Overview

overview

10

Static

static

3

eabe36d7d7...18.exe

windows7-x64

10

eabe36d7d7...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eabe36d7d77407d5b7b0d7059d794e39_JaffaCakes118

  • Size

    491KB

  • Sample

    240919-gz8mpsvblg

  • MD5

    eabe36d7d77407d5b7b0d7059d794e39

  • SHA1

    f8e4e0edb658380a813df054f477ab3d5af8ad4b

  • SHA256

    05f77e6ec37b63156c00611265bceefd5479ecc3dff18496ea6a6e4de0e859bf

  • SHA512

    fa615b05e895032b4c4d66f5458b76ac7f9bccbfab808b6e0c2df77fb5b58405a3c20bfce0571332e9ee72591cbeae295c0884f59e12941a77309bb4c4f737df

  • SSDEEP

    12288:cutrzh9xOXkUWzsKltSXkbnDlcQmbVXvUF5:cutr5OUUe3LSXSUvUP

Score
10/10
defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwaretrojan

Malware Config

Targets

    • Target

      eabe36d7d77407d5b7b0d7059d794e39_JaffaCakes118

    • Size

      491KB

    • MD5

      eabe36d7d77407d5b7b0d7059d794e39

    • SHA1

      f8e4e0edb658380a813df054f477ab3d5af8ad4b

    • SHA256

      05f77e6ec37b63156c00611265bceefd5479ecc3dff18496ea6a6e4de0e859bf

    • SHA512

      fa615b05e895032b4c4d66f5458b76ac7f9bccbfab808b6e0c2df77fb5b58405a3c20bfce0571332e9ee72591cbeae295c0884f59e12941a77309bb4c4f737df

    • SSDEEP

      12288:cutrzh9xOXkUWzsKltSXkbnDlcQmbVXvUF5:cutr5OUUe3LSXSUvUP

    Score
    10/10
    defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwaretrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Modifies security service

      evasion

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Disables taskbar notifications via registry modification

      evasion

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Sets service image path in registry

      persistence

    • Stops running service(s)

      evasionexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks for any installed AV software in registry

    • Drops desktop.ini file(s)

    • Enumerates processes with tasklist

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1
T1569

Service Execution

1
T1569.002

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Direct Volume Access

1
T1006

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Impair Defenses

2
T1562

Disable or Modify Tools

1
T1562.001

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

4
T1112

Credential Access

Discovery

Process Discovery

1
T1057

Query Registry

1
T1012

Remote System Discovery

1
T1018

Software Discovery

1
T1518

Security Software Discovery

1
T1518.001

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2
T1490

Service Stop

1
T1489

Tasks