Analysis

  • max time kernel
    140s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    23-05-2024 09:09

General

  • Target

    6a7072df1cee31eefc15368fbb805f9d_JaffaCakes118.exe

  • Size

    645KB

  • MD5

    6a7072df1cee31eefc15368fbb805f9d

  • SHA1

    fa2499d515b2395814014ef6c6ed2c4149fa8a9d

  • SHA256

    7bb4305a647d0126fe5f984549c3b92bcb6af11719b78112f6d795eaaecf2e6d

  • SHA512

    3a57f9b48bee561f6f3645195f73bea1d9c676f6607ddc8101227d929525b8844ac94694ce1f29b2dc8cba84708c3de8f6ee6b3e6234b80382f96201e17fbdaa

  • SSDEEP

    6144:oog5I9axysg5OPpO7zwGtqhyRBIZi4zVh2RiUX9o:Hgu9my/5OPp+zwMSlHXs

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-2248906074-2862704502-246302768-1000\RWJMLYTSJ-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.1 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .RWJMLYTSJ The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/1244a3b28013bd8c | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAAYL9F3g3BAHH6hAoycRP2Cy1OOFM4i5qR7dP3f3iZrnosRNngD6k9O37EyL/GSdVDcwwt+5onCXV9wvWps3PTO44UYTnh2RQHhC9XQJyx1SM6hDITrH2pDbqM5fBJTDEyJRd0tqoXSniifGsCkJD9TwomB/zDbQ3zl8MPg9Q+lCFwzm9KQDAGR83BZ1N4+4ZbYcxK4imZw3e/k9OjmxmBVcol+Ch1c5ZyM/4/I0J+J6OfFWxmM4HVg2FDqZv3nhAbQ0f+1JW3CosuKNB9ZTwQoJ9OB6n8ED3qFEqt9Nh5TBRycOKRXfqtf7ILcDLy8Oq9WQTXBu39GRK/81ZjhdSBarmShRWZPtAsb8RTQ2yY5pa8dD+j/9TCDzLWWmZzUUR981pf7vZTD57qMoQdPxBEbR7Zc0JASnKLEvwHJwmpqiWagVFOsaQpAC9N+AZ0edG0nA0UdJq3cOSjuZvtuQmaJo8BPV+O+VyZIiNkaag+GRPBbCRC+PfbrxTb8Cg3nUvumdXL9iEvdUnVKgrDkjiTTO0pRYuIdbaJXE2Tt1MfLFYCqpK2qeBTv9oXPaifsb6l2fW4+qVrPh5CEIN2Q5rulZcM5k/C0Z+cri1PQfrlUY2veWlviydviltiyVvlT22ak9sa7YAqDRQVhTRQL2OPg+cM0MNFkbpiP+lXPimaNXRK4gp5TieQz+6+D4fsdLlUx2nGyRHBM0SQJ0mvmxTmXEaw2Z8vhLkNxAQIjffngtRsg3clTZrwdYXrD5woNj1r6y5gRp85lb7Vr1dfjLQ6wWzcsPavCEXFOzD2WcFzNbjyaUu4VOXvGo9qpfdQT0zhuxVW+Hhz8Jr6c2UzqgELkU15z5hEmQxtn7VOFzrmwD9h+pE6zV37hijDeUY3+LVnNu57dzKX4gPprOL6m46V+uzKu6hLhrMmy5vS5ZFDiq9bnjZGuYUGmyhNIQYWfspELhkb7h2V82wnFiyt2VeJ/6wdkjUrI7gCM2u3cv+PYsr8iC/JqsyTo62FNKf1LvGUyYHdFl3W+N8dMl13SXm/KBBmg92ABgtHhdlP8hlriGancs+HtBeCBehb7QWJncoy0C7Rl59gRtpgqPgMwvSjNdyAO5eN1ulu6z4KseuSwAChQH7surJMJXovbWQUdwov6MUklKKFsgwHQ70ERbM4gpfA/nxdY1lE7OtCbMEmmYOtmlGag+4iyceWo6Q2FjpcUOze/ZKSfxvaiIKJ2PTjrNySh0TFEAzPBXuWOgjfWhS7mhzSAdL1UfQkRPzjPp+FJV4IlPQgllOj3KeCyvhQxDgyJ13Pi/f2GcuFh1juxiuWRJxVNAQR5BCUInNbZcf7Llz/+og4wu1f4jnfHV5jqVv3yS6MH4yr/4Oj9bIdtDFnUwhM/yzSUA33dli8E2DuSy9aJaN4Jh1jI4imHouRL7dGSyosCte4HOF4jRYdcJKN30ZaOdCBQxdZ0WH+ZkM+H6ZOIfHCAVZqcCAp0q/DOx0ex/8UDYhXN74g2n54YtIx0N11pL2vli5v3Kxo/KHGFyUqA+DzMbwyBlClq4ST7M2HdRMHs+wFnQtXijWWLXVxtjZAeXqwCJbyZV50ZHMiH4mEnkZScNqEPXcIZVupFXiUoub+h/NpmFlzM7KkV3stEvBeH57k39Ti2LDkzCwomZpTJyQPdTRhDVFlo6xor5L44kbTlOaEFD/vblV/OciC+PZMzpX3NaE66d9UEMrBYSCG1/p7jAJGAGwrm+wBx83p+Nadh6zG6Q9scjqKC11MVsA+0MaAQ/ZgAU4CocUOL5wSeeM4B7/oy+MxR6fUG/xjakt1G9pnh+TVLO1tDuEINZzp+BD73ittRmAXDH6mI/s8mGJMKpW/wc9SXJgIvnpGXSx/D3WGeRPKH8RAB7Xkv05rbZzyOu1rmaesANQwslftX36cq4WEeQ4H+jJa06Mvb262wmqdDHMxRyYLBJZqBtQhJCpDvzsBivSeQrvHyQDSIi9NiYFw7tPrlZXGYGWxXlRFREBBglNBRaRYUFpsVIpCXHiKGRFvNs8UIps/X52ypJh2jxbgRu8sp0bHPQ70xIz+5Uz6HDLkCTt/DnBI1l7Q+41VaomEWLgGL8CUvMxtgACBW0xqhPCdips8sbvH30lfUrYNnA09MHrzbN7n6BoJgGcL4HLzzChq7IJx2FFOuDJ5ep6/sAC2O3DYxTatEb/mqLr7NilmJh6mS8ZVqDoNcwjkDs9FIGjwY/FWdYOXQ= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmD59NTJLJDAAvaVouDGRWjIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2mU0R7+dxfWLoypoW25ypHEnKnMMuBl1Cmehqo5VrrnNSZu19KSVzOtTAymPz79ICyGBkpCKj0RQwVePfN00RSByDHtL6JedBcBidq/MY8R+i3MbHNmdeR3kfUP9Hyr/NzLOzjDaO2rwVWxuZ2TzbJpvbdL0N0zPfgSzCzhqApoTPFpp2CPDOx6ihEudzoNVoM6j2VyOmqqBlvZbwDrtsypC8D1fKlVjmT7qd4GuxOgTOwQUyhb/ofzNwkLQejqrjTwFji9zPbKPSghI2dWKf+5gkQvDGihIFfEv5EsSM5AN7hzdQVIFj1CUHPyeWMZ50B1h0/u+RWez0Et3TBCrbrZtdJPEqVK8ohLrgbsAnNcG2VuLCZEZKsSbTenISaf0Iib4k0t1Gacy3SiKIADBDFnYH2qA1whEaNxA== ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/1244a3b28013bd8c

Signatures

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Renames multiple (288) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 41 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a7072df1cee31eefc15368fbb805f9d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6a7072df1cee31eefc15368fbb805f9d_JaffaCakes118.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3000
    • C:\Windows\SysWOW64\wbem\wmic.exe
      "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2272
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1596

Network

MITRE ATT&CK Matrix ATT&CK v13

Execution

Windows Management Instrumentation

1
T1047

Defense Evasion

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

1
T1490

Defacement

1
T1491

Replay Monitor

Loading Replay Monitor...

Downloads

  • F:\$RECYCLE.BIN\S-1-5-21-2248906074-2862704502-246302768-1000\RWJMLYTSJ-DECRYPT.txt
    Filesize

    8KB

    MD5

    93e105c3dc8647457c134f4d93e2eb48

    SHA1

    78ac87203f1a7c994bba6398c8fb66c8d1f205d4

    SHA256

    710393144785f315a2a26753277ecc6ff401a1a447083be5b2b3ccbfc130f6a6

    SHA512

    2354d01c6600e081e80fc9d375d93aeffffa14d314dc47cdde28cf7eecb4ddd0b962bc9e39aa93a77cb59cca48e59a90494252d3f90b3c5c8c59643606b641f0

  • memory/3000-0-0x0000000000400000-0x00000000004A9000-memory.dmp
    Filesize

    676KB

  • memory/3000-3-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

  • memory/3000-2-0x00000000005E0000-0x00000000006E0000-memory.dmp
    Filesize

    1024KB

  • memory/3000-736-0x0000000000400000-0x00000000004A9000-memory.dmp
    Filesize

    676KB

  • memory/3000-737-0x00000000005E0000-0x00000000006E0000-memory.dmp
    Filesize

    1024KB

  • memory/3000-739-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB