Analysis
-
max time kernel
105s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
18/05/2025, 10:18
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_06a825af0c1281bfa3292627ca0ba3cc.exe
Resource
win10v2004-20250502-en
General
-
Target
JaffaCakes118_06a825af0c1281bfa3292627ca0ba3cc.exe
-
Size
311KB
-
MD5
06a825af0c1281bfa3292627ca0ba3cc
-
SHA1
66207081d064bb9129b6043e3572915d08794135
-
SHA256
eb9ca33957885c25a84484b71f29a705d39633a121eed414ab163064075e9927
-
SHA512
2a93c8fed615047dfe02fb7daedd40baead6a8cef5ca1901dc5be19bd0f2dd58ffc92ba48b9b80aad318b7c637698733f1a6cc541f2e69125a0d85debfc35645
-
SSDEEP
6144:i3s0DwZem8pxIIZrEkC+qCPHy4ckd+JmJSNeHDi:WwMbIIG7XJlNeji
Malware Config
Signatures
-
GandCrab payload 3 IoCs
resource yara_rule behavioral1/memory/4032-3-0x0000000000400000-0x00000000012D3000-memory.dmp family_gandcrab behavioral1/memory/4032-4-0x0000000001490000-0x00000000014A7000-memory.dmp family_gandcrab behavioral1/memory/4032-8-0x0000000000400000-0x000000000042C000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Gandcrab family
-
Program crash 1 IoCs
pid pid_target Process procid_target 4588 4032 WerFault.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_06a825af0c1281bfa3292627ca0ba3cc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a825af0c1281bfa3292627ca0ba3cc.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a825af0c1281bfa3292627ca0ba3cc.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4032 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 4402⤵
- Program crash
PID:4588
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4032 -ip 40321⤵PID:4600