General

  • Target

    79ccdcce117dc3dbe22d5a999ca8a6cc_JaffaCakes118

  • Size

    12KB

  • Sample

    241028-qfz1wsxpdl

  • MD5

    79ccdcce117dc3dbe22d5a999ca8a6cc

  • SHA1

    3f750fa10dc50b127de7ba592b792a25be4e9b5b

  • SHA256

    e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253

  • SHA512

    795ed18d899fe7c3d4b20d4d8b24beb2ebcca88e3b8b3a8927391a8f4842cf8f8fefb6dfad5af23dc4548b710fb10c2edf414ac369f91177a6d693579cd790dc

  • SSDEEP

    192:G/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMiFlZH:GebFNw4Pk1itKkpAjjI2YpdmiFlZH

Malware Config

Targets

    • Target

      79ccdcce117dc3dbe22d5a999ca8a6cc_JaffaCakes118

    • Size

      12KB

    • MD5

      79ccdcce117dc3dbe22d5a999ca8a6cc

    • SHA1

      3f750fa10dc50b127de7ba592b792a25be4e9b5b

    • SHA256

      e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253

    • SHA512

      795ed18d899fe7c3d4b20d4d8b24beb2ebcca88e3b8b3a8927391a8f4842cf8f8fefb6dfad5af23dc4548b710fb10c2edf414ac369f91177a6d693579cd790dc

    • SSDEEP

      192:G/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMiFlZH:GebFNw4Pk1itKkpAjjI2YpdmiFlZH

    • Renames multiple (2171) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Drops file in Drivers directory

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks