Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-01-2025 15:46
General
-
Target
JaffaCakes118_cc16e1d2f47fb83da428247fee95cc3f.exe
-
Size
294KB
-
MD5
cc16e1d2f47fb83da428247fee95cc3f
-
SHA1
a3b8148f2bed2827f19f357ca7c0bf91d6bb0326
-
SHA256
87c234cb0a099a90e121702f34151e88e7d56e86c17ab809deaf4075dd2c5bd5
-
SHA512
4ec494aa4a06a72988c6defb2657d267a794212c19f11d114b691675822d6b563c5767651fd923293dac9f43db8bceecb023aec4b15a8f927daae515fa0a5796
-
SSDEEP
6144:rwHFwSRuCB3bI6DcadgAWwQgghvKg4evcAb6cNV:2FwSRu4bIlEWWgogEAWcNV
Score
10/10
Malware Config
Signatures
-
GandCrab payload 3 IoCs
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Gandcrab family
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookAW 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cc16e1d2f47fb83da428247fee95cc3f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cc16e1d2f47fb83da428247fee95cc3f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookAW
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 4882⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3484 -ip 34841⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
176KB
-
Filesize
324KB
-
Filesize
92KB
-
Filesize
176KB