Overview

overview

10

Static

static

3

4bbb7a7315...18.exe

windows7-x64

10

4bbb7a7315...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4bbb7a73157575a993245b84f04f6223_JaffaCakes118

  • Size

    6.3MB

  • Sample

    240715-2pfjdsvhrg

  • MD5

    4bbb7a73157575a993245b84f04f6223

  • SHA1

    1c0c13a5d0bab990d342c5c79f231f1fb974799e

  • SHA256

    7868fbfccd2b80be0760808d04086e4ca5b2c644f9b06571419780c34dd73d4e

  • SHA512

    d5d25ae52f9b5a92da784966348130d5563bd12a1d02a74448389e13d55eb5924254a07f328482a392e338601d02761c1387fa5d98c6bd676ded3dbbf07492fb

  • SSDEEP

    196608:jVkpVLECFbM7eLIbS46cDFQZNlZRM3XdaIe:j6dFw7eLIb2mQZTvuaIe

Score
10/10
evasionpersistenceransomware

Malware Config

Targets

    • Target

      4bbb7a73157575a993245b84f04f6223_JaffaCakes118

    • Size

      6.3MB

    • MD5

      4bbb7a73157575a993245b84f04f6223

    • SHA1

      1c0c13a5d0bab990d342c5c79f231f1fb974799e

    • SHA256

      7868fbfccd2b80be0760808d04086e4ca5b2c644f9b06571419780c34dd73d4e

    • SHA512

      d5d25ae52f9b5a92da784966348130d5563bd12a1d02a74448389e13d55eb5924254a07f328482a392e338601d02761c1387fa5d98c6bd676ded3dbbf07492fb

    • SSDEEP

      196608:jVkpVLECFbM7eLIbS46cDFQZNlZRM3XdaIe:j6dFw7eLIb2mQZTvuaIe

    Score
    10/10
    evasionpersistenceransomware

    • Deletes NTFS Change Journal

      The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

      ransomware

    • Clears Windows event logs

      evasionransomware

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks