Overview

overview

7

Static

static

3

ddf101f7ed...18.exe

windows7-x64

3

ddf101f7ed...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    ddf101f7ed9935fedaa064039357bd9a_JaffaCakes118

  • Size

    194KB

  • Sample

    240913-h5597s1cml

  • MD5

    ddf101f7ed9935fedaa064039357bd9a

  • SHA1

    14bc7a40a63ac410439c7c774a4b06217a0e3831

  • SHA256

    da764453a64a04ccaa15e1faaf4a82da4e1510ea39b977310128f12ad0be44cc

  • SHA512

    b4f8f87a87c617ed9fcf76c072a9469850d0ab8c137bc08084aec5aa21f1d1e6a0668a3123196a5dbf5bbdd514ca3e8b05a0e10b5c4b927a4b9c1ad5c7767741

  • SSDEEP

    3072:GSNREobysAXhRtsmJMBTev9kK3O3SwXKFsG2E9wpqoyCQufAFK3vM7Srtq:GSvARRt30E9S3SeKP9wtyCQuE7ctq

Score
7/10
discoverypersistenceransomware

Malware Config

Targets

    • Target

      ddf101f7ed9935fedaa064039357bd9a_JaffaCakes118

    • Size

      194KB

    • MD5

      ddf101f7ed9935fedaa064039357bd9a

    • SHA1

      14bc7a40a63ac410439c7c774a4b06217a0e3831

    • SHA256

      da764453a64a04ccaa15e1faaf4a82da4e1510ea39b977310128f12ad0be44cc

    • SHA512

      b4f8f87a87c617ed9fcf76c072a9469850d0ab8c137bc08084aec5aa21f1d1e6a0668a3123196a5dbf5bbdd514ca3e8b05a0e10b5c4b927a4b9c1ad5c7767741

    • SSDEEP

      3072:GSNREobysAXhRtsmJMBTev9kK3O3SwXKFsG2E9wpqoyCQufAFK3vM7Srtq:GSvARRt30E9S3SeKP9wtyCQuE7ctq

    Score
    7/10
    discoverypersistenceransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks