General
-
Target
45193536497856842273bcf3ba3eed80_JaffaCakes118
-
Size
360KB
-
Sample
240515-jjclfaff64
-
MD5
45193536497856842273bcf3ba3eed80
-
SHA1
9936812c27e92c8f7f7183ed3a8730ea1c6e167b
-
SHA256
9bf59f52f58052e0644fc5d0a8e9efcc8b7db586a365bd8611228c42ed4d0332
-
SHA512
3ea4cb9916f01b00d7dd73fef6a9006d1c521a225037a44a136991d98db1a0abb74fbc2a09dd2905e2404ca2956382dbb274e346e84be99bdb0377a3ca44f785
-
SSDEEP
6144:gZtBZh5vTOAWJx4u1l05Lpm+SemsrbK9XbgwJU2WWIBReISOuO8I:Qn7vSr4+sLwRnXbg4U2WWyN
Static task
static1
Behavioral task
behavioral1
Sample
45193536497856842273bcf3ba3eed80_JaffaCakes118.exe
Resource
win11-20240508-en
Malware Config
Extracted
C:\Program Files\7-Zip\Lang\_ReCoVeRy_+xmmav.txt
teslacrypt
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/669D7CFA5A31C98D
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/669D7CFA5A31C98D
http://yyre45dbvn2nhbefbmh.begumvelic.at/669D7CFA5A31C98D
http://xlowfznrg4wf7dli.ONION/669D7CFA5A31C98D
Targets
-
-
Target
45193536497856842273bcf3ba3eed80_JaffaCakes118
-
Size
360KB
-
MD5
45193536497856842273bcf3ba3eed80
-
SHA1
9936812c27e92c8f7f7183ed3a8730ea1c6e167b
-
SHA256
9bf59f52f58052e0644fc5d0a8e9efcc8b7db586a365bd8611228c42ed4d0332
-
SHA512
3ea4cb9916f01b00d7dd73fef6a9006d1c521a225037a44a136991d98db1a0abb74fbc2a09dd2905e2404ca2956382dbb274e346e84be99bdb0377a3ca44f785
-
SSDEEP
6144:gZtBZh5vTOAWJx4u1l05Lpm+SemsrbK9XbgwJU2WWIBReISOuO8I:Qn7vSr4+sLwRnXbg4U2WWyN
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (95) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-