Analysis
-
max time kernel
143s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
26/08/2024, 10:05
General
-
Target
c2c5848ec8ae11e84d42521c527f75ca_JaffaCakes118.exe
-
Size
2.4MB
-
MD5
c2c5848ec8ae11e84d42521c527f75ca
-
SHA1
d8d98dff64297d4cf8a227a2c138efc4774942b2
-
SHA256
3efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467
-
SHA512
10e3f210c2d98c090ce3a65be2ff70279c07c1bf3dcb06a48dbfaa34ab6471ed0e8f2a35fbf5bd0c9b61b1c55493c5042daa32556b4b28e22c28e8d80c5d0846
-
SSDEEP
49152:3rKiRwG7r2ie/XMK+kLg7SdqnCvIUdJi0l2Css5qq2nY4/gX1aNnUm5vL:3RXK+b7ScCvFPx3Kr48UmN
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Renames multiple (2642) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2c5848ec8ae11e84d42521c527f75ca_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c2c5848ec8ae11e84d42521c527f75ca_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\c2c5848ec8ae11e84d42521c527f75ca_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160B
MD5000e8c41d4a15fb34d0be0dbb56e3778
SHA100c4eae64ee6239d7c65d819c6ce1ac329224f8c
SHA2568bdfa6a5b7de345cf0d4fe0e9c17d8b0e9db26d58b05b1b2ebbb3a05a068ff28
SHA512775d832eb8ab73e4a93789917dca69edb6c91fbb426e02acf7c6e213ffb4575776187209d1c471fbf57c4621ea3c23d9850f6dfc2770d62c17de9d66710800af
-
Filesize
12KB
MD5bd42ba47ff97fd7e395c90f79e0f9508
SHA1c2d8069ff6d72f3c63eeeac23933e5620f649d9d
SHA2563ad6f0a5c15cd3e24aa59e9687649e0d8d8b85789f3feef68e22b61a34a183e5
SHA5124eb6b58c46225f6e96bf41177892131384507cd8437e314426b797797c10960db52b84abd1fbf3cd845d1ed4bb8c67d2be3099a9ff5379a04d059b0557ef7fca
-
Filesize
8KB
MD529c6678d44aa7966ae163d70dd9f3661
SHA104e2608b9497905befec2c9c74931cdd14c754e8
SHA256f7634f4769d57b1fd7ff257cafd60a0b309194e610202dfd26fc5113d0abf834
SHA512e80a6a0270d20e255f84ee6ef285b610b79731058f88272b8246e4f0c97222cebf2113d7ae70a1a145c0bec2a94fea5cb5abff0203a8be64c634a9b9b6a3b1b6
-
Filesize
140KB
MD5347fc49ebff58163b5ee2e51e3fe34e2
SHA18c70a4cdf18a01fcbfba9a9d3cf0724fe8e46548
SHA25698698e36a6814b1058ce9859c0720ac9587806bc2d502d3632abfea5e94724d7
SHA512ae591783236e373456a7dda20f0e092bef027dbe47ecab14a74fd9a3e5165954a1eed134414c840fd6e17efc63e74cc3c4a334e9ab456f05f83cc72b8ef2b9dc
-
Filesize
16B
MD5cfdae8214d34112dbee6587664059558
SHA1f649f45d08c46572a9a50476478ddaef7e964353
SHA25633088cb514406f31e3d96a92c03294121ee9f24e176f7062625c2b36bee7a325
SHA512c260f2c223ecbf233051ac1d6a1548ad188a2777085e9d43b02da41b291ff258e4c506f99636150847aa24918c7bbb703652fef2fe55b3f50f85b5bd8dd5f6e3
-
Filesize
2.4MB
MD5c2c5848ec8ae11e84d42521c527f75ca
SHA1d8d98dff64297d4cf8a227a2c138efc4774942b2
SHA2563efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467
SHA51210e3f210c2d98c090ce3a65be2ff70279c07c1bf3dcb06a48dbfaa34ab6471ed0e8f2a35fbf5bd0c9b61b1c55493c5042daa32556b4b28e22c28e8d80c5d0846
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
3.8MB
-
Filesize
9.7MB
-
Filesize
3.8MB
-
Filesize
256KB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
9.7MB
-
Filesize
3.8MB
-
Filesize
9.7MB
-
Filesize
3.8MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
