gandcrab | c9b7fc45e40ba89bfb9f9e4cea087767e234702fdc60050a0d249bce226a7171

Analysis

max time kernel
93s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
18-06-2024 11:43

Target

bbbfaa7767bf064425e721604ac5ab51_JaffaCakes118.exe
Size

69KB
MD5

bbbfaa7767bf064425e721604ac5ab51
SHA1

f37c377a44dd5637ee09799cfa53804931c4d1fd
SHA256

c9b7fc45e40ba89bfb9f9e4cea087767e234702fdc60050a0d249bce226a7171
SHA512

48121daccb21c292ba8b4bbe92230b76dd164128883bb2d20d0920bc119c59be6416eb03c1aa42fddd34812513cee7f90766fb6fe06933332eb4ddf3e1c443ea
SSDEEP

1536:TZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAmMqqU+2bbbAV2/S2Lccu:jBounVyFHjMqqDL2/Lcc

Score

10^/10

GandCrab payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/700-0-0x000000000F2B0000-0x000000000F2C6000-memory.dmp family_gandcrab
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3976 700 WerFault.exe bbbfaa7767bf064425e721604ac5ab51_JaffaCakes118.exe

resource	yara_rule
behavioral2/memory/700-0-0x000000000F2B0000-0x000000000F2C6000-memory.dmp	family_gandcrab

pid	pid_target	process	target process
3976	700	WerFault.exe	bbbfaa7767bf064425e721604ac5ab51_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bbbfaa7767bf064425e721604ac5ab51_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bbbfaa7767bf064425e721604ac5ab51_JaffaCakes118.exe"
1⤵
PID:700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 344
2⤵
- Program crash
PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 700 -ip 700
1⤵
PID:3340

memory/700-0-0x000000000F2B0000-0x000000000F2C6000-memory.dmp

Filesize
88KB

Download