clop | eceebf67a9022adc559db57ef161df8c532d810c8bc5b8187338ff10cca472d1

Resubmissions

17/03/2025, 03:22

250317-dw4ykaywhz 10

17/03/2025, 02:00

250317-cfczgawybw 10

Analysis

max time kernel
147s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
17/03/2025, 03:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_7c7dad601c488b31c1bd958296787b26.exe
Size

55KB
MD5

7c7dad601c488b31c1bd958296787b26
SHA1

7b6d039cfa14a6955f0386f2495be80c985c6f15
SHA256

eceebf67a9022adc559db57ef161df8c532d810c8bc5b8187338ff10cca472d1
SHA512

2ca2458699c952f06240d70d4cac485c4b90346fd9a62469b3151860757094a159a263d16f6e8adfb45060383fd94e5219e7506fc2a0fa725ae06f82e45b7add
SSDEEP

1536:yvAfsckgoGUx0fdCEQE2Dy+vJ+zJqsSq9HnA:yvA1sxECEQEkvJ4DSWHnA

Score

10^/10

clop discovery ransomware

Malware Config

Signatures

Clop family
clop
clop
Ransomware discovered in early 2019 which has been actively developed since release.
ransomware clop

Executes dropped EXE 10 IoCs

pid	Process
3900	nokiacheck.exe
344	nokiacheck.exe
3964	nokiacheck.exe
4180	nokiacheck.exe
2024	nokiacheck.exe
2708	nokiacheck.exe
3928	nokiacheck.exe
2792	nokiacheck.exe
2904	nokiacheck.exe
116	nokiacheck.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\nokiacheck.exe	nokiacheck.exe
File created	C:\Windows\SysWOW64\nokiacheck.exe	nokiacheck.exe
File opened for modification	C:\Windows\SysWOW64\nokiacheck.exe	nokiacheck.exe
File opened for modification	C:\Windows\SysWOW64\nokiacheck.exe	nokiacheck.exe
File created	C:\Windows\SysWOW64\nokiacheck.exe	nokiacheck.exe
File opened for modification	C:\Windows\SysWOW64\nokiacheck.exe	nokiacheck.exe
File opened for modification	C:\Windows\SysWOW64\nokiacheck.exe	nokiacheck.exe
File created	C:\Windows\SysWOW64\nokiacheck.exe	JaffaCakes118_7c7dad601c488b31c1bd958296787b26.exe
File created	C:\Windows\SysWOW64\nokiacheck.exe	nokiacheck.exe
File opened for modification	C:\Windows\SysWOW64\nokiacheck.exe	nokiacheck.exe
File opened for modification	C:\Windows\SysWOW64\nokiacheck.exe	nokiacheck.exe
File created	C:\Windows\SysWOW64\nokiacheck.exe	nokiacheck.exe
File opened for modification	C:\Windows\SysWOW64\nokiacheck.exe	nokiacheck.exe
File created	C:\Windows\SysWOW64\nokiacheck.exe	nokiacheck.exe
File opened for modification	C:\Windows\SysWOW64\nokiacheck.exe	JaffaCakes118_7c7dad601c488b31c1bd958296787b26.exe
File created	C:\Windows\SysWOW64\nokiacheck.exe	nokiacheck.exe
File created	C:\Windows\SysWOW64\nokiacheck.exe	nokiacheck.exe
File created	C:\Windows\SysWOW64\nokiacheck.exe	nokiacheck.exe
File opened for modification	C:\Windows\SysWOW64\nokiacheck.exe	nokiacheck.exe
File created	C:\Windows\SysWOW64\nokiacheck.exe	nokiacheck.exe
File created	C:\Windows\SysWOW64\nokiacheck.exe	nokiacheck.exe
File opened for modification	C:\Windows\SysWOW64\nokiacheck.exe	nokiacheck.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nokiacheck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nokiacheck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nokiacheck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nokiacheck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nokiacheck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nokiacheck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nokiacheck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nokiacheck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nokiacheck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nokiacheck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7c7dad601c488b31c1bd958296787b26.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 3900	4828	JaffaCakes118_7c7dad601c488b31c1bd958296787b26.exe	87
PID 4828 wrote to memory of 3900	4828	JaffaCakes118_7c7dad601c488b31c1bd958296787b26.exe	87
PID 4828 wrote to memory of 3900	4828	JaffaCakes118_7c7dad601c488b31c1bd958296787b26.exe	87
PID 3900 wrote to memory of 344	3900	nokiacheck.exe	96
PID 3900 wrote to memory of 344	3900	nokiacheck.exe	96
PID 3900 wrote to memory of 344	3900	nokiacheck.exe	96
PID 344 wrote to memory of 3964	344	nokiacheck.exe	101
PID 344 wrote to memory of 3964	344	nokiacheck.exe	101
PID 344 wrote to memory of 3964	344	nokiacheck.exe	101
PID 3964 wrote to memory of 4180	3964	nokiacheck.exe	102
PID 3964 wrote to memory of 4180	3964	nokiacheck.exe	102
PID 3964 wrote to memory of 4180	3964	nokiacheck.exe	102
PID 4180 wrote to memory of 2024	4180	nokiacheck.exe	103
PID 4180 wrote to memory of 2024	4180	nokiacheck.exe	103
PID 4180 wrote to memory of 2024	4180	nokiacheck.exe	103
PID 2024 wrote to memory of 2708	2024	nokiacheck.exe	104
PID 2024 wrote to memory of 2708	2024	nokiacheck.exe	104
PID 2024 wrote to memory of 2708	2024	nokiacheck.exe	104
PID 2708 wrote to memory of 3928	2708	nokiacheck.exe	106
PID 2708 wrote to memory of 3928	2708	nokiacheck.exe	106
PID 2708 wrote to memory of 3928	2708	nokiacheck.exe	106
PID 3928 wrote to memory of 2792	3928	nokiacheck.exe	107
PID 3928 wrote to memory of 2792	3928	nokiacheck.exe	107
PID 3928 wrote to memory of 2792	3928	nokiacheck.exe	107
PID 2792 wrote to memory of 2904	2792	nokiacheck.exe	108
PID 2792 wrote to memory of 2904	2792	nokiacheck.exe	108
PID 2792 wrote to memory of 2904	2792	nokiacheck.exe	108
PID 2904 wrote to memory of 116	2904	nokiacheck.exe	109
PID 2904 wrote to memory of 116	2904	nokiacheck.exe	109
PID 2904 wrote to memory of 116	2904	nokiacheck.exe	109

