZYHn6SRvE0PqiFsUW7hWssO+ggcoZmMf4RhLiKrTH02nOiBXD/X0vesXz9cIMcy9ziyD00asrTUbzFlUoKq6e98s5yqlBOCA2Ps3CJfSAzD1+Uwp+jNm2gRDsuyzdamLa0d4uKe9Ec69rjkJCM0GEpEicksPCbMxej5J7BrpBTRGVybx1GbO4vW+UnJCjk4qlHDFx+weYhh3LdQ8TyX8K9e6GUU3xp+BnJ5MKDNrqcsB7pUNmOrRVFL8NY4PgUS14HzExBNXQQKaTHW93ZqIzegwBTBceX+CS3Cy1XJHhyN/CLXVIlgqcLmIEevR8oL6/TSWT9M5N4HxNcTkhr5PQ9sjoHm96M/h6G9q1hufxvPPg6PN6a6M42hWAfEW4X+v054Xgee1sCIW8yZRZ8bzw9Ss4r/Qzfg0hcFwGUpKJ4muaNYU7oraSHlbFeNf+c5+JHHzQ+gYWRK2ZSSM2mMkoj1CBXsglNLsdIzt60IGHqmxLNV0Ccg7dF93GR43umIXeCyLs7xWIC2giY6o4FuokX42cTZpddK/1tQUnoihUPNOPMDKhATvRx89eYFpKuVKR8uzCIE+FIYvatdpGSHXvLZh3pwk7NF31/+q/Kcy5QsAuQCLXT7px0t/Z2+DathN4Fm00KdASQlUOq6DENQLQcBhaVc64qWT8NTplr9KyCZeQN3rLeBuFY17jnYqI/2TyZrbT9m/+kMF1mLLG+f29Pc89VKy5bXSbLnoUw7Xp5c96P+TSXiwMJxVsBICESP0hKv5A88eAUyDHPZIl5B12xqVAz6STZMoCy/ZS78gd90mSg8ELwwukbOr5NVmkgRHzMV32RHfuth/TkUqr8ZOgcjWD1Wu2xJzDcVJWDjE0s8FbljsQjzIiJRQ1Zd86RRzVdB9AowaAZIMH/z3J/pbedWtDBdibtozOGDNwgSReCmVnMZCE7X9cJ4XxeXtqbVIr4qnemPqeTPHE0ozRnAr6iKt+S6E=
---END GANDCRAB KEY---
---BEGIN PC DATA---
wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZVToFRrHYU7nFWtbfBTHKHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXBs+L1/2Y2GeslGolYblrRBiPtqxHeEYwbqScV4tm4Laa5Y59yPYyu2Qiiy5RtTRYqBlPKJPYJzJFqwNcoBxPInKc+DO5cALafi2Eyg61rLg32xAxKww72ZinpCBFM3vDLN+at1wYZMnQURkmKCjnb1ifgDX9lmT3f7CydQUtnnLIqlsiw73IGVY3pfjf3fBwceMB8P3BNg39XQ3DC2aZBEuHtLEi+BdBMOZH4HpsOeb/YRZoP4YksV8zuv7OczMv9OXYAh9gzrewdRb9tHf+DbmDW4OIcXpReLdQr9A==
---END PC DATA---
URLs
http://gandcrabmfe6mnef.onion/ca083b2b468e870
Signatures
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (278) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 21 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 45 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe"1⤵
- Checks computer location settings
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout -c 5 & del "C:\Users\Admin\AppData\Local\Temp\2024-06-19_9c59dda483facf2ffc068442e0dfe91d_gandcrab_karagany.exe" /f /q2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout -c 53⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\$RECYCLE.BIN\S-1-5-21-1337824034-2731376981-3755436523-1000\KRAB-DECRYPT.txtFilesize
7KB
MD55d0e763c09873f733486c7a8f6a8b264
SHA17169d5ea5da89cb5fcfa333ecb0ef2f2a67113d7
SHA25692fbe5d43b21d44f05d0eba0799f91128fc6350bdd241d820753db15f86a40c4
SHA51293b9857e93b82d101f8f04244b86d008b7996d3c959a08b1e884a5ecd9f4c90dbd14c7377dc3fc77b0a8c1baa4fa1ee0adc40b603806443b322d9300ae557a95