Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
20-09-2024 23:55
General
-
Target
eeaf2df9b452d043891bb5b1ab54a068_JaffaCakes118.exe
-
Size
690KB
-
MD5
eeaf2df9b452d043891bb5b1ab54a068
-
SHA1
b3c1a492692fe91ed8fb582b9f276ea3a0a8039d
-
SHA256
f018326456daf09fc5cab41e9254d6ff1e8320ffd74c87668ba60ab27a7a0cb7
-
SHA512
7d21768e3a7cb737638de353abc24a70aa77b3c927891eaab25f8c1a848c9af86b9c9e19c717db621beb4d96d6fc39327f2328f1857ac6bfb1b260d8a3d3a3e6
-
SSDEEP
6144:Pi4Iy0HZxn7FBVmlwFuqeYq8s8w9Mq2CcjKX:Pi4IlHL7FBGwFP88Rw91cg
Malware Config
Extracted
F:\$RECYCLE.BIN\URROYVNTIB-DECRYPT.txt
http://gandcrabmfe6mnef.onion/a81b68c4e7218d87
Signatures
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (265) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 20 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies system certificate store 2 TTPs 8 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\eeaf2df9b452d043891bb5b1ab54a068_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eeaf2df9b452d043891bb5b1ab54a068_JaffaCakes118.exe"1⤵
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Indicator Removal
1File Deletion
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
Filesize
342B
MD5f2f9c9beff09471b0a089a7ac2c9e2d3
SHA1d17e7c1700dbf87a46655f4b82ff74a1e0131027
SHA25697929cc38d8fb943110904e39a95cb6cbd8f2cf2745e62a18dc973a4cee57151
SHA5128bb26a48cf94c4add10e80df268f7e0c6d12c544ded04222e92436c588ecb4835bc74833f5eb963194302278fe7b966053fbd5f50ada2832a6ae0c5870600121
-
Filesize
242B
MD58ae30357bea5745f111b21733cd76688
SHA1981aa1959961816cd43529f4d87668d6b8ef18f2
SHA2569637119d5b18310820b16ba18d935d1b5bc398907d13f8b3951a1576646ea13b
SHA5125244c5c6c768229ecc7d435ed1ecd4f27f637d6a2f35a6d5f2966edd0882c1ba7b2d9708a41576fc8a252e4689fca399ef4ad3b5e48f1e636e901666def72891
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
8KB
MD59b575750ed6ee648be95e35775df1f07
SHA14f27dfcdcb5a3cc6b9e134907353ad194844c1bf
SHA2562e47292519a36fefa01d1ba52f9e68825cc7c86328a85283439584e88a276918
SHA512170a0045df8365b604dcd07373ca22ab8bd9425ec0e810a2a265b2cff36d5c22f64f34992d0ee585a38ccc6bfb526cbc960f0d04616b34ac92a52fe5aedec46b
-
Filesize
720KB
-
Filesize
1024KB
-
Filesize
160KB
-
Filesize
1024KB
-
Filesize
720KB
-
Filesize
160KB