c5945445ce7edd6dd33a730a4c1bcf6b4d42b2f3e451d9e69e968b67cd40f320 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b5273a0163c71fcad373632402716d6d_JaffaCakes118
Size

360KB
Sample

240821-1j445asbje
MD5

b5273a0163c71fcad373632402716d6d
SHA1

ec6fb6cda84c718abfc23ad6176c09bb5d0c3ea1
SHA256

c5945445ce7edd6dd33a730a4c1bcf6b4d42b2f3e451d9e69e968b67cd40f320
SHA512

5ad7cb8d2721968d532cb33b2a65abf2f19c02ba12f0fb0326926320d60dfaf10705b84464f9096be83e60718d3fc01667e8649dd628691dc4ab2fe09836fa98
SSDEEP

6144:eCAt/ABfs18svlnkczR/MurAXIEAykBnFq/N5tRJoRkSdkalPjavSQot5KP6G:ehMfQ8svlkKtIXIz52J8jdpiSQonKP3

Score

10^/10

defense_evasion discovery evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  b5273a0163c71fcad373632402716d6d_JaffaCakes118
- Size
  
  360KB
- MD5
  
  b5273a0163c71fcad373632402716d6d
- SHA1
  
  ec6fb6cda84c718abfc23ad6176c09bb5d0c3ea1
- SHA256
  
  c5945445ce7edd6dd33a730a4c1bcf6b4d42b2f3e451d9e69e968b67cd40f320
- SHA512
  
  5ad7cb8d2721968d532cb33b2a65abf2f19c02ba12f0fb0326926320d60dfaf10705b84464f9096be83e60718d3fc01667e8649dd628691dc4ab2fe09836fa98
- SSDEEP
  
  6144:eCAt/ABfs18svlnkczR/MurAXIEAykBnFq/N5tRJoRkSdkalPjavSQot5KP6G:ehMfQ8svlkKtIXIz52J8jdpiSQonKP3
Score

10^/10

defense_evasion discovery evasion persistence ransomware trojan
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Modifies Shared Task Scheduler registry keys
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Impair Defenses

Disable or Modify Tools

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionpersistenceransomwaretrojan

behavioral2