f861639ece923b78ab0b83e19c33f43c7a3ebae05b880c0aada2ad4dc399de1e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

11fe44d273d379fa7a93ad510903b8a1_JaffaCakes118
Size

171KB
Sample

241004-fzq7zswepl
MD5

11fe44d273d379fa7a93ad510903b8a1
SHA1

4a18bd91acd42145aa01c3bffff7a10f738d0933
SHA256

f861639ece923b78ab0b83e19c33f43c7a3ebae05b880c0aada2ad4dc399de1e
SHA512

dbaf974bd205aa3e763ce0c6f32508a030e512810b7585ff2d6cdbce6cd1268bb22999654a0d65e6033bef8ae3b836cdf260d37e7956bb0e10d90521b0cc76e6
SSDEEP

3072:OaWQK32RpS+gevPVyY91iAKvBcMp68FVoptF4VUceP3/wUPtbqSAoGJ+jMi:DK30oevPVRXiAKv6qbV2tF4NePVAo+2

Score

7^/10

discovery persistence ransomware

Malware Config

Targets

- Target
  
  11fe44d273d379fa7a93ad510903b8a1_JaffaCakes118
- Size
  
  171KB
- MD5
  
  11fe44d273d379fa7a93ad510903b8a1
- SHA1
  
  4a18bd91acd42145aa01c3bffff7a10f738d0933
- SHA256
  
  f861639ece923b78ab0b83e19c33f43c7a3ebae05b880c0aada2ad4dc399de1e
- SHA512
  
  dbaf974bd205aa3e763ce0c6f32508a030e512810b7585ff2d6cdbce6cd1268bb22999654a0d65e6033bef8ae3b836cdf260d37e7956bb0e10d90521b0cc76e6
- SSDEEP
  
  3072:OaWQK32RpS+gevPVyY91iAKvBcMp68FVoptF4VUceP3/wUPtbqSAoGJ+jMi:DK30oevPVRXiAKv6qbV2tF4NePVAo+2
Score

7^/10

discovery persistence ransomware
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Deletes itself
- Adds Run key to start application
  persistence
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

discoverypersistenceransomware

behavioral2

discoverypersistenceransomware