Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/10/2026, 16:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.exe
- Size 181KB
- Sample261009-twdpdabx7w
- SHA256 c3ddf96b27ea8f79bb7472a7801bf2b3432fd9013d4ca957770f310285530591
- MD5 13b888d41af01c984b625ac83c9f8040
- SHA1 b33dbc855d2106bcd9bd7906396c5c564ac733b9
- SHA512 930bebfa10de0f17275ff7d092782891758f19313e7d2db900955d6beacb29c03093196e34f9103563823db4ff3ad0cd65312e038aeda75f431064acd574dde0
- SSDEEP 3072:AEaT/ARHA7AWxOZxOSgJQQEMd1X5yv6CHaX4N6Tyx0yzDV:xar7AjxoJQ921Jyv6MalyzJ
- TLSH T1A604CE0331D2D6B3EA4EA1F044B54AE85E3AA0744B54D3C7BA4B21DBDF713A29F26305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
- GandCrab payload 4 IoCs
resource yara_rule behavioral1/memory/4716-2-0x0000000000400000-0x0000000000433000-memory.dmp family_gandcrab behavioral1/memory/4716-4-0x0000000002210000-0x0000000002227000-memory.dmp family_gandcrab behavioral1/memory/4716-6-0x0000000000400000-0x0000000000433000-memory.dmp family_gandcrab behavioral1/memory/4716-3-0x0000000000412000-0x0000000000425000-memory.dmp family_gandcrab - Program crash 1 IoCs
pid pid_target Process procid_target 4620 4716 WerFault.exe 87 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_HEUR.Trojan.Win32.Generic.exe - Suspicious use of SetWindowsHookAW 64 IoCs
pid Process 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4716 jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookAW
PID:4716 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 4682⤵
- Program crash
PID:4620
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4716 -ip 47161⤵PID:3776