Overview

overview

9

Static

static

1

акт_с�...ls.wsf

windows7-x64

9

акт_с�...ls.wsf

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6c1a8d6835b208834fe50bbcf783fb8a_JaffaCakes118

  • Size

    38KB

  • Sample

    240523-yvfjssed9s

  • MD5

    6c1a8d6835b208834fe50bbcf783fb8a

  • SHA1

    efed4b12237d104f6deeff85f37063e563ae57a9

  • SHA256

    1c7a3913aa96e18b28f39dca7ae4b1a28fd29571b613b269985c5f525a43754e

  • SHA512

    6e90970469d9daa92194038d95e17fce2a3c8574510dc4349c7bee5014fb2ad07e81a95606c7133f84f5828d2c7bcebc4c9e0cab912340eb84a4f1c70e8ba7d8

  • SSDEEP

    768:cSzMV8fZqj/Mk0QbZa0Us/Rsy24M04RnPDRBOgQstzsO:Va8fojUE9aZaRsy9/OZ9tzh

Score
9/10
defense_evasionexecutionimpactransomwarespywarestealer

Malware Config

Targets

    • Target

      акт_сверки_№10A_выгрузка_из_1С_02.03.2018_подписан_эцп.xls.wsf

    • Size

      67KB

    • MD5

      94c81fbcfcb6048301f8a237c3b9ba91

    • SHA1

      134f5af1d6c4114714d0eac2d80179cb588a42b5

    • SHA256

      24a28efaa2775567885af2ea0157119aa76abd7356887be94f1aa5d5f065743c

    • SHA512

      cae61e926297cba4edc9da92ed0b72d6b6befd66b0210c52c3776e21d394852b394c51bee5e35212260d5512831fd985fbb8f2b4936eaabba5b476ee80d39593

    • SSDEEP

      1536:C93M6Nef6zrbZuOmRfkDu6hNq9gxb647FfL5TN49o1IW:833NzrbZuOcau6hNZxWQ5LZNVz

    Score
    9/10
    defense_evasionexecutionimpactransomwarespywarestealer

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks