Overview

overview

7

Static

static

3

edf8c397ad...18.exe

windows7-x64

3

edf8c397ad...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118

  • Size

    194KB

  • Sample

    240411-v35bcabf6t

  • MD5

    edf8c397adac678ad8b11df86c1abbf9

  • SHA1

    d9fc64ed98a69ac96d9044858d23dc633bb6acc8

  • SHA256

    8e6c5bd07989f54a55be814760bf148a1c49c4e66161c0d00563413832d027b8

  • SHA512

    e1bff306daf491eb923e0fbe2c79e4a031c07be082d37379dfc2a3bb9bd10772a2e6280feb0f195c32764fe84c7a7d3746cae6f898ea9e393ecf03b93fc253e1

  • SSDEEP

    3072:hqUEwVwd0zjld+I/0cmbM+fulMHxznGteKJGJoJuuO73EmjA09+sL:j7VASjlQI/0bfKMTOJ2oMuhPs

Score
7/10
discoverypersistenceransomware

Malware Config

Targets

    • Target

      edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118

    • Size

      194KB

    • MD5

      edf8c397adac678ad8b11df86c1abbf9

    • SHA1

      d9fc64ed98a69ac96d9044858d23dc633bb6acc8

    • SHA256

      8e6c5bd07989f54a55be814760bf148a1c49c4e66161c0d00563413832d027b8

    • SHA512

      e1bff306daf491eb923e0fbe2c79e4a031c07be082d37379dfc2a3bb9bd10772a2e6280feb0f195c32764fe84c7a7d3746cae6f898ea9e393ecf03b93fc253e1

    • SSDEEP

      3072:hqUEwVwd0zjld+I/0cmbM+fulMHxznGteKJGJoJuuO73EmjA09+sL:j7VASjlQI/0bfKMTOJ2oMuhPs

    Score
    7/10
    discoverypersistenceransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks