931eb5ae791991f7ace322ce21f3639c060436af7b7376eb28ebbb2f2cf4c833 | Triage

Sharing

General

Target

686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118
Size

554KB
Sample

240522-ylv8wsed57
MD5

686b6813e2f24e6e61afe74e9ed1642d
SHA1

cbf55d857f1816056bb2849308c9196e8115b821
SHA256

931eb5ae791991f7ace322ce21f3639c060436af7b7376eb28ebbb2f2cf4c833
SHA512

a67eac318d9947efa6d8dc1919c8026110fd62efd3f0978a5424857349e95287b3b30733be3816efe6c9458d2c35fb12fa6b05b086ffbd7abc4c183663d2fa56
SSDEEP

12288:YQjLuRE4xKR72qKoe/ZWsYUxUKQzZZQZsqtOqD:nLueaKR72qKoe/EhdKYavD

Score

9^/10

defense_evasion evasion execution impact persistence ransomware trojan

Malware Config

Targets

- Target
  
  686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118
- Size
  
  554KB
- MD5
  
  686b6813e2f24e6e61afe74e9ed1642d
- SHA1
  
  cbf55d857f1816056bb2849308c9196e8115b821
- SHA256
  
  931eb5ae791991f7ace322ce21f3639c060436af7b7376eb28ebbb2f2cf4c833
- SHA512
  
  a67eac318d9947efa6d8dc1919c8026110fd62efd3f0978a5424857349e95287b3b30733be3816efe6c9458d2c35fb12fa6b05b086ffbd7abc4c183663d2fa56
- SSDEEP
  
  12288:YQjLuRE4xKR72qKoe/ZWsYUxUKQzZZQZsqtOqD:nLueaKR72qKoe/EhdKYavD
Score

9^/10

defense_evasion evasion execution impact persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Windows Management Instrumentation

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Resource Development

Reconnaissance

Tasks

static1

behavioral1

defense_evasionevasionexecutionimpactpersistenceransomwaretrojan

behavioral2