Overview

overview

10

Static

static

3

25d7c9ba82...18.exe

windows7-x64

10

25d7c9ba82...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118

  • Size

    9.1MB

  • Sample

    241008-1jk19ayhnl

  • MD5

    25d7c9ba82bd909ce4224177a87424c4

  • SHA1

    cdbe6272122b68ec2d666c3068733b3f17c1941f

  • SHA256

    a9b94093b5b8d953f43259f470b79a56b0582fd856e56905f831d5d94719ac93

  • SHA512

    0b2f205f048f7c4e691ded300176fbdf40b1413f998bc85eb1fa1d5d239d8c55a92dd65965350f0ca1ab9ae5cbfea81a0ffb24a3df715ba5f5a86b2d2012cfa5

  • SSDEEP

    98304:PE2cJIMzKpXOMGQ+IM/E2cJIMzKpIkMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMu:PnwI2ly+IunwI24I2ly8

Score
10/10
discoverypersistenceransomware

Malware Config

Targets

    • Target

      25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118

    • Size

      9.1MB

    • MD5

      25d7c9ba82bd909ce4224177a87424c4

    • SHA1

      cdbe6272122b68ec2d666c3068733b3f17c1941f

    • SHA256

      a9b94093b5b8d953f43259f470b79a56b0582fd856e56905f831d5d94719ac93

    • SHA512

      0b2f205f048f7c4e691ded300176fbdf40b1413f998bc85eb1fa1d5d239d8c55a92dd65965350f0ca1ab9ae5cbfea81a0ffb24a3df715ba5f5a86b2d2012cfa5

    • SSDEEP

      98304:PE2cJIMzKpXOMGQ+IM/E2cJIMzKpIkMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMu:PnwI2ly+IunwI24I2ly8

    Score
    10/10
    discoverypersistenceransomware

    • Modifies WinLogon for persistence

      persistence

    • Renames multiple (91) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks