General

  • Target

    b683f61f2c3d5e3b4aa37b4f3e947e78_JaffaCakes118

  • Size

    816KB

  • Sample

    240617-drr37swclq

  • MD5

    b683f61f2c3d5e3b4aa37b4f3e947e78

  • SHA1

    ce042e2232d191e8dc2d61e8938f066a7e6aff90

  • SHA256

    842d328d3fbde83c400986ced316ef6ac256ea3501590bd806ebb24949fa8b80

  • SHA512

    197ea1bb91fff4e79cbac382f89805ff7e53359577bf0909fcbf2d1bca66ef2dd9d8ff649283d067df840bd6e604794da0a668901c80b3ee29534f6ad6a5e983

  • SSDEEP

    24576:TEtl9mRda1cSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0NuJve:oEs1hQ

Score
10/10

Malware Config

Targets

    • Target

      b683f61f2c3d5e3b4aa37b4f3e947e78_JaffaCakes118

    • Size

      816KB

    • MD5

      b683f61f2c3d5e3b4aa37b4f3e947e78

    • SHA1

      ce042e2232d191e8dc2d61e8938f066a7e6aff90

    • SHA256

      842d328d3fbde83c400986ced316ef6ac256ea3501590bd806ebb24949fa8b80

    • SHA512

      197ea1bb91fff4e79cbac382f89805ff7e53359577bf0909fcbf2d1bca66ef2dd9d8ff649283d067df840bd6e604794da0a668901c80b3ee29534f6ad6a5e983

    • SSDEEP

      24576:TEtl9mRda1cSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0NuJve:oEs1hQ

    Score
    10/10
    • Modifies WinLogon for persistence

    • Renames multiple (91) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks