Overview

overview

10

Static

static

10

d5f9fa1a8d...18.exe

windows7-x64

10

d5f9fa1a8d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d5f9fa1a8dca5319432f51a5891f7794_JaffaCakes118

  • Size

    7.1MB

  • Sample

    240909-knsnwszdmk

  • MD5

    d5f9fa1a8dca5319432f51a5891f7794

  • SHA1

    2a937328f5b99eccb9b8c13ed71d6ffb9dff4521

  • SHA256

    18f4123ee42f5a29f8df7bd1cf95ab73441f082584f390aa218c2dd1134f4055

  • SHA512

    87013b63a9b153c5268784928394dfbf1eeff1b91eea6bdf187025e63d25c535e468e59a33f47d23682a386605bb314311e50a7edd1d6deb1b60f5008237a7d0

  • SSDEEP

    196608:TfavVYaolX+aFFLlPKQ8hY/RkQWslX4ge+:TiYaolrFFEHYu3sSge

Score
10/10
mimikatzzhendiscoveryevasionexploitpersistencepyinstallerransomwarespywarestealer

Malware Config

Targets

    • Target

      d5f9fa1a8dca5319432f51a5891f7794_JaffaCakes118

    • Size

      7.1MB

    • MD5

      d5f9fa1a8dca5319432f51a5891f7794

    • SHA1

      2a937328f5b99eccb9b8c13ed71d6ffb9dff4521

    • SHA256

      18f4123ee42f5a29f8df7bd1cf95ab73441f082584f390aa218c2dd1134f4055

    • SHA512

      87013b63a9b153c5268784928394dfbf1eeff1b91eea6bdf187025e63d25c535e468e59a33f47d23682a386605bb314311e50a7edd1d6deb1b60f5008237a7d0

    • SSDEEP

      196608:TfavVYaolX+aFFLlPKQ8hY/RkQWslX4ge+:TiYaolrFFEHYu3sSge

    Score
    10/10
    mimikatzzhendiscoveryevasionexploitpersistencepyinstallerransomwarespywarestealer

    • Deletes Windows Defender Definitions

      Uses mpcmdrun utility to delete all AV definitions.

      evasion

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • Zhen Executable

    • Zhen Ransomware

      First seen in September 2020. Drops ransomnote as .ini file.

      ransomwarezhen

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Renames multiple (1884) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • mimikatz is an open source tool to dump credentials on Windows

    • Possible privilege escalation attempt

      exploit

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

File and Directory Permissions Modification

1
T1222

Impair Defenses

1
T1562

Modify Registry

2
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Network Service Discovery

1
T1046

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Tasks