Extracted

• • Target

    1268348828883dbc98a1a584dec8ded8_JaffaCakes118

  • Size

    283KB

  • MD5

    1268348828883dbc98a1a584dec8ded8

  • SHA1

    7fd4ed93d6a549baf7402f7fd5e736faf2ae40f4

  • SHA256

    05bbe75c2e13f4e9267f6217a0d91acab003fc7f1eb1a92d81b10bd3cf448f9e

  • SHA512

    8d7df58ab9cb6ca13c1e3317cf51ec7ae67e7389e0464794dab8edaabd1b6454d73b8c27796335693f2aa6453a4dfed1261685f10d180a793781ae35adde2dcb

  • SSDEEP

    6144:AFM0/rWK/2tG3ZL1hsI5y7XFeLAPlRpQEWpbTMp4Jc3L:AX/d/2QtT5y7XnlRpQHFTMaJGL

  Score

  10^/10

  crypvaultponycollectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactransomwareratspywarestealerupx

  • CrypVault

    Ransomware family which makes encrypted files look like they have been quarantined by AV.

    ransomwarecrypvault

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2