ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eae7974d820bd517495222b9a616a5c5_JaffaCakes118
Size

554KB
Sample

240919-jxm94aybqg
MD5

eae7974d820bd517495222b9a616a5c5
SHA1

ed1344541be0cce3e93177ac577f56fa0b06b9f4
SHA256

ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9
SHA512

2cc45bdb0b359d65246b731f9b009de68c625fc667bcd5f19d8e5846a7b627af65cb78665f86d9913f398cf734fe00a65480612b4d3c083f6d661434f581c679
SSDEEP

12288:YQjLuRE4xKR72qKoe/ZWsYUxUKQzZZQZsqtOqN:nLueaKR72qKoe/EhdKYavN

Score

9^/10

defense_evasion discovery evasion execution impact persistence ransomware trojan

Malware Config

Targets

- Target
  
  eae7974d820bd517495222b9a616a5c5_JaffaCakes118
- Size
  
  554KB
- MD5
  
  eae7974d820bd517495222b9a616a5c5
- SHA1
  
  ed1344541be0cce3e93177ac577f56fa0b06b9f4
- SHA256
  
  ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9
- SHA512
  
  2cc45bdb0b359d65246b731f9b009de68c625fc667bcd5f19d8e5846a7b627af65cb78665f86d9913f398cf734fe00a65480612b4d3c083f6d661434f581c679
- SSDEEP
  
  12288:YQjLuRE4xKR72qKoe/ZWsYUxUKQzZZQZsqtOqN:nLueaKR72qKoe/EhdKYavN
Score

9^/10

defense_evasion discovery evasion execution impact persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwaretrojan

behavioral2