General
-
Target
b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118
-
Size
2.2MB
-
Sample
240616-xal1eascqe
-
MD5
b49cd0398cbc0e6cdfbab13cf0e53773
-
SHA1
565694a2ceb2ebbe0a49981c11adeb5cde244e76
-
SHA256
6e04fdd174b6d18769751acb97564e41b131ec95e00e9d92152f52969113b547
-
SHA512
32015420e4cb24c1d59de76e05fb8885069a8ef69dc7ab5bf60def9de503e7b6a7c78771b83b620eeb32b07e9173d10c267a237db62c55d19536761589528349
-
SSDEEP
49152:Es9J0weFq3/+GSoZxNqPaNQN64vjLFn1XA2mk/U:EkRHdZOPaNQnvjLF1P8
Static task
static1
Behavioral task
behavioral1
Sample
b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\QPBFKOTVD-DECRYPT.txt
http://gandcrabmfe6mnef.onion/c0c6836d2fa03ac1
Extracted
F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\FTCPWBHEC-DECRYPT.txt
http://gandcrabmfe6mnef.onion/1edef952f3001c0
Targets
-
-
Target
b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118
-
Size
2.2MB
-
MD5
b49cd0398cbc0e6cdfbab13cf0e53773
-
SHA1
565694a2ceb2ebbe0a49981c11adeb5cde244e76
-
SHA256
6e04fdd174b6d18769751acb97564e41b131ec95e00e9d92152f52969113b547
-
SHA512
32015420e4cb24c1d59de76e05fb8885069a8ef69dc7ab5bf60def9de503e7b6a7c78771b83b620eeb32b07e9173d10c267a237db62c55d19536761589528349
-
SSDEEP
49152:Es9J0weFq3/+GSoZxNqPaNQN64vjLFn1XA2mk/U:EkRHdZOPaNQnvjLF1P8
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Renames multiple (291) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Defense Evasion
Indicator Removal
1File Deletion
1Virtualization/Sandbox Evasion
2Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1