Overview

overview

10

Static

static

1

JaffaCakes...8.html

windows10-ltsc 2021-x64

10

Resubmissions

14-01-2025 17:00

250114-vjbvpawjej 10

14-01-2025 16:59

250114-vhpedstlbz 10

14-01-2025 16:53

250114-vd4nhstkdy 8

14-01-2025 16:43

250114-t8fz9svpep 10

13-01-2025 20:11

250113-yyefxaymfk 3

13-01-2025 20:00

250113-yqyvkswma1 7

13-01-2025 17:23

250113-vycqjazrbw 4

13-01-2025 17:10

250113-vpy76sznfx 10

13-01-2025 16:55

250113-vfc9casjcj 10

13-01-2025 16:48

250113-vbjwbs1qer 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_1d93e8597dd860cf81cd913c4b997818

  • Size

    25KB

  • Sample

    250113-vfc9casjcj

  • MD5

    1d93e8597dd860cf81cd913c4b997818

  • SHA1

    a7dacf6a32b194720a87130a16f2222c44f036eb

  • SHA256

    6514b345465786d232a61f8aca8e3b60e2bf8a3e45f237086e55caac0c19cb4d

  • SHA512

    c35592acafe20b18914ba7ee31201faa7534136df292d7c14436fb3bcbdd5f07b96b3b63897509068b8263ec4e12f55e192de027996dac8e63e08712fb891e98

  • SSDEEP

    384:PqlIcCtF4JVGTHyk9v1o99t5W9ISFaTGHx6QckT/gbpLOXguLZ:sZtSF5zg9ExLZ

Score
10/10
chimeradiscoverypersistenceransomwareupx

Malware Config

Targets

    • Target

      JaffaCakes118_1d93e8597dd860cf81cd913c4b997818

    • Size

      25KB

    • MD5

      1d93e8597dd860cf81cd913c4b997818

    • SHA1

      a7dacf6a32b194720a87130a16f2222c44f036eb

    • SHA256

      6514b345465786d232a61f8aca8e3b60e2bf8a3e45f237086e55caac0c19cb4d

    • SHA512

      c35592acafe20b18914ba7ee31201faa7534136df292d7c14436fb3bcbdd5f07b96b3b63897509068b8263ec4e12f55e192de027996dac8e63e08712fb891e98

    • SSDEEP

      384:PqlIcCtF4JVGTHyk9v1o99t5W9ISFaTGHx6QckT/gbpLOXguLZ:sZtSF5zg9ExLZ

    Score
    10/10
    chimeradiscoverypersistenceransomwareupx

    • Chimera

      Ransomware which infects local and network files, often distributed via Dropbox links.

      ransomwarechimera

    • Chimera Ransomware Loader DLL

      Drops/unpacks executable file which resembles Chimera's Loader.dll.

      ransomware

    • Chimera family

      chimera

    • Renames multiple (3294) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks