e41e187f0d1e121fdf800420dcca8997196398960e600894e1c59096580a4114

Sharing

Copy URL Twitter E-mail

General

Target
janjapatch.zip
Size 3.9MB
Sample260824-3wpajsz1ct
SHA256 e41e187f0d1e121fdf800420dcca8997196398960e600894e1c59096580a4114
MD5 3f9023e1622c4854a415061d7301043f
SHA1 92187c7ec6b7afe89e522ee8e1fe8dea90fcbf18
SHA512 e2a0a7f607da41a5601a4adb9e6a6fea304639e71f8dc4285e1905117ffc6784e217fb672c28ed2140ed97b4731567f4027813bebd42325574377e0d899f7dfb
SSDEEP 98304:Dkf8XxuDJpHr1xugK/nk7Xk4WeKDgDOF0ygwlQy8dgTZ:QlDvup/kzk4YDgD+g3yFTZ
TLSH
T1D616334EB831DE65EC8B80BA2B771F7778442E9D5FB4B51DC0242CBAC64309227F2695
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  janjapatch.zip
- Size 3.9MB
- SHA256 e41e187f0d1e121fdf800420dcca8997196398960e600894e1c59096580a4114
- MD5 3f9023e1622c4854a415061d7301043f
- SHA1 92187c7ec6b7afe89e522ee8e1fe8dea90fcbf18
- SHA512 e2a0a7f607da41a5601a4adb9e6a6fea304639e71f8dc4285e1905117ffc6784e217fb672c28ed2140ed97b4731567f4027813bebd42325574377e0d899f7dfb
- SSDEEP 98304:Dkf8XxuDJpHr1xugK/nk7Xk4WeKDgDOF0ygwlQy8dgTZ:QlDvup/kzk4YDgD+g3yFTZ
- TLSH
  T1D616334EB831DE65EC8B80BA2B771F7778442E9D5FB4B51DC0242CBAC64309227F2695
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1
- Target
  JanjaPatch.exe
- Size 6.9MB
- SHA256 9b7b5ede91d34bdd062168568911fd15e7ff5f3eb12c6522d124df171f2602c1
- MD5 370257b0971137ef99db5e709f6b8fb0
- SHA1 c96b6c3240d8804dbb09618aa6c1301bd5e20466
- SHA512 93b40b746176ee5326e52bcd68a2072c811c75a7d8b2166f5c28289377823bacf37641425faefeaaf95bc4e17814376ebdb5e29a37209c6710aeda13c733aa51
- SSDEEP 98304:DNHzN1ETrqtwG5Uz1OFWA2GXh/V0AxyD+W/3:Dh5kGZV0GyDn3
- TLSH
  T12C766A217A9A98ACC15BC07483468AB25A3130DB1B35B9FF44D496793F7AAF41F3C358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  VERSION
- Size 6B
- SHA256 59854984853104df5c353e2f681a15fc7924742f9a2e468c29af248dce45ce03
- MD5 c9e47dbb0e1927076ed7b2e1ec157be7
- SHA1 c538b66c7110ca3a028ccfe422d0f1fa200a9935
- SHA512 c6e5081ce77f5971474ff994acc1b8887818f3007a4e3db32c91640203906f0bd2df3012441c9e1b6c1ae4e54dfea465ec23034092779cf6852aece45bf1df21
- MD5 SHA1 SHA512
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  banner.txt
- Size 1KB
- SHA256 91b0ed45705267a2f108b7764584b6f557792a364466d34692e071333b1e4685
- MD5 272ab24c4cd19b06df1ce4340667b78c
- SHA1 1ae09ec790ad0e102af64e0738e93ace55dc2b33
- SHA512 e189efd24f1ea2a43f486413ef2bcd01491e7eee3c5d386bb2a6e304d409ec7d4ff416a26229e8e989334f548d527c17141446aa440c478f7a182123c2062a22
- TLSH
  T10C2192D5FC950B82AE789BAE41807B60DE30468FDC02713C34FD03735B96F298A49417
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral4
- Target
  chrome/README.md
- Size 3KB
- SHA256 4b1104fd7b68bd417d29006d5350dd75aa2ccfc39e06c2c5008f7cfdde78f8be
- MD5 31794f45cf8712c15f549bb775efcddb
- SHA1 68578915623cd2fba5a775e34b06f328e38ef4e1
- SHA512 71fac81871fe8ac3b47f97cd2a8a4f5c203bccd300a01fc7d7920a6df0c15120f348880583182d8392b5a3064a9c6b4917cd10534b4bb392e6a241fcd3fcebbd
- TLSH
  T1CB71963B624533700EEF855DEA4E12C1EB21D058A72A7692B1CF415D1242BAD03BE7D6
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  chrome/background.js
- Size 37KB
- SHA256 0a82793fc9125d2ba94c915ad360b5aba5a05f3821f976cc02328adfb18ceea8
- MD5 cb894e476bdb6ded30b6aba85f656d64
- SHA1 8ea838a19ffbef82fe24ae1b564aebf05663c13b
- SHA512 20c0b75b88734c5a2f916ae97617ffe17c47e6dce79981686626f42a3dae9ca28df3343c7514a92c60db5a4a3264ae08bcc7bdc2f9c13dc883b05f85953f63e1
- SSDEEP 384:zzfdSREJY5xUG68EyDrOkG5PD+cd3efwq9csjPPxKoZeSgwLL45tLw9nasi7TGzN:zrgHOX+KefwyDrPZe3bMN/zd
- TLSH
  T10B03545924F3113243A720BCDB2FC02AB232D503B508DD967B9C96545FA95ADC6F3BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  chrome/gateway-proxy.js
- Size 11KB
- SHA256 4ad0cfe3ac178db2306b2aea0ac0f8ef1b5c40ecb5deb32ad6f89232e156bd3e
- MD5 9dab61ad63fdbfbfa3bba663706ea9d5
- SHA1 8a09355da83249a85dea9bf34054469e3d6087c8
- SHA512 6fc359f777ccde49eab092086945688d541bb8240e9c7ebbc9a3a4e058bed98fe6eeacd4b7f1d752c85725831a74a9fcb30ea8db761834fd480b991b187827c1
- SSDEEP 192:VW2/0I7lRs4xLFg9usTTPMqdrEtIi3jJxHKtZNSfyTvl3Sd1+zi5iQMTsnclQ27+:osfEFEtIexkM12scDU4GkSdgiTn
- TLSH
  T16F3266696BF3023692AB71794A2F10063339D0072859DD997B8C53506F8663C9AFDFB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  chrome/imgs/tray.png
- Size 132KB
- SHA256 adf0a7ec5410eacc2af0d32cc79b68fe414c8ff08ea723ff0e9310589c0c7900
- MD5 eb4378829c78121c1a83d572f62e27bf
- SHA1 1e654d5dbd9166600e3b3681c7ed7000d28e8046
- SHA512 a58d098ca365bd5785a911fd8ca65649e0f8e1af4754fc81f6f100bf5dbe45c07ba9e44deb706e0eeea99408a76b73c218d69df7262957fd5ba817e47f6bf1cb
- SSDEEP 3072:yICadZ2wAwWKmoBs+VSHaM0rD6wLV7OLfrQiyPiMhfoJpD2gJXXR5:yIDn2cmoBscSHaM0rDBLV7OIPiPjD2gl
- TLSH
  T13BD3126C63DB252FB4039DDB04B27A45DA6918C125C599FE806061AFFA18DEBE0D33F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  chrome/manifest.json
- Size 823B
- SHA256 3d768857d754c12caea1425a5a1f9eb5c55d9b117b61e7a82905d34df77d8584
- MD5 ce0957b382447391b7e45f6612be766a
- SHA1 efd1ccb3b8f90308e1fac2687b67cc6a39434789
- SHA512 6e30254c3ef9208bbd319c8c8163d95f3ef0e60965b4ee3b72bf0734d8dfb35621dc0ec230b500d3f2cb01d413352367a465e499f4eeec87db31653d085108c4
- TLSH
  T1AC01482AD4508DAB118C4624AEB60609B3140A4FA884BE4E735B404C8FDCD6F91BAA49
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9
- Target
  chrome/version-checker.js
- Size 8KB
- SHA256 70bc52d7c903326569d4c05fc15898aefb1cab44bff3773bd3614bb2d946780b
- MD5 1483dc9c3e069aa1e5139ccce3615e26
- SHA1 dade116db5065a46a3e43b6637acd6e59a61aebf
- SHA512 9cf66bc6b6652154fe3f517b18ba23dfcd12f1307f03962c0d493b0a84e8280390ab2836ffc8e5e7594b1a026b9a2ce2b425f9c8f5d98735004eb88fead645fe
- SSDEEP 192:7gCfJotFaIQQV1WQvDij5aUsCz2AAba0oWn:UCfSVD8HnyMu
- TLSH
  T17F02641829F715258B3232E9892F5052B271C10B39DDCAD9FA9C82412F9553CCB6EFF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10