General
-
Target
873d16767e0895ff109b2a2ae61335f5_JaffaCakes118
-
Size
175KB
-
Sample
240603-rmdxnshc31
-
MD5
873d16767e0895ff109b2a2ae61335f5
-
SHA1
15ce4fd25f2709f3a3379a41e51337ddfa6c773c
-
SHA256
77da860cd56ac35ea77e4768745a0c36a3662ad08fca31aa6a5ab1cec5c3d4e0
-
SHA512
280efb73feb2b569444212a708be2e1d9432752ececc7302f4841235c6d76f3d50f2732f12d867b289f9c881a282abf5709918435344d91948ee7570a2d436f5
-
SSDEEP
1536:SqtY8hd8Wu8pI8Cd8hd8dQg0H//3oS34GNkFjYfBCJisl+aeTH+WK/Lf1/hmnVSV:SBoT34/F6BCJiZm
Static task
static1
Behavioral task
behavioral1
Sample
873d16767e0895ff109b2a2ae61335f5_JaffaCakes118.html
Resource
win10v2004-20240426-en
Malware Config
Extracted
C:\Users\Admin\Downloads\@[email protected]
wannacry
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Targets
-
-
Target
873d16767e0895ff109b2a2ae61335f5_JaffaCakes118
-
Size
175KB
-
MD5
873d16767e0895ff109b2a2ae61335f5
-
SHA1
15ce4fd25f2709f3a3379a41e51337ddfa6c773c
-
SHA256
77da860cd56ac35ea77e4768745a0c36a3662ad08fca31aa6a5ab1cec5c3d4e0
-
SHA512
280efb73feb2b569444212a708be2e1d9432752ececc7302f4841235c6d76f3d50f2732f12d867b289f9c881a282abf5709918435344d91948ee7570a2d436f5
-
SSDEEP
1536:SqtY8hd8Wu8pI8Cd8hd8dQg0H//3oS34GNkFjYfBCJisl+aeTH+WK/Lf1/hmnVSV:SBoT34/F6BCJiZm
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Downloads MZ/PE file
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1