Overview

overview

10

Static

static

10

c3066d3a50...18.exe

windows7-x64

9

c3066d3a50...18.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c3066d3a50ac699c018baacc2eba38c7_JaffaCakes118

  • Size

    12KB

  • Sample

    241204-r4n4zatnfm

  • MD5

    c3066d3a50ac699c018baacc2eba38c7

  • SHA1

    10fc03945741936af5c3392bd5f77b47ebc23c44

  • SHA256

    8a7c6ae143a867e7689d23b6f9f71cc06387026eccd75247466da569cd2fe1d4

  • SHA512

    f80e44e362649aa0daae3f0c531e9e75f59dd4c458775b08ffa334ee7944a3f8f3d9649aa193a00c9d9e29ed4fcc659b29dcff011b7bef16a6f9c443759bb7b5

  • SSDEEP

    192:p/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjaGpsHcxUw4h+lfPtRM8iuamJGr:pebFNw4Pk1itKkpAjjJs6B40W8i

Score
10/10
xoristdiscoverypersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      c3066d3a50ac699c018baacc2eba38c7_JaffaCakes118

    • Size

      12KB

    • MD5

      c3066d3a50ac699c018baacc2eba38c7

    • SHA1

      10fc03945741936af5c3392bd5f77b47ebc23c44

    • SHA256

      8a7c6ae143a867e7689d23b6f9f71cc06387026eccd75247466da569cd2fe1d4

    • SHA512

      f80e44e362649aa0daae3f0c531e9e75f59dd4c458775b08ffa334ee7944a3f8f3d9649aa193a00c9d9e29ed4fcc659b29dcff011b7bef16a6f9c443759bb7b5

    • SSDEEP

      192:p/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjaGpsHcxUw4h+lfPtRM8iuamJGr:pebFNw4Pk1itKkpAjjJs6B40W8i

    Score
    9/10
    discoverypersistenceransomwarespywarestealer

    • Renames multiple (2214) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks