Overview

overview

10

Static

static

3

2f080387b2...18.exe

windows7-x64

10

2f080387b2...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2f080387b2950bc35bcb664095ce999b_JaffaCakes118

  • Size

    1.3MB

  • Sample

    240510-pcsxqsgh42

  • MD5

    2f080387b2950bc35bcb664095ce999b

  • SHA1

    f6f55bbfdd716d7ed2500f124b0d921b6e3dc703

  • SHA256

    5d3fac0624d62cbcd70d90ddc297a1ff473e0ff118413183b83295ad530aef44

  • SHA512

    bfa36518dc082e6e266a1697f2fef0e359b3ddd4c94d0bda1953191f61d9d052c448addf16ae53721596fc5e5c618c9b54c4db26b5603d3ae1a0903292f49a68

  • SSDEEP

    24576:dEtl9mRda1wQE6Ehg7mM+M6RkMkIM7gE6Eh67S:2Es1F0g7mM+M6RkMkIM7I067S

Score
10/10
persistenceransomware

Malware Config

Targets

    • Target

      2f080387b2950bc35bcb664095ce999b_JaffaCakes118

    • Size

      1.3MB

    • MD5

      2f080387b2950bc35bcb664095ce999b

    • SHA1

      f6f55bbfdd716d7ed2500f124b0d921b6e3dc703

    • SHA256

      5d3fac0624d62cbcd70d90ddc297a1ff473e0ff118413183b83295ad530aef44

    • SHA512

      bfa36518dc082e6e266a1697f2fef0e359b3ddd4c94d0bda1953191f61d9d052c448addf16ae53721596fc5e5c618c9b54c4db26b5603d3ae1a0903292f49a68

    • SSDEEP

      24576:dEtl9mRda1wQE6Ehg7mM+M6RkMkIM7gE6Eh67S:2Es1F0g7mM+M6RkMkIM7I067S

    Score
    10/10
    persistenceransomware

    • Modifies WinLogon for persistence

      persistence

    • Renames multiple (93) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks