Resubmissions
02-12-2024 11:09
241202-m871esxnap 10Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-12-2024 11:09
General
-
Target
b82b65ace1731fe2d694512fcd448895_JaffaCakes118.exe
-
Size
8.0MB
-
MD5
b82b65ace1731fe2d694512fcd448895
-
SHA1
c6de94da7152e237c1f0b36264b14deb32e85ce2
-
SHA256
85639d9a1900703f2ffbf076d28925ea8d5fe4537098fa82dd96cb8eb21d2911
-
SHA512
70bcfc8449ae913ae1e81f90fcb49ce05076b18d495683f101a4353719b3917451e8d507c701790805f6f1484ce6e12935e2dd7a8f1fabb5192492a19ec93564
-
SSDEEP
196608:6CKhIwvgsb87DwQiiFFL4an2L/dfXaI+fVcZ2/:RC3Stl4LL/ZaI
Malware Config
Extracted
F:\$RECYCLE.BIN\S-1-5-21-4177215427-74451935-3209572229-1000\VGUCMIIYE-DECRYPT.txt
http://gandcrabmfe6mnef.onion/baff8cd57d0122e
Signatures
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Gandcrab family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (261) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 2 IoCs
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 7 IoCs
-
Loads dropped DLL 24 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 43 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 52 IoCs
-
Modifies system certificate store 2 TTPs 9 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 50 IoCs
-
Suspicious use of FindShellTrayWindow 12 IoCs
-
Suspicious use of SendNotifyMessage 11 IoCs
-
Suspicious use of WriteProcessMemory 41 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b82b65ace1731fe2d694512fcd448895_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b82b65ace1731fe2d694512fcd448895_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\cexplorer.exe"C:\Users\Admin\AppData\Roaming\cexplorer.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-2273G.tmp\cexplorer.tmp"C:\Users\Admin\AppData\Local\Temp\is-2273G.tmp\cexplorer.tmp" /SL5="$80192,6397385,121344,C:\Users\Admin\AppData\Roaming\cexplorer.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe"C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe" /trialregister4⤵
- Executes dropped EXE
- Modifies registry class
-
-
C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe"C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe" /replaceexplorer4⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
-
C:\Program Files (x86)\Chameleon Explorer\ChameleonFolder.exe"C:\Program Files (x86)\Chameleon Explorer\ChameleonFolder.exe" /update4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe"C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe" /update4⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
-
-
C:\Users\Admin\AppData\Roaming\update.exe"C:\Users\Admin\AppData\Roaming\update.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Indicator Removal
1File Deletion
1Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
786KB
MD5dd5ce4d765edd75eba6f311e6e0ea10a
SHA19ea7f6516e5ad0755b74463d427055f63ed1a664
SHA25664b7f8f70a7b037d10da72eaa769078b7e4d1ac8964c5eae5515d373e816ed6d
SHA512d2782310df7cc533cc9ffaf5c1903d5bc6a500c3bbe48148c1339fb5de19c835e4a8c765da1b80b3744ea231353f76f22ba4e04c78a3d950d7ee291d6eab2216
-
Filesize
1.2MB
MD5de5f74ef4e17b2dc8ad69a3e9b8d22c7
SHA142df8fedc56761041bce47b84bd4e68ee75448d2
SHA256b89a6a57b48be10103825440d2157f2c4a56e4c6b79ad13f729429cd5393bf32
SHA512515e9b498d8cd9bb03f8d9758e891d073627dfd6fb0b931650a47d6e53722aa6e1cc3caff8c0e64f4721ad2abef7a81ef4e7b49952d3c8fc325deb5bba6b3314
-
Filesize
750KB
MD5fb76f4f533203e40ce30612a47171f94
SHA1304ba296c77a93ddb033d52578fcc147397db981
SHA2563de05f18ffe9fda589a45ea539a464e58a30f70d59d71444b018064cf831c4a6
SHA512a416a6d6efbbd69209e1867f12b9d1d11b21160f6dfe07c510b43112c22c317f805c67dd9402744a6c7e1541f6b3a061c49942fe28fa70f74aea670ba9c71995
-
Filesize
1.2MB
MD596f92c8368c1e922692f399db96da1eb
SHA11a91d68f04256ef3bc1022beb616ba65271bd914
SHA256161408b86eed7c4d9a5882aa00df3f8765ed28fa4fd9aab2c9b3dceadbd527f9
SHA512b3d3fb2d78fe2df864f0e07a8bc1610ee9d65251957e0495a34c1631895293590e0fca965ec9deb160f48a4e09a2feabd3bff6fb9a0c22888a941e308de39d14
-
Filesize
854B
MD5e935bc5762068caf3e24a2683b1b8a88
SHA182b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA256a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
SHA512bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
Filesize
170B
MD55adef5bd2b590d5cc1e32f507759b24b
SHA1080badacd7e4d4f432d8cebe7aff125cac2b1013
SHA256c8d195a35e0735d439cb8b20abb5e5e3bd047ef6458a1689eb61d9b24fdf56f2
SHA512291990fb8a076761a0ed49fd094022d12ef6a8a6dab1509a0a738d2e0ad5d605ca4725ab54b82cdc05d77f1ee50ce5347eb76d157318724ae6bb9ea338eb38f6
-
Filesize
342B
MD55f24ccd5dafb54b20fc3fa94af95ac02
SHA10dc12d295a8b9a91fea60e58c96ddf22f0789351
SHA256c5c2fb09ff8fc9ec769e37308301b7325bf77625283186ec83731d4408c49d5f
SHA5124830f81317f97087e36ca32d632185808681e2476118cfe8318f4ef76af4325b79f025200dbaf3e426808e8a93ad8242127cc191daf8105cfa307417c304e41c
-
Filesize
242B
MD58bd3eeb193301cd46e23192811f4b2f8
SHA15527298b24aeab5c2f416afa613778035276a1cb
SHA256b6a90dd4eeb4c58eef27227fb3a0ba48e90d1122beb2c9767080f6f7dfde932f
SHA512461a933f24675ec4f6c75f620a46445ae2d0e84b44f9b30ff895e8ded1cfaae7cb0bbef50cb06315fd394e3d21f4b05bea763f063995143066d4e011c3231be9
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
8KB
MD5f69cc5c6c8862bc12f9c2bc0d978ff84
SHA188e83131b9f1dbb0652f147e5552681593b6aecd
SHA2567f4c5df8bd2d52832eabcf60f06c8504d3a6cacf910cd2c3c97c79e469dddcf6
SHA512a016714e417360e552f618c2ca018627a2bfd55f60f1d1c45aa68ff0f081bc1615e5b3d83c93db388a65e155984b470c18c5729dc4fd5dcfe8b755f0a3140b05
-
Filesize
14.4MB
MD592a3d0847fc622b31f2d0c273a676c0e
SHA1e642d694367cc98a8863d87fec82e4cf940eb48a
SHA2569a9923c08d3fc5937b6ed189e20cf416482a079bc0c898c4ed75329e0ee3ae89
SHA51201d13fd9a0dd52bc2e3f17af7a999682201c99ecf7218bca254a4944a483fd1dec2a3e6d59def501a024ad760b849787902ecb55bd33d23fa9651c0a7689cd1c
-
Filesize
4.4MB
MD55b0ae3fac33c08145dca4a9c272ebc34
SHA1940f504d835fc254602953495320bb92456177b9
SHA256137723bdd388f6e5a50b7942eff02f4cc70e6b86d8650a41f9e8956ea1e4de3b
SHA512015ffc133ad3a6937222bbc057f68b60abfe22b900b5e7c4e6ca3ec7dc6b09abaf54b595f00fa9212f370da8531af1ac5fc52b39953e1f685e81c66d1ec61f8a
-
Filesize
143KB
MD5246aaa95abddfd76f9166a2daa9f2d73
SHA10467fa8567b71f6e3a54d152d9ea77121c627798
SHA2563f6880605a97ffb9b14cd97419a40cb2ea6cefd616e417fe538031d633fb93b9
SHA512fe2042e9ce22be3e6e6fe1b324290aedbc155c55c0ede63ccf44a0eea10ce9f626c7553c40b24d917e5a4a8fb70513b33d698f7def5091a50831fa0529e8e669
-
Filesize
1.1MB
MD5729bc0108bcd7ec083dfa83d7a4577f2
SHA10b4efa5e1764b4ce3e3ae601c8655c7bb854a973
SHA256b1c68b1582ebb5f465512a0b834ccac095460b29136b6c7eea0475612bf16b49
SHA51249c83533ce88d346651d59d855cff18190328795401c1277f4e3d32ff34f207d2c35f026785aa6c4a85624d88bf8c927654907faf50db1d57447730d9d6ac44c
-
Filesize
6.5MB
MD5d8388140b196952bc419141fa07ac0c9
SHA171e6f4a14964c39a9b827479ffe90ec07b9145e3
SHA2566d77ff618ac5c4306dea8f34e66092e146f172570e88a3ac05166068e5a4abd6
SHA5124f8e089eba0cc90af09321cc83297cf763b9899cb65cd1ebd44697866e7458fa5ba1f3ace9e6cf7875c92fa5ac7d7fe85ff3a4af0c6f659b1849c03bba674e22
-
Filesize
356KB
MD573497313a18a4e8ef6fcc7810a5f4637
SHA1beafc036b2baea46e618982615d3422ab2994920
SHA2563538d4438f167ad175116729425ce8a11f46b54d1a4b3827967b12782ddeb1dc
SHA51257ea5e6de79fdc23be150f6dc5c996e03447990560d208e13f7403453eef03fdc56efd448649d4773fd6cd6f109b1f2b3f3656ddb164945aa572ad3de4d53da2
-
Filesize
6.2MB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
68KB
-
Filesize
16.2MB
-
Filesize
5.9MB
-
Filesize
372KB
-
Filesize
372KB
-
Filesize
16.2MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
16.2MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB