General
-
Target
eeaf2df9b452d043891bb5b1ab54a068_JaffaCakes118
-
Size
690KB
-
Sample
240920-3yvkcavfrd
-
MD5
eeaf2df9b452d043891bb5b1ab54a068
-
SHA1
b3c1a492692fe91ed8fb582b9f276ea3a0a8039d
-
SHA256
f018326456daf09fc5cab41e9254d6ff1e8320ffd74c87668ba60ab27a7a0cb7
-
SHA512
7d21768e3a7cb737638de353abc24a70aa77b3c927891eaab25f8c1a848c9af86b9c9e19c717db621beb4d96d6fc39327f2328f1857ac6bfb1b260d8a3d3a3e6
-
SSDEEP
6144:Pi4Iy0HZxn7FBVmlwFuqeYq8s8w9Mq2CcjKX:Pi4IlHL7FBGwFP88Rw91cg
Static task
static1
Behavioral task
behavioral1
Sample
eeaf2df9b452d043891bb5b1ab54a068_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
eeaf2df9b452d043891bb5b1ab54a068_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
F:\$RECYCLE.BIN\URROYVNTIB-DECRYPT.txt
http://gandcrabmfe6mnef.onion/a81b68c4e7218d87
Extracted
C:\PerfLogs\VWNUDCIEEN-DECRYPT.txt
http://gandcrabmfe6mnef.onion/d216e5dbc26e6e41
Targets
-
-
Target
eeaf2df9b452d043891bb5b1ab54a068_JaffaCakes118
-
Size
690KB
-
MD5
eeaf2df9b452d043891bb5b1ab54a068
-
SHA1
b3c1a492692fe91ed8fb582b9f276ea3a0a8039d
-
SHA256
f018326456daf09fc5cab41e9254d6ff1e8320ffd74c87668ba60ab27a7a0cb7
-
SHA512
7d21768e3a7cb737638de353abc24a70aa77b3c927891eaab25f8c1a848c9af86b9c9e19c717db621beb4d96d6fc39327f2328f1857ac6bfb1b260d8a3d3a3e6
-
SSDEEP
6144:Pi4Iy0HZxn7FBVmlwFuqeYq8s8w9Mq2CcjKX:Pi4IlHL7FBGwFP88Rw91cg
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (265) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Indicator Removal
1File Deletion
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1