General

  • Target

    69a4edafa563fbca38e1a73190b63718_JaffaCakes118

  • Size

    12KB

  • Sample

    241022-j6ghxawapa

  • MD5

    69a4edafa563fbca38e1a73190b63718

  • SHA1

    95c3cd4c13120015dcc0574b7f546524c2cb90e5

  • SHA256

    57b5154145d8c804ecf3adced8ef78549ded43b567c795aa1690a714a5b55cd6

  • SHA512

    f5406e0a97bcd68eb9a3f3a4828243d2d29705064bc2d4c84f111f0d1b991f54a995ce204b3a2886b8d39bfc72c320bd60c02d0f81303ee9401dd9aa4a2a232c

  • SSDEEP

    192:J/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjaGpsHcxUw4h+lfPtRMSgiIDh031O:JebFNw4Pk1itKkpAjjJs6B40WSgrDKk

Malware Config

Targets

    • Target

      69a4edafa563fbca38e1a73190b63718_JaffaCakes118

    • Size

      12KB

    • MD5

      69a4edafa563fbca38e1a73190b63718

    • SHA1

      95c3cd4c13120015dcc0574b7f546524c2cb90e5

    • SHA256

      57b5154145d8c804ecf3adced8ef78549ded43b567c795aa1690a714a5b55cd6

    • SHA512

      f5406e0a97bcd68eb9a3f3a4828243d2d29705064bc2d4c84f111f0d1b991f54a995ce204b3a2886b8d39bfc72c320bd60c02d0f81303ee9401dd9aa4a2a232c

    • SSDEEP

      192:J/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjaGpsHcxUw4h+lfPtRMSgiIDh031O:JebFNw4Pk1itKkpAjjJs6B40WSgrDKk

    • Renames multiple (2284) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Drops file in Drivers directory

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks