Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 08:36
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_7c506d65fa9d1c3e00796777d8516dfdca8d975c03cd7542b485be6064bb4934.exe
Resource
win7-20240708-en
General
-
Target
JaffaCakes118_7c506d65fa9d1c3e00796777d8516dfdca8d975c03cd7542b485be6064bb4934.exe
-
Size
324KB
-
MD5
32e769af31bd04eaf3d67dc674e94356
-
SHA1
a12e0d84642174ae9fc5308bee1dc1c6cdce832e
-
SHA256
7c506d65fa9d1c3e00796777d8516dfdca8d975c03cd7542b485be6064bb4934
-
SHA512
1a0b1be06ee1c2cd82074131fc9012bb75830d3dd69b4f0fad8dafa4906a67d39a1b72945350b65d06bb553874357785a8eb74d094d26dc963314ffce39a99d4
-
SSDEEP
6144:HAIzXLEMwbeM+N9XqSGuXSV9I3I0KEGMMs+bYYsG08a5:HAuzwbeM+vqHKKO52YO08W
Malware Config
Extracted
gcleaner
45.139.105.171
85.31.46.167
107.182.129.235
171.22.30.106
-
url_path
....!..../software.php
....!..../software.php
Signatures
-
Gcleaner family
-
Program crash 9 IoCs
pid pid_target Process procid_target 4876 32 WerFault.exe 82 1220 32 WerFault.exe 82 436 32 WerFault.exe 82 1984 32 WerFault.exe 82 3432 32 WerFault.exe 82 700 32 WerFault.exe 82 2600 32 WerFault.exe 82 3960 32 WerFault.exe 82 3548 32 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_7c506d65fa9d1c3e00796777d8516dfdca8d975c03cd7542b485be6064bb4934.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 32 JaffaCakes118_7c506d65fa9d1c3e00796777d8516dfdca8d975c03cd7542b485be6064bb4934.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c506d65fa9d1c3e00796777d8516dfdca8d975c03cd7542b485be6064bb4934.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c506d65fa9d1c3e00796777d8516dfdca8d975c03cd7542b485be6064bb4934.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:32 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 4682⤵
- Program crash
PID:4876
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 7642⤵
- Program crash
PID:1220
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 7842⤵
- Program crash
PID:436
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 7842⤵
- Program crash
PID:1984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 8562⤵
- Program crash
PID:3432
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 9282⤵
- Program crash
PID:700
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 9322⤵
- Program crash
PID:2600
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 11322⤵
- Program crash
PID:3960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 7682⤵
- Program crash
PID:3548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 32 -ip 321⤵PID:2516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 32 -ip 321⤵PID:4608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 32 -ip 321⤵PID:1376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 32 -ip 321⤵PID:1152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 32 -ip 321⤵PID:1480
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 32 -ip 321⤵PID:1036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 32 -ip 321⤵PID:3832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 32 -ip 321⤵PID:2332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 32 -ip 321⤵PID:1376