General
-
Target
00442a088456ce18a43187605557b3d1_JaffaCakes118
-
Size
344KB
-
Sample
240930-jtg9nstenj
-
MD5
00442a088456ce18a43187605557b3d1
-
SHA1
d02f19accf695508bc31a650539934d8ea46fb15
-
SHA256
d8ee200589d8e7d72878ea79bcfc9d18ee52569c046df74fa0dfe7e33d9ec422
-
SHA512
62d65da6e38ceae67845d44fe979941049d54075ca16ff0ed6b6db3379ccc30df55da5a4a2926e52147a48f0c11c2283fc1ee06864e8605bf31fb77b766656a7
-
SSDEEP
6144:V6DdOsqgCFKNnhMA6GOopUtQ9KIwD13KJ181KUO:sZOsSwhCGbWWu13E0
Static task
static1
Behavioral task
behavioral1
Sample
00442a088456ce18a43187605557b3d1_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
00442a088456ce18a43187605557b3d1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\{RecOveR}-houjp__.Txt
http://h3ds4.maconslab.com/408F1196AF7A8BEE
http://aq3ef.goimocoa.at/408F1196AF7A8BEE
http://fl43s.toabolt.at/408F1196AF7A8BEE
http://xzjvzkgjxebzreap.onion/408F1196AF7A8BEE
Extracted
C:\Program Files\7-Zip\Lang\{RecOveR}-yhrws__.Txt
http://h3ds4.maconslab.com/AD35F03018765474
http://aq3ef.goimocoa.at/AD35F03018765474
http://fl43s.toabolt.at/AD35F03018765474
http://xzjvzkgjxebzreap.onion/AD35F03018765474
Targets
-
-
Target
00442a088456ce18a43187605557b3d1_JaffaCakes118
-
Size
344KB
-
MD5
00442a088456ce18a43187605557b3d1
-
SHA1
d02f19accf695508bc31a650539934d8ea46fb15
-
SHA256
d8ee200589d8e7d72878ea79bcfc9d18ee52569c046df74fa0dfe7e33d9ec422
-
SHA512
62d65da6e38ceae67845d44fe979941049d54075ca16ff0ed6b6db3379ccc30df55da5a4a2926e52147a48f0c11c2283fc1ee06864e8605bf31fb77b766656a7
-
SSDEEP
6144:V6DdOsqgCFKNnhMA6GOopUtQ9KIwD13KJ181KUO:sZOsSwhCGbWWu13E0
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Indicator Removal
2File Deletion
2Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1