Analysis
-
max time kernel
94s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-12-2024 10:13
General
-
Target
bce7e4cfa9a078f50cfde463149e5695_JaffaCakes118.exe
-
Size
225KB
-
MD5
bce7e4cfa9a078f50cfde463149e5695
-
SHA1
523ba95e18b45b4de729205416a8a840f5c04a30
-
SHA256
fd8e2a796cdacde9d9db4f21d1a7582af52bb202d28dca6f8fe10e8f49d2fa58
-
SHA512
57ffe8346f56cb61c80ad52e011ba9254a59dbcb3f2fd5bedb28478624bf41907c2e79320d224c90f920a1ac3895a94953e54531890102b2d517322295c13310
-
SSDEEP
3072:hGvtF7cz+y0qhAosOt5C+vqZh29kuuLA/1bR05O5bTFeR/nYLKNa88Ti/J6:hGvttgdPsOtPvqWkuMm1baOaxonTi/J6
Malware Config
Signatures
-
GandCrab payload 3 IoCs
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Gandcrab family
-
Drops file in Windows directory 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 20 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bce7e4cfa9a078f50cfde463149e5695_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bce7e4cfa9a078f50cfde463149e5695_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 5442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5020 -ip 50201⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5764765046cd2a93023da3d4ee6e70a13
SHA19a4f067251176d6980c0490fd605345710142dd1
SHA25665390ad0fe25f57428293f7ff6059383d1533e5126454c509d119ed3462ae75a
SHA5120ae3f01180884958e7123785881a1fb50b014d97006f1cf90fedd58f8f5df99c9d4aa403aa385000bcdb202bde8561c38d1ba1da515f785c8bb86337875cee07
-
Filesize
5KB
MD539cbe980f86bd19f9588178cff07a5ec
SHA11c1214c0e8bb34ce0642e2db67849a5c7f2af0af
SHA256e3d6776951119616209365046ce447171093f47b6541e265361afb168b3a6ad7
SHA5120b0b573b92825e26669a9a278a0d6eb649e7233722d43040f07d9d36b4b97ae3e885ad8a6ad65f87e1916a2654121367744eaf6655ba65c9533246bdb22ed22f
-
Filesize
1024KB
-
Filesize
160KB
-
Filesize
7.3MB
-
Filesize
92KB