General

  • Target

    ae4803a8ef3fbbd57c3958c373f5742d_JaffaCakes118

  • Size

    73KB

  • Sample

    240615-nymr6stbnj

  • MD5

    ae4803a8ef3fbbd57c3958c373f5742d

  • SHA1

    b267f5aed50e86b102fd13f1ab7204839b7f8f17

  • SHA256

    5c5dc98afd7d4b905a66b147ce61476c8d95e87ad8bf436822cfe808a49eb8cc

  • SHA512

    489ee61f46452e44b18812e733f029d813db6279aaf571182df7f77014df261e6ce73cc7d4a695727922429580e3ff89982bdf9d1d1f9f3bd08a02f33ba9a805

  • SSDEEP

    1536:F55u555555555pmgSeGDjtQhnwmmB0ybMqqU+2bbbAV2/S2mr3IdE8mne0Avu5rJ:NMSjOnrmBTMqqDL2/mr3IdE8we0Avu5h

Score
10/10

Malware Config

Extracted

Family

gandcrab

C2

http://gdcbghvjyqy7jclk.onion.top/

Targets

    • Target

      ae4803a8ef3fbbd57c3958c373f5742d_JaffaCakes118

    • Size

      73KB

    • MD5

      ae4803a8ef3fbbd57c3958c373f5742d

    • SHA1

      b267f5aed50e86b102fd13f1ab7204839b7f8f17

    • SHA256

      5c5dc98afd7d4b905a66b147ce61476c8d95e87ad8bf436822cfe808a49eb8cc

    • SHA512

      489ee61f46452e44b18812e733f029d813db6279aaf571182df7f77014df261e6ce73cc7d4a695727922429580e3ff89982bdf9d1d1f9f3bd08a02f33ba9a805

    • SSDEEP

      1536:F55u555555555pmgSeGDjtQhnwmmB0ybMqqU+2bbbAV2/S2mr3IdE8mne0Avu5rJ:NMSjOnrmBTMqqDL2/mr3IdE8we0Avu5h

    Score
    6/10
    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Tasks