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c7dad601c488b31c1bd958296787b26.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c7dad601c488b31c1bd958296787b26.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\nokiacheck.exe
  C:\Windows\system32\nokiacheck.exe 1012 "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c7dad601c488b31c1bd958296787b26.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Windows\SysWOW64\nokiacheck.exe
    C:\Windows\system32\nokiacheck.exe 1128 "C:\Windows\SysWOW64\nokiacheck.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:344
  - - C:\Windows\SysWOW64\nokiacheck.exe
      C:\Windows\system32\nokiacheck.exe 1104 "C:\Windows\SysWOW64\nokiacheck.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3964
    - - C:\Windows\SysWOW64\nokiacheck.exe
        
        C:\Windows\system32\nokiacheck.exe 1076 "C:\Windows\SysWOW64\nokiacheck.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4180
      - C:\Windows\SysWOW64\nokiacheck.exe
        
        C:\Windows\system32\nokiacheck.exe 1108 "C:\Windows\SysWOW64\nokiacheck.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\SysWOW64\nokiacheck.exe
        
        C:\Windows\system32\nokiacheck.exe 1100 "C:\Windows\SysWOW64\nokiacheck.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Windows\SysWOW64\nokiacheck.exe
        
        C:\Windows\system32\nokiacheck.exe 1120 "C:\Windows\SysWOW64\nokiacheck.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\SysWOW64\nokiacheck.exe
        
        C:\Windows\system32\nokiacheck.exe 1124 "C:\Windows\SysWOW64\nokiacheck.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\SysWOW64\nokiacheck.exe
        
        C:\Windows\system32\nokiacheck.exe 1116 "C:\Windows\SysWOW64\nokiacheck.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2904
        
        C:\Windows\SysWOW64\nokiacheck.exe
        
        C:\Windows\system32\nokiacheck.exe 1112 "C:\Windows\SysWOW64\nokiacheck.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\nokiacheck.exe

Filesize
55KB

MD5
7c7dad601c488b31c1bd958296787b26

SHA1
7b6d039cfa14a6955f0386f2495be80c985c6f15

SHA256
eceebf67a9022adc559db57ef161df8c532d810c8bc5b8187338ff10cca472d1

SHA512
2ca2458699c952f06240d70d4cac485c4b90346fd9a62469b3151860757094a159a263d16f6e8adfb45060383fd94e5219e7506fc2a0fa725ae06f82e45b7add

Download Submit
memory/116-26-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/344-10-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2024-16-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2708-18-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2792-22-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2904-24-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3900-8-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3928-20-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3964-12-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4180-14-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4828-0-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4828-7-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download