429cc0a6fe75a25f540d8605315c7bbd6d1e97fb792cb8d5e7e07865f2112e90 | Triage

Submit
Reports

Overview

overview

Static

static

3

6f5dacb776...18.exe

windows7-x64

6f5dacb776...18.exe

windows10-2004-x64

Sharing

General

Target

6f5dacb7767c14b66459cf46151e35fe_JaffaCakes118
Size

495KB
Sample

240725-nhc8sswcmj
MD5

6f5dacb7767c14b66459cf46151e35fe
SHA1

9573bada998152e2d13d8384f4f710a05a0f8eb6
SHA256

429cc0a6fe75a25f540d8605315c7bbd6d1e97fb792cb8d5e7e07865f2112e90
SHA512

a1836575fc520ddffd4746553ecd2de2f546d23174b1c5b995a942243534fe948482947a98165da58adb47cf755f4b7c9a70148f45acd8af4b35db38f351eb1e
SSDEEP

12288:6Cw8LQjKKxvUGGAUzMmt8i/GTlPCFAbkIZ9nnqYL:Vf8dxUGGQhiuT9dQIZ8

Score

10^/10

defense_evasion discovery evasion persistence ransomware trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

6f5dacb7767c14b66459cf46151e35fe_JaffaCakes118.exe

Resource

win7-20240704-en

defense_evasion discovery evasion persistence ransomware trojan

windows7-x64

25 signatures

150 seconds

Behavioral task

behavioral2

Sample

6f5dacb7767c14b66459cf46151e35fe_JaffaCakes118.exe

Resource

win10v2004-20240709-en

discovery evasion persistence ransomware trojan

windows10-2004-x64

25 signatures

150 seconds

Malware Config

Targets

- Target
  
  6f5dacb7767c14b66459cf46151e35fe_JaffaCakes118
- Size
  
  495KB
- MD5
  
  6f5dacb7767c14b66459cf46151e35fe
- SHA1
  
  9573bada998152e2d13d8384f4f710a05a0f8eb6
- SHA256
  
  429cc0a6fe75a25f540d8605315c7bbd6d1e97fb792cb8d5e7e07865f2112e90
- SHA512
  
  a1836575fc520ddffd4746553ecd2de2f546d23174b1c5b995a942243534fe948482947a98165da58adb47cf755f4b7c9a70148f45acd8af4b35db38f351eb1e
- SSDEEP
  
  12288:6Cw8LQjKKxvUGGAUzMmt8i/GTlPCFAbkIZ9nnqYL:Vf8dxUGGQhiuT9dQIZ8
Score

10^/10

defense_evasion discovery evasion persistence ransomware trojan
- Modifies WinLogon for persistence
  persistence
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Modifies Shared Task Scheduler registry keys
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionpersistenceransomwaretrojan

behavioral2

discoveryevasionpersistenceransomwaretrojan

© 2018-2025

Terms | Privacy