be68f531d17da5e5b57800ca70e31d743ee5032de9135e7b98b2512cfb20b55f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

061be62f7839b786a497ecc6dc56ec76_JaffaCakes118
Size

157KB
Sample

241001-rayfjssgpj
MD5

061be62f7839b786a497ecc6dc56ec76
SHA1

b904d8a031848d0fe6918da629248efc791e0ba1
SHA256

be68f531d17da5e5b57800ca70e31d743ee5032de9135e7b98b2512cfb20b55f
SHA512

d3eacaee2b3ff4044442d7504fbd6143e437faaeb4f79b10a36d1314762d6ad1cb90a047f5e020e6484b84e5bd4749bb4ac4f08e759193a5adcda5c11661dea1
SSDEEP

3072:mmVEOrs5goNlDDUQjezsldPaDOTp9xyke0Jm7AOTugnI:/VEuS//UNQldaD8p2ke04vyn

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  061be62f7839b786a497ecc6dc56ec76_JaffaCakes118
- Size
  
  157KB
- MD5
  
  061be62f7839b786a497ecc6dc56ec76
- SHA1
  
  b904d8a031848d0fe6918da629248efc791e0ba1
- SHA256
  
  be68f531d17da5e5b57800ca70e31d743ee5032de9135e7b98b2512cfb20b55f
- SHA512
  
  d3eacaee2b3ff4044442d7504fbd6143e437faaeb4f79b10a36d1314762d6ad1cb90a047f5e020e6484b84e5bd4749bb4ac4f08e759193a5adcda5c11661dea1
- SSDEEP
  
  3072:mmVEOrs5goNlDDUQjezsldPaDOTp9xyke0Jm7AOTugnI:/VEuS//UNQldaD8p2ke04vyn
Score

9^/10

discovery persistence ransomware spyware stealer
- Renames multiple (175) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops file in Drivers directory
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistenceransomwarespywarestealer

behavioral2