2bdf894b05844e6ce24c7a42eaf3abae2312b094d1277db0a09bc83a8fef886a | Triage

Sharing

General

Target

b01e46bf32bbd7ee487afa466675d66e_JaffaCakes118
Size

17.5MB
Sample

241129-kp8rhawmbs
MD5

b01e46bf32bbd7ee487afa466675d66e
SHA1

bc824d6f59df34c2921e82b28117c06c8d067078
SHA256

2bdf894b05844e6ce24c7a42eaf3abae2312b094d1277db0a09bc83a8fef886a
SHA512

5ee755da3d0a7dfee73413c25177a930b3e1ecf4e1270d9c83a9b4af3c7beff7318a855b87514da16ef39ae9e82e4e60728d4e3c708616724fad764888125e1c
SSDEEP

393216:Yvys39dd49QjUcMqaMVvvBLs1cP9yukE2y8Ql:Yvy79yFM0HEcP9170Ql

Score

8^/10

discovery exploit ransomware

Malware Config

Targets

- Target
  
  b01e46bf32bbd7ee487afa466675d66e_JaffaCakes118
- Size
  
  17.5MB
- MD5
  
  b01e46bf32bbd7ee487afa466675d66e
- SHA1
  
  bc824d6f59df34c2921e82b28117c06c8d067078
- SHA256
  
  2bdf894b05844e6ce24c7a42eaf3abae2312b094d1277db0a09bc83a8fef886a
- SHA512
  
  5ee755da3d0a7dfee73413c25177a930b3e1ecf4e1270d9c83a9b4af3c7beff7318a855b87514da16ef39ae9e82e4e60728d4e3c708616724fad764888125e1c
- SSDEEP
  
  393216:Yvys39dd49QjUcMqaMVvvBLs1cP9yukE2y8Ql:Yvy79yFM0HEcP9170Ql
Score

8^/10

discovery exploit ransomware
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/Banner.dll
- Size
  
  4KB
- MD5
  
  0116a50101c4107a138a588d1e46fca5
- SHA1
  
  b781dce23e828cf2b97306661c7dad250a6aaf77
- SHA256
  
  ab80cf45070d936f0745f5e39b22e6e07ba90aa179b5ec4469ef6e2cb1b9ef6b
- SHA512
  
  55de6aeaad05b01a25828553d3ea9f1b32a8b0c35c42dc6106bed244320e3421ec6a6f5359b15f9d18dd1e9692ca5572b2736d9d48cceb07b9443601d00a5988
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/ExecCmd.dll
- Size
  
  4KB
- MD5
  
  b1d08c24cad3f8f6ccd6b9ebd24d30c0
- SHA1
  
  d01549db25d0345c05d3c2eb90b173f937966ce5
- SHA256
  
  c4b6ff0091b3401670c8c6d3cb337d3ba0c2a514e66b0ea3501bb7ef78ddba69
- SHA512
  
  9cb5735c86cdf8d126268b7b2ec8fafd654d69bdfe5336d54b7d44b5ac8e1174836c487bb4aa40517516a55323bf9f916a96753c8dd2bc9b2d481071c9d9fbf8
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/JpgToBmp.exe
- Size
  
  44KB
- MD5
  
  a3e8696c93ad86d6b76a455e9d04582f
- SHA1
  
  17368dc01a16b6a67663c1900575aa96f5e170ba
- SHA256
  
  cce22a24171bca94741e8e5aed408b8abf33f20a27c6fe8696947285e7e7da70
- SHA512
  
  85de5fcdc530c787aae8aa9ef3a0c27f22ac65dd8ca066e71859b417d141cf49d4013fc05b008cd49dad66a90f23efcd8bd37bc7360c6873171e334cbb7ce30c
- SSDEEP
  
  768:VZmjJPk428s6nJrvfB/yLtpMUnN3aml6:VS3JDfsRdNHl6
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  c17103ae9072a06da581dec998343fc1
- SHA1
  
  b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA256
  
  dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- SHA512
  
  d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/UXTheme Patcher.exe
- Size
  
  72KB
- MD5
  
  c35efaa15f6f1da888efc247e886389d
- SHA1
  
  e3f35519380a564ff62f5ea2fa95fd5bca38bb1a
- SHA256
  
  558f6e38c300957234231234c44ccf41217182677e859c9005a51094bdf01794
- SHA512
  
  fd3d27271cab60f51929a4e92cccd0ce2edf8c95fd2db6cc957620ff2f7522e644b67862ec7803e6068f5ae75caedad9daae3dafdd4b7f4898c618c8498dca16
- SSDEEP
  
  1536:oI78vwnEmMpryYRt2M5d3YieAB3iW+IalC6L9XMI+l1+hX:/78vwnEm+1RAkd3deANZ+IoC6xXMIYg1
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/UXTheme Patcher64.exe
- Size
  
  92KB
- MD5
  
  5eac71e2ab8b58f00da48a21becb586f
- SHA1
  
  57fe7ac0196a04b535615f19b0758e75071a9943
- SHA256
  
  196756bea46f45de4b8e2eedebd51df8222f627f1eb9c2876d927718c85286e9
- SHA512
  
  2345d45a9d2b163d2a550808ab2af72748e80615e9d7965d40642b80cf53c3eab3ad07cbfed6b8b97ea1656436306919de6e74fef9f62c62456bd058c70830ff
- SSDEEP
  
  1536:gygP+gUrcNLHnX6YlQZfIpFSC6L9XMI+l1+N2:zgPbtNLHBlQZfIWC6xXMIYgs
Score

1^/10
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/inetc.dll
- Size
  
  20KB
- MD5
  
  f02155fa3e59a8fc48a74a236b2bb42e
- SHA1
  
  6d76ee8f86fb29f3352c9546250d940f1a476fb8
- SHA256
  
  096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999
- SHA512
  
  8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399
- SSDEEP
  
  384:voJLJVqG5WLJgu/Emx1Ywxd2ZmX66vwUhU7ya4LC0Ac9khYLMkIX0+Gv8gcLom7:AJVkN8mHYwxdWmX3wUhUua4LeT7
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  c10e04dd4ad4277d5adc951bb331c777
- SHA1
  
  b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA256
  
  e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- SHA512
  
  853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP
  
  96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  
  $PLUGINSDIR/nsExec.dll
- Size
  
  6KB
- MD5
  
  acc2b699edfea5bf5aae45aba3a41e96
- SHA1
  
  d2accf4d494e43ceb2cff69abe4dd17147d29cc2
- SHA256
  
  168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
- SHA512
  
  e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
- SSDEEP
  
  96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  
  $PLUGINSDIR/xml.dll
- Size
  
  118KB
- MD5
  
  42df1fbaa87567adf2b4050805a1a545
- SHA1
  
  b892a6efbb39b7144248e0c0d79e53da474a9373
- SHA256
  
  e900fcb9d598643eb0ee3e4005da925e73e70dbaa010edc4473e99ea0638b845
- SHA512
  
  4537d408e2f54d07b018907c787da6c7340f909a1789416de33d090055eda8918f338d8571bc3b438dd89e5e03e0ded70c86702666f12adb98523a91cbb1de1d
- SSDEEP
  
  1536:U2A8OSGjylgkara+70LICin9zgtg2LxowhtJu6MqSNicNEtIfF42q2KC:OzjLkarn7O+n9z2L6whFtGF42bK
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  
  $PROGRAMFILES/8 Skin Pack/$PROGRAMFILES/8 Skin Pack/uninst.exe
- Size
  
  355KB
- MD5
  
  50d1281001c24d935a347ce4cbcc42e6
- SHA1
  
  8de02314fe088f8b60b283a66e34dbb3ea1a211d
- SHA256
  
  ef3894b05d322084194fac6308414a08e86b1f5c4c9a42780fe1c313800c5aa9
- SHA512
  
  6d37c70120f4b67983aeb386383e6552ff9dc2150f382421d6c1fd00d4d639578b916ed6c5dccc12bdb30480daf32984ac9c7d8d99205e1b56d484fc5806f98e
- SSDEEP
  
  6144:+sIcOhURy+PcrmyK+7qWAxVdzO428hqhmDsI451KrELXe4:OA8+PiK++WGzOeoKsTOrEz
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral23 behavioral24
- Target
  
  $PLUGINSDIR/ExecCmd.dll
- Size
  
  4KB
- MD5
  
  b1d08c24cad3f8f6ccd6b9ebd24d30c0
- SHA1
  
  d01549db25d0345c05d3c2eb90b173f937966ce5
- SHA256
  
  c4b6ff0091b3401670c8c6d3cb337d3ba0c2a514e66b0ea3501bb7ef78ddba69
- SHA512
  
  9cb5735c86cdf8d126268b7b2ec8fafd654d69bdfe5336d54b7d44b5ac8e1174836c487bb4aa40517516a55323bf9f916a96753c8dd2bc9b2d481071c9d9fbf8
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  c17103ae9072a06da581dec998343fc1
- SHA1
  
  b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA256
  
  dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- SHA512
  
  d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  c10e04dd4ad4277d5adc951bb331c777
- SHA1
  
  b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA256
  
  e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- SHA512
  
  853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP
  
  96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  
  $PLUGINSDIR/nsExec.dll
- Size
  
  6KB
- MD5
  
  acc2b699edfea5bf5aae45aba3a41e96
- SHA1
  
  d2accf4d494e43ceb2cff69abe4dd17147d29cc2
- SHA256
  
  168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
- SHA512
  
  e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
- SSDEEP
  
  96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

discoveryexploitransomware

behavioral2

discoveryransomware

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32