Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05-12-2024 23:54

General

  • Target

    ca01dd476a134daf18d581824e9fafc0_JaffaCakes118.exe

  • Size

    273KB

  • MD5

    ca01dd476a134daf18d581824e9fafc0

  • SHA1

    daca2b2550a6aa59421b80ef0998a1491f0fe582

  • SHA256

    825bdedd023468e8b6ed97da862d3088e10343bfe1f935163d7369c27c186801

  • SHA512

    a9f3fa84b42cf5f051756bc0ca7d82aa26433ecdcffac3bd6ef08471628a2824839d1b0569c0a9daaebfcd6eefb458f45711d3b32c057b12f71734258ff45dba

  • SSDEEP

    3072:LCtm61g2Ax3qpfBNohg9E+SvGqKDhRjUUwrMqMXt4KjyILN2xvywJIfpo/4KKhd:LCVg2AxeZTvyHKYAPOeOvYpoQXd

Malware Config

Signatures

  • GandCrab payload 3 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • Gandcrab family
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 61 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ca01dd476a134daf18d581824e9fafc0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ca01dd476a134daf18d581824e9fafc0_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1788
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1884
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2680
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2328
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2928
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2816
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2504
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2472
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2532
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2000
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1596
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2444
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2516
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1640
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1988
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1804
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1744
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2804
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2888
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3048
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2892
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:828
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1472
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:940
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1728
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2100
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1752
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2336
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2156
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1280
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1688
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2340
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1580
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1912
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:328
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1792
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2720
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2232
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2008
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2608
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1016
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2464
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2192
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1004
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2692
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2460
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2508
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2576
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1776
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:264
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2260
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2732
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:532
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1844
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2020
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:936
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:348
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3060
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1768
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1712-2-0x0000000000240000-0x0000000000257000-memory.dmp

    Filesize

    92KB

  • memory/1712-1-0x0000000000400000-0x0000000001400000-memory.dmp

    Filesize

    16.0MB

  • memory/1712-9-0x0000000000400000-0x0000000001400000-memory.dmp

    Filesize

    16.0MB