Overview

overview

10

Static

static

5

846b3e30cd...18.exe

windows7-x64

10

846b3e30cd...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    846b3e30cd174661265a4c925cf73865_JaffaCakes118

  • Size

    23KB

  • Sample

    241101-nxep6szgmd

  • MD5

    846b3e30cd174661265a4c925cf73865

  • SHA1

    78be287dfd593ec5e87b31ef20347bebb61abfcb

  • SHA256

    a3c19a448c24e965c3467e7dc70ac417c730db5fad66cde644bf837feb3f1935

  • SHA512

    9714acd51b2f23090169da09d3f9c5d804c3aca385de6e375df92fdcc0cd1a4aaa33c1c7e3e5904f013f002840b6f6da263c6fb8c7dfa503a2ab5aa3ae516e5b

  • SSDEEP

    384:kAhgmZnWs/FBSPGvx2Ji+xN48gUbhFQa0h+dVkaioSSBMmVw+vNrY0BEY0177ZX3:k2gh7G527lLQaEU3OSS93fd7Bc

Score
10/10
xoristdiscoverypersistenceransomwarespywarestealerupx

Malware Config

Targets

    • Target

      846b3e30cd174661265a4c925cf73865_JaffaCakes118

    • Size

      23KB

    • MD5

      846b3e30cd174661265a4c925cf73865

    • SHA1

      78be287dfd593ec5e87b31ef20347bebb61abfcb

    • SHA256

      a3c19a448c24e965c3467e7dc70ac417c730db5fad66cde644bf837feb3f1935

    • SHA512

      9714acd51b2f23090169da09d3f9c5d804c3aca385de6e375df92fdcc0cd1a4aaa33c1c7e3e5904f013f002840b6f6da263c6fb8c7dfa503a2ab5aa3ae516e5b

    • SSDEEP

      384:kAhgmZnWs/FBSPGvx2Ji+xN48gUbhFQa0h+dVkaioSSBMmVw+vNrY0BEY0177ZX3:k2gh7G527lLQaEU3OSS93fd7Bc

    Score
    10/10
    xoristdiscoverypersistenceransomwarespywarestealerupx

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Xorist family

      xorist

    • Renames multiple (3275) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks