Overview

overview

10

Static

static

10

951d28bfa6...18.exe

windows7-x64

9

951d28bfa6...18.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    951d28bfa67ae87a356041ca9a46046f_JaffaCakes118

  • Size

    18KB

  • Sample

    241124-q9ravayqaj

  • MD5

    951d28bfa67ae87a356041ca9a46046f

  • SHA1

    0fcc1bf1dad4fde89ab3fdc9da87bc0f7330a2fd

  • SHA256

    363475d0f90dce427656e61929a4bc6f2bfff052a003b44ecc81d2ada73c9d82

  • SHA512

    d0ca4004d587bd6ba640f86685896a525141b49580d977598648b1ffba43e6a5289b275f571833839e588699fb10bbf43a4b62cfcd5606f71e795a5ccd30bf7f

  • SSDEEP

    384:iebFNw4Pk1itKkpAjjI2Ypdm/iYpVg48JrX:i0FmBkpKjPYppYuFX

Score
10/10
xoristdiscoverypersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      951d28bfa67ae87a356041ca9a46046f_JaffaCakes118

    • Size

      18KB

    • MD5

      951d28bfa67ae87a356041ca9a46046f

    • SHA1

      0fcc1bf1dad4fde89ab3fdc9da87bc0f7330a2fd

    • SHA256

      363475d0f90dce427656e61929a4bc6f2bfff052a003b44ecc81d2ada73c9d82

    • SHA512

      d0ca4004d587bd6ba640f86685896a525141b49580d977598648b1ffba43e6a5289b275f571833839e588699fb10bbf43a4b62cfcd5606f71e795a5ccd30bf7f

    • SSDEEP

      384:iebFNw4Pk1itKkpAjjI2Ypdm/iYpVg48JrX:i0FmBkpKjPYppYuFX

    Score
    9/10
    discoverypersistenceransomwarespywarestealer

    • Renames multiple (2212) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks