General
-
Target
JaffaCakes118_946b58a1341ed568aa967d9c24b638fb9cb0277c3c27b8eabfdc31cfcf4d6fd6
-
Size
560KB
-
Sample
241223-svfa5stjgt
-
MD5
2fa81856c7734d054f5eb3a0363638ab
-
SHA1
0bf72720ee93c9ee297e182aa90473d7aa867bef
-
SHA256
946b58a1341ed568aa967d9c24b638fb9cb0277c3c27b8eabfdc31cfcf4d6fd6
-
SHA512
a40469660290a813b43732b49095bb9b99c6dc9bf58681b220be6c01a23ebf78088a320fd5d8d038dcea6ea6b1021a12af7f5141964906c43f24f4162e1d94fd
-
SSDEEP
12288:4AFXK7atEIhP9y5IEWYBmwfXmwHAr7wdqLtrALWC8iIdc:rXKKlyeYnfHcL1m2c
Static task
static1
Behavioral task
behavioral1
Sample
840ab447e0f3a2a982ff8f0c3c336338a6df691c8b0b74b0f153c0f6a15662e2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
840ab447e0f3a2a982ff8f0c3c336338a6df691c8b0b74b0f153c0f6a15662e2.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\576127-readme.html
avaddon
Targets
-
-
Target
840ab447e0f3a2a982ff8f0c3c336338a6df691c8b0b74b0f153c0f6a15662e2
-
Size
1.3MB
-
MD5
fd61adfce25d440ef8994d124cfce67c
-
SHA1
4c7d496c02177037f58588579239caa1d95d509c
-
SHA256
840ab447e0f3a2a982ff8f0c3c336338a6df691c8b0b74b0f153c0f6a15662e2
-
SHA512
67aeb813bc7be2bf61117a04ee995de70c7b248d044699b33fe1d040476a8d7963ce4831a195591237dcd4e2df07c06971281ffa8c9a70f233469721580e35fc
-
SSDEEP
24576:Ks6JmdFn5KLOCgHWcAvcrOcEsKfR9uA7rmFbbbbpccfA6QJfSQccc2IhuOnA:Ks6JY5KLOCyWcDUfRAA3mFbbbbpc4A6s
-
Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
-
Avaddon family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (236) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
3