gandcrab | 299f191aa3decd3256c9c3522dd444321db8b45a49109ecd3ad14c57d6eccdb2

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2025 18:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_b6dbd2d0fbd8d9710a40e0f42753e68b.exe
Size

233KB
MD5

b6dbd2d0fbd8d9710a40e0f42753e68b
SHA1

b073d500c013ce2cbed08bddcfa04eba0c4af22c
SHA256

299f191aa3decd3256c9c3522dd444321db8b45a49109ecd3ad14c57d6eccdb2
SHA512

33843e88ac3eb944192801a5555ef1abdc302d33419f9037bf8c23002fa1f72f0f10d3aa43ca45ea3d5cb39419e63611b361cc020ff714f3c33faff1f85d47f9
SSDEEP

3072:ggJYL+iU82IteL5hYcAhaW3q0Dj7VVkYvB5nxMwxWhoUqVRMlcK:ggJYLk6t5u0vZVkYzNWh2wp

Score

10^/10

gandcrab backdoor discovery ransomware

Malware Config

Signatures

GandCrab payload 3 IoCs

resource	yara_rule
behavioral2/memory/3176-259-0x0000000000400000-0x0000000000B4A000-memory.dmp	family_gandcrab
behavioral2/memory/3176-260-0x00000000028A0000-0x00000000028B7000-memory.dmp	family_gandcrab
behavioral2/memory/3176-264-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab
Gandcrab family
gandcrab

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	JaffaCakes118_b6dbd2d0fbd8d9710a40e0f42753e68b.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5072	3176	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_b6dbd2d0fbd8d9710a40e0f42753e68b.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b6dbd2d0fbd8d9710a40e0f42753e68b.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b6dbd2d0fbd8d9710a40e0f42753e68b.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 480
  2⤵
  - Program crash
  PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3176 -ip 3176
1⤵
PID:3708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win.ini

Filesize
6KB

MD5
7bd45b4353c2eb076cb800af6794c74c

SHA1
8b43110b86ab342a3a50fba1101af23e58afb81f

SHA256
46768646ca5a5742bd66e10f807c7d85c06d67f34d01e1da68c0ed585e81c74d

SHA512
a41d292080b01fa6884140f0aab6a9a45310ff8eccf850715d5b373c8aeaf0a57ed060e12475621372876ccf05d64278f89ec9b458d3c1af4cc60b5999f735f3

Download Submit
memory/3176-257-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Filesize
1024KB

Download
memory/3176-258-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3176-259-0x0000000000400000-0x0000000000B4A000-memory.dmp

Filesize
7.3MB

Download
memory/3176-260-0x00000000028A0000-0x00000000028B7000-memory.dmp

Filesize
92KB

Download
memory/3176-264-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download