gandcrab | 2b94a1ef590b4d82ae9cff8d771a738dfe672e8efa24b696ef686da1ea78501e

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30-03-2024 07:43

Target

371de1cf9d7da962f423a3ff1ad9bc52_JaffaCakes118.exe
Size

244KB
MD5

371de1cf9d7da962f423a3ff1ad9bc52
SHA1

c913750e9fb78cd6687555e9f64d60c5ebf16aaa
SHA256

2b94a1ef590b4d82ae9cff8d771a738dfe672e8efa24b696ef686da1ea78501e
SHA512

98d3b6a1844f14307f1f2b52b82b6cb432035bee74ebdf04b77161dfe191439f010d324c62e09d7bbbe48c89a0fbbce0c00b61f2a1185dec7ffbfd82ef16758f
SSDEEP

3072:JyQC2mC/zuw10GGQ++vroMTPjg/2Y2KfdkYq4vjC3IxbOaeOuMkBAOE6lLxSPNlm:uKuwvJUdkqjtbwqkmOVlLxSG

Score

10^/10

GandCrab payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2356-258-0x0000000000400000-0x0000000000499000-memory.dmp	family_gandcrab
behavioral2/memory/2356-259-0x0000000002220000-0x0000000002237000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab
Drops file in Windows directory 1 IoCs

Processes:

371de1cf9d7da962f423a3ff1ad9bc52_JaffaCakes118.exe

description ioc process

File opened for modification C:\Windows\win.ini 371de1cf9d7da962f423a3ff1ad9bc52_JaffaCakes118.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4668 2356 WerFault.exe 371de1cf9d7da962f423a3ff1ad9bc52_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	371de1cf9d7da962f423a3ff1ad9bc52_JaffaCakes118.exe

pid	pid_target	process	target process
4668	2356	WerFault.exe	371de1cf9d7da962f423a3ff1ad9bc52_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\371de1cf9d7da962f423a3ff1ad9bc52_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\371de1cf9d7da962f423a3ff1ad9bc52_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
PID:2356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 488
2⤵
- Program crash
PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2356 -ip 2356
1⤵
PID:1044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4012 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:3640

C:\Windows\win.ini
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2356-256-0x0000000000640000-0x000000000065B000-memory.dmp

Filesize
108KB

Download
memory/2356-257-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/2356-258-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/2356-259-0x0000000002220000-0x0000000002237000-memory.dmp

Filesize
92KB

Download
memory/2356-263-0x0000000000640000-0x000000000065B000-memory.dmp

Filesize
108KB

Download