Overview

overview

9

Static

static

3

jkas.exe

windows10-1703-x64

9

jkas.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    jkas.exe

  • Size

    731KB

  • Sample

    231001-3skg7agb67

  • MD5

    724841114acf0bbde3a70c4a7cb54bcc

  • SHA1

    1d298b3bf3b2d0c4ccd0615597ba9510e8f180c7

  • SHA256

    4c80c0a0d3c211c3aa52b734b4ccb40d50bd0d14b0364fd1160c0c4887df9cf1

  • SHA512

    cfd0494247c5dd11dbd9852c54131e90f5a4bf7ee1097c7a8be70bf958eb497c31d94c80ba8759e798c408704d9c89bc606b341af1dafec1d3941d29dba82d90

  • SSDEEP

    6144:P3BBCqxV6VsgHTQer7CZ1wwE5P4j8P6pfnFczW0AQxe2gHcb998g4iBCXtzrf78f:P3+A6hXqamQP6pfFCGVu8g4sCXtzr7O

Score
9/10
persistenceransomware

Malware Config

Targets

    • Target

      jkas.exe

    • Size

      731KB

    • MD5

      724841114acf0bbde3a70c4a7cb54bcc

    • SHA1

      1d298b3bf3b2d0c4ccd0615597ba9510e8f180c7

    • SHA256

      4c80c0a0d3c211c3aa52b734b4ccb40d50bd0d14b0364fd1160c0c4887df9cf1

    • SHA512

      cfd0494247c5dd11dbd9852c54131e90f5a4bf7ee1097c7a8be70bf958eb497c31d94c80ba8759e798c408704d9c89bc606b341af1dafec1d3941d29dba82d90

    • SSDEEP

      6144:P3BBCqxV6VsgHTQer7CZ1wwE5P4j8P6pfnFczW0AQxe2gHcb998g4iBCXtzrf78f:P3+A6hXqamQP6pfFCGVu8g4sCXtzr7O

    Score
    9/10
    persistenceransomware

    • Renames multiple (3380) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Renames multiple (3463) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks