xorist | 72f9ab0e73104cb19a765b7055ba58e74995faa36ed24bd7c30db9ec568a8eca | Triage

Sharing

General

Target

7d3489a0ee9216a6b4ac6c573bef5d23_JaffaCakes118
Size

12KB
Sample

241030-ac4xnstncl
MD5

7d3489a0ee9216a6b4ac6c573bef5d23
SHA1

23988ae6ab99186a74119ad2ef401af506b7cb64
SHA256

72f9ab0e73104cb19a765b7055ba58e74995faa36ed24bd7c30db9ec568a8eca
SHA512

27b4397f5af6f7ca3c8e8267c044feaf965ba7d5faff433dc3652fbf47c6c170d6debbeef4015b96d3affaa2df8b3de37ffda1e35118a639393d702018e49001
SSDEEP

192:e/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMFUUgN:eebFNw4Pk1itKkpAjjI2YpdmFUU

Score

10^/10

xorist discovery persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  7d3489a0ee9216a6b4ac6c573bef5d23_JaffaCakes118
- Size
  
  12KB
- MD5
  
  7d3489a0ee9216a6b4ac6c573bef5d23
- SHA1
  
  23988ae6ab99186a74119ad2ef401af506b7cb64
- SHA256
  
  72f9ab0e73104cb19a765b7055ba58e74995faa36ed24bd7c30db9ec568a8eca
- SHA512
  
  27b4397f5af6f7ca3c8e8267c044feaf965ba7d5faff433dc3652fbf47c6c170d6debbeef4015b96d3affaa2df8b3de37ffda1e35118a639393d702018e49001
- SSDEEP
  
  192:e/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMFUUgN:eebFNw4Pk1itKkpAjjI2YpdmFUU
Score

9^/10

discovery persistence ransomware spyware stealer
- Renames multiple (2153) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops file in Drivers directory
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistenceransomwarespywarestealer

behavioral2

discoverypersistenceransomwarespywarestealer