General

  • Target

    7a2a1fdc535f9b9a76443231e3f8b0c4_JaffaCakes118

  • Size

    12KB

  • Sample

    241028-sfyh6sscpm

  • MD5

    7a2a1fdc535f9b9a76443231e3f8b0c4

  • SHA1

    f3a8add78cae37caab8750ee1fe86d86a19f9584

  • SHA256

    b99b02ee83460973ec47f4a067e1f7fa4fdff073f6771b523035b505855e8815

  • SHA512

    cd107296bc451bc39f052c4da3e70290d2d8873454a42808e7fc064dc990127a27b319bf2ff78293fe8e0f608b7c583003db09b3502b1abbc8a9eb83ea10cf5c

  • SSDEEP

    192:Vu1/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMp1SWt:Vu1ebFNw4Pk1itKkpAjjI2Ypdmp

Malware Config

Targets

    • Target

      7a2a1fdc535f9b9a76443231e3f8b0c4_JaffaCakes118

    • Size

      12KB

    • MD5

      7a2a1fdc535f9b9a76443231e3f8b0c4

    • SHA1

      f3a8add78cae37caab8750ee1fe86d86a19f9584

    • SHA256

      b99b02ee83460973ec47f4a067e1f7fa4fdff073f6771b523035b505855e8815

    • SHA512

      cd107296bc451bc39f052c4da3e70290d2d8873454a42808e7fc064dc990127a27b319bf2ff78293fe8e0f608b7c583003db09b3502b1abbc8a9eb83ea10cf5c

    • SSDEEP

      192:Vu1/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMp1SWt:Vu1ebFNw4Pk1itKkpAjjI2Ypdmp

    • Renames multiple (2193) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Drops file in Drivers directory

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks