General
-
Target
683c46de5ff0b3453369565b86b3ae92_JaffaCakes118
-
Size
344KB
-
Sample
241022-bm1tfazfpk
-
MD5
683c46de5ff0b3453369565b86b3ae92
-
SHA1
567bcdd4b1d38ab4f66b1caf5a30a88c32e67ba1
-
SHA256
e971b832058a8ac68376158f9def96d606b570e0b0b736b1c6cb590a6b9966a4
-
SHA512
650de6ff2cf892aa68461a0fcf6cb7a260762a79890b2b2fd426bfefa0b6ee47f0be1fa182723b6eb7d373f0eaaa0e9d566c26fdf5c79ce1ae34d98223017ca2
-
SSDEEP
6144:d6DdOsqgCFKNnhMA6GOopUtQ9KIwD13KJ181KUO:EZOsSwhCGbWWu13E0
Static task
static1
Behavioral task
behavioral1
Sample
683c46de5ff0b3453369565b86b3ae92_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
683c46de5ff0b3453369565b86b3ae92_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\{RecOveR}-ktuxo__.Txt
http://h3ds4.maconslab.com/3E60E348FB9FFC30
http://aq3ef.goimocoa.at/3E60E348FB9FFC30
http://fl43s.toabolt.at/3E60E348FB9FFC30
http://xzjvzkgjxebzreap.onion/3E60E348FB9FFC30
Extracted
C:\Program Files\7-Zip\Lang\{RecOveR}-flrix__.Txt
http://h3ds4.maconslab.com/678D3B9F36EC48D
http://aq3ef.goimocoa.at/678D3B9F36EC48D
http://fl43s.toabolt.at/678D3B9F36EC48D
http://xzjvzkgjxebzreap.onion/678D3B9F36EC48D
Targets
-
-
Target
683c46de5ff0b3453369565b86b3ae92_JaffaCakes118
-
Size
344KB
-
MD5
683c46de5ff0b3453369565b86b3ae92
-
SHA1
567bcdd4b1d38ab4f66b1caf5a30a88c32e67ba1
-
SHA256
e971b832058a8ac68376158f9def96d606b570e0b0b736b1c6cb590a6b9966a4
-
SHA512
650de6ff2cf892aa68461a0fcf6cb7a260762a79890b2b2fd426bfefa0b6ee47f0be1fa182723b6eb7d373f0eaaa0e9d566c26fdf5c79ce1ae34d98223017ca2
-
SSDEEP
6144:d6DdOsqgCFKNnhMA6GOopUtQ9KIwD13KJ181KUO:EZOsSwhCGbWWu13E0
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Indicator Removal
2File Deletion
2Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1