Overview

overview

10

Static

static

3

14d0e55c3e...18.exe

windows7-x64

10

14d0e55c3e...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    14d0e55c3e29f47530a0490570e2a8b3_JaffaCakes118

  • Size

    3.9MB

  • Sample

    240627-f2t2naxalq

  • MD5

    14d0e55c3e29f47530a0490570e2a8b3

  • SHA1

    86b4ee849fbbc9de32013a3816996ebc7d3271a8

  • SHA256

    61bbe5df1047959861d3dce7439f237b9394b1ab121f0269fd30e1f9703bd477

  • SHA512

    2eaadd0188551344f332c80d7aa98c102e7f35a16c168966804f2f86d6e232397222675b64bb46c2ee1f7d7862c0a710eced702a0bd485e4afa1bb257f275d7d

  • SSDEEP

    98304:PE2Ji0HiIMzKpXOMJkMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMM:Pn80CI2l

Score
10/10
persistenceransomware

Malware Config

Targets

    • Target

      14d0e55c3e29f47530a0490570e2a8b3_JaffaCakes118

    • Size

      3.9MB

    • MD5

      14d0e55c3e29f47530a0490570e2a8b3

    • SHA1

      86b4ee849fbbc9de32013a3816996ebc7d3271a8

    • SHA256

      61bbe5df1047959861d3dce7439f237b9394b1ab121f0269fd30e1f9703bd477

    • SHA512

      2eaadd0188551344f332c80d7aa98c102e7f35a16c168966804f2f86d6e232397222675b64bb46c2ee1f7d7862c0a710eced702a0bd485e4afa1bb257f275d7d

    • SSDEEP

      98304:PE2Ji0HiIMzKpXOMJkMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMM:Pn80CI2l

    Score
    10/10
    persistenceransomware

    • Modifies WinLogon for persistence

      persistence

    • Renames multiple (91) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks