General

  • Target

    4fe309dc0189ef9066844ac9c0308e66_JaffaCakes118

  • Size

    798KB

  • Sample

    240517-qbppcsab8t

  • MD5

    4fe309dc0189ef9066844ac9c0308e66

  • SHA1

    8f41a87d0ebbe9edf167de1b4969a7a0d678d461

  • SHA256

    8df2f129c0abc2b6175475a914318f4e13137efc295c2536908336178535d4b0

  • SHA512

    7b68879f09d6e15095ff0fafa532730a3923d7de96dadff2b866b910bb9532776d8bc6a8c3b2b4b859f17694016931a3854500183f890316c5a3416c7f6cfa13

  • SSDEEP

    24576:ZMMpXS0hN0V0HoSMMMpXS0hN0V0HoSTSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFU:Kwi0L0qlFwi0L0qlGp

Malware Config

Targets

    • Target

      4fe309dc0189ef9066844ac9c0308e66_JaffaCakes118

    • Size

      798KB

    • MD5

      4fe309dc0189ef9066844ac9c0308e66

    • SHA1

      8f41a87d0ebbe9edf167de1b4969a7a0d678d461

    • SHA256

      8df2f129c0abc2b6175475a914318f4e13137efc295c2536908336178535d4b0

    • SHA512

      7b68879f09d6e15095ff0fafa532730a3923d7de96dadff2b866b910bb9532776d8bc6a8c3b2b4b859f17694016931a3854500183f890316c5a3416c7f6cfa13

    • SSDEEP

      24576:ZMMpXS0hN0V0HoSMMMpXS0hN0V0HoSTSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFU:Kwi0L0qlFwi0L0qlGp

    • Modifies WinLogon for persistence

    • Renames multiple (91) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks