Overview

overview

10

Static

static

3

a88691e332...18.exe

windows7-x64

10

a88691e332...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a88691e3326c603c387db1feba5b204e_JaffaCakes118

  • Size

    1.7MB

  • Sample

    241127-szl99azjbv

  • MD5

    a88691e3326c603c387db1feba5b204e

  • SHA1

    3889322291e15c5cf7724c2a38679b714c952dec

  • SHA256

    699de3cf358c7c037c5789133405e5be4697d3e0328f6b783a967ca6b87b5240

  • SHA512

    0e30b4ddb60d5b320d79c94c8a05408b7c2dd450f26d05fc0a13f0329e32f96d54dc1acba47434f5582f882a836222ecf76c062c5c4a07b57ff2675e386a6034

  • SSDEEP

    768:6/jTcgw9uRSN/HhzXEu12reKTj8ZnM9td17e9EG+6:9toI1H1EeKP0M9tdJ7G+6

Score
10/10
xoristdiscoverypersistenceransomwarespywarestealerupx

Malware Config

Targets

    • Target

      a88691e3326c603c387db1feba5b204e_JaffaCakes118

    • Size

      1.7MB

    • MD5

      a88691e3326c603c387db1feba5b204e

    • SHA1

      3889322291e15c5cf7724c2a38679b714c952dec

    • SHA256

      699de3cf358c7c037c5789133405e5be4697d3e0328f6b783a967ca6b87b5240

    • SHA512

      0e30b4ddb60d5b320d79c94c8a05408b7c2dd450f26d05fc0a13f0329e32f96d54dc1acba47434f5582f882a836222ecf76c062c5c4a07b57ff2675e386a6034

    • SSDEEP

      768:6/jTcgw9uRSN/HhzXEu12reKTj8ZnM9td17e9EG+6:9toI1H1EeKP0M9tdJ7G+6

    Score
    10/10
    xoristdiscoverypersistenceransomwarespywarestealerupx

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Xorist family

      xorist

    • Renames multiple (2191) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks