Overview

overview

7

Static

static

3

41e53aa1f6...18.exe

windows7-x64

3

41e53aa1f6...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    41e53aa1f652225968dc5929fe74f292_JaffaCakes118

  • Size

    111KB

  • Sample

    240713-qwnb2avdqg

  • MD5

    41e53aa1f652225968dc5929fe74f292

  • SHA1

    994a2245c0d14761c52ffcfab55bc762cb0cca97

  • SHA256

    4819a5677f4031698007d4b4e11e51dba97791704bf9eac0f8bd028a9f6bed04

  • SHA512

    2ced83584b693b22880d20e41b6c671aeb216877623eb587ad1155dc34d3c199abd48b9b7edabc9f2cebe5a7686ef6a0c2703855177b3e1823833f451d03ad77

  • SSDEEP

    3072:VKiTiLZ9iKxMF4FrDeKKOxgSxtqtNNeiKnY91enfOJ:MDLPiKZhKOxgcqt+iKn+WU

Score
7/10
discoverypersistenceransomwareupx

Malware Config

Targets

    • Target

      41e53aa1f652225968dc5929fe74f292_JaffaCakes118

    • Size

      111KB

    • MD5

      41e53aa1f652225968dc5929fe74f292

    • SHA1

      994a2245c0d14761c52ffcfab55bc762cb0cca97

    • SHA256

      4819a5677f4031698007d4b4e11e51dba97791704bf9eac0f8bd028a9f6bed04

    • SHA512

      2ced83584b693b22880d20e41b6c671aeb216877623eb587ad1155dc34d3c199abd48b9b7edabc9f2cebe5a7686ef6a0c2703855177b3e1823833f451d03ad77

    • SSDEEP

      3072:VKiTiLZ9iKxMF4FrDeKKOxgSxtqtNNeiKnY91enfOJ:MDLPiKZhKOxgcqt+iKn+WU

    Score
    7/10
    discoverypersistenceransomwareupx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks