Overview

overview

10

Static

static

3

761c1fd0fd...18.exe

windows7-x64

10

761c1fd0fd...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    761c1fd0fd125f26482ed641b374a24f_JaffaCakes118

  • Size

    307KB

  • Sample

    241027-1qw24atbqb

  • MD5

    761c1fd0fd125f26482ed641b374a24f

  • SHA1

    d6043c7269cabd9b540a4ba7972259d32d5a18a3

  • SHA256

    31a9ca0a1f20618bf113dd2b03a0cb28fc003a800e49c74b97e9baca5acc26e2

  • SHA512

    b707ed5f80b0d1bb1978eec88d931776e53d8b693951ff1f4fffd47e077b127e8b126f8d6b11d719117ab082455635b751a5664cf7941a0c245ee0a66aaae830

  • SSDEEP

    6144:8EdrcSuQNS+Q/yvt6+36R2eqHzs5oP+8fgsOznWqZajzCrY4Ff/:MjX/yn3RHzsmP+agVznWqZa/Cr79

Score
10/10
jigsawpersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      761c1fd0fd125f26482ed641b374a24f_JaffaCakes118

    • Size

      307KB

    • MD5

      761c1fd0fd125f26482ed641b374a24f

    • SHA1

      d6043c7269cabd9b540a4ba7972259d32d5a18a3

    • SHA256

      31a9ca0a1f20618bf113dd2b03a0cb28fc003a800e49c74b97e9baca5acc26e2

    • SHA512

      b707ed5f80b0d1bb1978eec88d931776e53d8b693951ff1f4fffd47e077b127e8b126f8d6b11d719117ab082455635b751a5664cf7941a0c245ee0a66aaae830

    • SSDEEP

      6144:8EdrcSuQNS+Q/yvt6+36R2eqHzs5oP+8fgsOznWqZajzCrY4Ff/:MjX/yn3RHzsmP+agVznWqZa/Cr79

    Score
    10/10
    jigsawpersistenceransomwarespywarestealer

    • Jigsaw Ransomware

      Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

      ransomwarejigsaw

    • Jigsaw family

      jigsaw

    • Renames multiple (2000) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks