Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
24-05-2024 23:10
General
-
Target
701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
-
Size
183KB
-
MD5
701afacec588c55ddce7088c8fa65b93
-
SHA1
1808efc4b1e61e36b3e3e04a26b92034d74f006b
-
SHA256
08b0ec21722d740e19571aadaab15778ac5a8a85274bfed842fddfa8e4673ae1
-
SHA512
5d944e848c0754c229e95c3f3caee5255f693b0e84bfefa9d663a3e3d5e51918c01c0d2092514805dc581b7414233a49b7c6f2eee64ce482c4b83a8e692e7dec
-
SSDEEP
3072:Ealy19emgKe0QuYS3UmWuDTEltI3S/7IarDrjCgrQp0MUW:EaqxxDwx/7IS40MB
Malware Config
Signatures
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (294) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 22 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 45 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\$RECYCLE.BIN\S-1-5-21-1337824034-2731376981-3755436523-1000\FGXZN-DECRYPT.htmlFilesize
64KB
MD5a537daf2328452806702ecea6caf58e3
SHA1a0c823e3dc942649376bb78e5cbbe9b789106101
SHA2568f13aa3cd3ae5ce0a961674d7b7a3716eb470f1624239421e2da7a8468e88976
SHA51257625e4acb671d1c2786a8a2847fc1e865292522bd813203a05036d6ba8e4f4b6f5c03bdafea671015d69fb82e1795d24430ad74a505f943da6cda3fdac13009