General

  • Target

    JaffaCakes118_051875eab29fc911406e0d140622d7c0

  • Size

    444KB

  • Sample

    250516-b6p62svrt5

  • MD5

    051875eab29fc911406e0d140622d7c0

  • SHA1

    76864a5fc806906c3ed69b02f9fc0f5c136f8ae9

  • SHA256

    706d5e60d9847bf7a438b4e9b61b97a777933c031fbce7b611e34711cc1afeca

  • SHA512

    07e81eab6643f4653576cf7853b68eaed1ee6d3c33c2f1332d4f5f0eae9dec540066212700a63b0953f2bfcc901ce01ccc04b1357ffc920353a2b6a8adc484a7

  • SSDEEP

    12288:O2Jt024Gj+BZnGU2Yjo13OvXAP9GKC0rbykqY:Ot2nL0g+QPAKt/L

Malware Config

Targets

    • Target

      JaffaCakes118_051875eab29fc911406e0d140622d7c0

    • Size

      444KB

    • MD5

      051875eab29fc911406e0d140622d7c0

    • SHA1

      76864a5fc806906c3ed69b02f9fc0f5c136f8ae9

    • SHA256

      706d5e60d9847bf7a438b4e9b61b97a777933c031fbce7b611e34711cc1afeca

    • SHA512

      07e81eab6643f4653576cf7853b68eaed1ee6d3c33c2f1332d4f5f0eae9dec540066212700a63b0953f2bfcc901ce01ccc04b1357ffc920353a2b6a8adc484a7

    • SSDEEP

      12288:O2Jt024Gj+BZnGU2Yjo13OvXAP9GKC0rbykqY:Ot2nL0g+QPAKt/L

    • Modifies visibility of file extensions in Explorer

    • Renames multiple (53) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks