Overview

overview

10

Static

static

7

5ee4f62c0f...18.exe

windows7-x64

10

5ee4f62c0f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5ee4f62c0fd5857adf2841c1bfd828de_JaffaCakes118

  • Size

    38KB

  • Sample

    240720-d7zszsyaqh

  • MD5

    5ee4f62c0fd5857adf2841c1bfd828de

  • SHA1

    79e33d927ab40b66fbaa05b36effa4c4dd5c7e55

  • SHA256

    cb807d47fa3a44fa2cb45b2e365569e8b9882804d2fa56be3b7da33542227ac8

  • SHA512

    ba10273899055ec9276dadafda26a8fa818824740185a052430d41ac0c7a037e5190901bcbd90929c8e17d6e65bf6ad0021ecbad53a25cd659f9086fdbee73d1

  • SSDEEP

    768:Ht07Y5qkm7a9SOsgx/kufE6H7USmpcA6KR4eXq+x:8yqBgx/kuc6bUXnR4eNx

Score
10/10
xoristpersistenceransomwarespywarestealerupx

Malware Config

Targets

    • Target

      5ee4f62c0fd5857adf2841c1bfd828de_JaffaCakes118

    • Size

      38KB

    • MD5

      5ee4f62c0fd5857adf2841c1bfd828de

    • SHA1

      79e33d927ab40b66fbaa05b36effa4c4dd5c7e55

    • SHA256

      cb807d47fa3a44fa2cb45b2e365569e8b9882804d2fa56be3b7da33542227ac8

    • SHA512

      ba10273899055ec9276dadafda26a8fa818824740185a052430d41ac0c7a037e5190901bcbd90929c8e17d6e65bf6ad0021ecbad53a25cd659f9086fdbee73d1

    • SSDEEP

      768:Ht07Y5qkm7a9SOsgx/kufE6H7USmpcA6KR4eXq+x:8yqBgx/kuc6bUXnR4eNx

    Score
    10/10
    xoristpersistenceransomwarespywarestealerupx

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Renames multiple (2211) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks