Overview

overview

10

Static

static

3

7b65b6bdd6...18.exe

windows7-x64

10

7b65b6bdd6...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    28-05-2024 02:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe

  • Size

    220KB

  • MD5

    7b65b6bdd6866345d6f9d0e18a0dcbc9

  • SHA1

    fe3fdda918a3db1b17fc48716b574356700d5fc0

  • SHA256

    2c34888b579bfe9598f5ab006346ce318ece71375b4deed4a5baf46aa867f274

  • SHA512

    0e73217400e0763ff6e455f7e6fec40b9bfc849c45d2dfec88e5b4ea7f5f102578a0694d35c1b18993bf8f41a5bcbf09903f5bc9662b08fbcae4f6484a274ef1

  • SSDEEP

    3072:93VrTNNer1tXqjkJ+G0vskV+Rr/wtBMHD4C6S7FSrK3xn9j0J:tV/MvJaL+lItqISxMGxh0

Score
10/10
globeimposterdefense_evasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (8675) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 38 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\tmpB693.tmp.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2080
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:1336
      • C:\Windows\SysWOW64\reg.exe
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
        3⤵
          PID:852
        • C:\Windows\SysWOW64\reg.exe
          reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
          3⤵
            PID:1848
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
            3⤵
              PID:864
            • C:\Windows\SysWOW64\attrib.exe
              attrib Default.rdp -s -h
              3⤵
              • Views/modifies file attributes
              PID:1508
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe > nul
            2⤵
            • Deletes itself
            PID:1936
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2000

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini
          Filesize

          1KB

          MD5

          9a479e05f3b236a22d3274ddf4d55b7a

          SHA1

          2dd35f0ad9482b6b47c9b787e3fa0a669706008f

          SHA256

          c6e8d87f313b8f6bd42f0099ef491d23eabb8bd8845aef3f3abb8d58ad7af236

          SHA512

          ec8ef6e475783202df7f3a4208e3c1ee55b5e6be43b134a38f82c9bce455f7773cb39cc9d4f20d72e4ad779a8d4ee7ef1e22ec3a40ea0efb828b9987970d83d6

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\tmpB693.tmp.bat
          Filesize

          445B

          MD5

          32d8f7a3d0c796cee45f64b63c1cca38

          SHA1

          d58466430a2bba8641bd92c880557379e25b140c

          SHA256

          1a6f73b5c28d1c10f63f2056068c1de61487b8cf8f1dcf7516548df144b3e9ea

          SHA512

          288213b92a03ac750ea319bb23c52e7bdf47f5a47ecb70c905c7610a84c63a3ec0a30801b5880e6def8df2c9f577082072e342198d23a19f64e561923e1ef698

          Download Submit

        • C:\Users\Public\Videos\Read___ME.html
          Filesize

          4KB

          MD5

          75fc9039bcfbe651c5e9943174fc8914

          SHA1

          14ed798b157360e959f86ec14e69a8abc2e82aab

          SHA256

          f7f7c81bdbb397c3327e00edea38ea5404b86c5a6abcb326c5bf60afa1c089e9

          SHA512

          a7d18abcd1c1e8d6703be9ff68b70e8ffceb2c032296d9a9873e62297bd782820f93dce798bd4a4d1a92caea08a19cba2eb8153ac07087b99d736fd19c816eec

          Download Submit

        • memory/2100-3-0x0000000000400000-0x000000000040F000-memory.dmp

          Filesize

          60KB

          Download

        • memory/2100-2-0x0000000000270000-0x0000000000370000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2100-1432-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

          Download

        • memory/2100-2925-0x0000000000270000-0x0000000000370000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2100-2926-0x0000000000400000-0x000000000040F000-memory.dmp

          Filesize

          60KB

          Download