Overview

overview

10

Static

static

3

8ccce69652...18.exe

windows7-x64

10

8ccce69652...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8ccce69652942733ae5ceadd4faf8320_JaffaCakes118

  • Size

    222KB

  • Sample

    241103-wqbc6szgrd

  • MD5

    8ccce69652942733ae5ceadd4faf8320

  • SHA1

    d50c444d6959e851b56c7018b810b91ac7f9c14e

  • SHA256

    19b605a68fdec32ef6e596bcea5fbbb8f22c84b0f43a9c6f3e0f6699d04b545e

  • SHA512

    4ad035d016b660e0b776adaaae5e07544207a5cd4c8ae209be4ebb5dc14820e79c9c51cdfa402a3e5dfcbccc70cbf124635b000d50538073e9b2aabf6257ae88

  • SSDEEP

    6144:WGGG+BFoqjHH6oHI4CzgtD78nfa2Dhb6vzSFA:iBFnH0g78nCC8vzn

Score
10/10
xoristbootkitdiscoverypersistenceransomwarespywarestealerupx

Malware Config

Targets

    • Target

      8ccce69652942733ae5ceadd4faf8320_JaffaCakes118

    • Size

      222KB

    • MD5

      8ccce69652942733ae5ceadd4faf8320

    • SHA1

      d50c444d6959e851b56c7018b810b91ac7f9c14e

    • SHA256

      19b605a68fdec32ef6e596bcea5fbbb8f22c84b0f43a9c6f3e0f6699d04b545e

    • SHA512

      4ad035d016b660e0b776adaaae5e07544207a5cd4c8ae209be4ebb5dc14820e79c9c51cdfa402a3e5dfcbccc70cbf124635b000d50538073e9b2aabf6257ae88

    • SSDEEP

      6144:WGGG+BFoqjHH6oHI4CzgtD78nfa2Dhb6vzSFA:iBFnH0g78nCC8vzn

    Score
    10/10
    xoristbootkitdiscoverypersistenceransomwarespywarestealerupx

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Xorist family

      xorist

    • Renames multiple (2212) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks