Overview

overview

10

Static

static

0746594fc3...2f.exe

windows7_x64

10

0746594fc3...2f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0746594fc3e49975d3d94bac8e80c0cdaa96d90ede3b271e6f372f55b20bac2f

  • Size

    152KB

  • Sample

    220531-c7wkwsbfd9

  • MD5

    924c84415b775af12a10366469d3df69

  • SHA1

    8ab568db2bc914e3e6af048666eb0bc4ba2e414d

  • SHA256

    0746594fc3e49975d3d94bac8e80c0cdaa96d90ede3b271e6f372f55b20bac2f

  • SHA512

    6a9e510ff772a6a3018d61b27b6f465abde75cbcb9c64dcdbae6ed4ff2c2d2d1dde41ed9ab14e5c5191bc7e061a100a3775ec456fc49357a317f05cd3d996368

Score
10/10
ransomwarespywarestealersuricata

Malware Config

Extracted

Path

C:\ReadMe.html

Ransom Note
<html> <head> <meta content="text/html; charset=UTF-8" http-equiv="content-type"> <title>jaff decryptor system</title> </head> <body style="background-color: rgb(102, 204, 204); color: rgb(0, 0, 0);" alink="#ee0000" link="#0000ee" vlink="#551a8b"> <div style="position: absolute; top:0; text-align:center; width:100%" > <h1 style="font-family: System; color: rgb(102, 102, 102);"><big>jaff decryptor system</big></h1> </div> <style> .center { width: 1000px; padding: 10px; margin: auto; background: #fc0; } </style> <div style="position: absolute; top:15%; left: 30%;" > <p style="border: 3px solid rgb(255, 255, 10); padding: 10px; background-color: rgb(223, 213, 209); text-align: left;"><big><big>Files are encrypted!</big></big><br> <br> <big><big>To decrypt flies you need to obtain the private key.<br> The only copy of the private key, which will allow you to decrypt your files, is located on a secret server in the Internet<br> <br> </big></big>&#10102;<big><big> You must install Tor Browser: https://www.torproject.org/download/download-easy.html.en<br> <br> </big></big>&#10103;<big><big> After instalation, run the Tor Browser and enter address: http://rktazuzi7hbln7sy.onion/<br> <br> Follow the instruction on the web-site.</big></big><br> </p> <br> <br> <center><h1><big>Your decrypt ID: 4111296342</big></h1></center> </div> </div> </body> </html>
URLs

http-equiv="content-type">

http://rktazuzi7hbln7sy.onion/<br>

Extracted

Path

C:\ReadMe.txt

Ransom Note
jaff decryptor system Files are encrypted! To decrypt flies you need to obtain the private key. The only copy of the private key, which will allow you to decrypt your files, is located on a secret server in the Internet You must install Tor Browser: https://www.torproject.org/download/download-easy.html.en After instalation,run the Tor Browser and enter address: http://rktazuzi7hbln7sy.onion/ Follow the instruction on the web-site. Your decrypt ID: 4111296342
URLs

http://rktazuzi7hbln7sy.onion/

Extracted

Path

C:\ReadMe.html

Ransom Note
<html> <head> <meta content="text/html; charset=UTF-8" http-equiv="content-type"> <title>jaff decryptor system</title> </head> <body style="background-color: rgb(102, 204, 204); color: rgb(0, 0, 0);" alink="#ee0000" link="#0000ee" vlink="#551a8b"> <div style="position: absolute; top:0; text-align:center; width:100%" > <h1 style="font-family: System; color: rgb(102, 102, 102);"><big>jaff decryptor system</big></h1> </div> <style> .center { width: 1000px; padding: 10px; margin: auto; background: #fc0; } </style> <div style="position: absolute; top:15%; left: 30%;" > <p style="border: 3px solid rgb(255, 255, 10); padding: 10px; background-color: rgb(223, 213, 209); text-align: left;"><big><big>Files are encrypted!</big></big><br> <br> <big><big>To decrypt flies you need to obtain the private key.<br> The only copy of the private key, which will allow you to decrypt your files, is located on a secret server in the Internet<br> <br> </big></big>&#10102;<big><big> You must install Tor Browser: https://www.torproject.org/download/download-easy.html.en<br> <br> </big></big>&#10103;<big><big> After instalation, run the Tor Browser and enter address: http://rktazuzi7hbln7sy.onion/<br> <br> Follow the instruction on the web-site.</big></big><br> </p> <br> <br> <center><h1><big>Your decrypt ID: 1538912692</big></h1></center> </div> </div> </body> </html>
URLs

http-equiv="content-type">

http://rktazuzi7hbln7sy.onion/<br>

Extracted

Path

C:\ReadMe.txt

Ransom Note
jaff decryptor system Files are encrypted! To decrypt flies you need to obtain the private key. The only copy of the private key, which will allow you to decrypt your files, is located on a secret server in the Internet You must install Tor Browser: https://www.torproject.org/download/download-easy.html.en After instalation,run the Tor Browser and enter address: http://rktazuzi7hbln7sy.onion/ Follow the instruction on the web-site. Your decrypt ID: 1538912692
URLs

http://rktazuzi7hbln7sy.onion/

Targets

    • Target

      0746594fc3e49975d3d94bac8e80c0cdaa96d90ede3b271e6f372f55b20bac2f

    • Size

      152KB

    • MD5

      924c84415b775af12a10366469d3df69

    • SHA1

      8ab568db2bc914e3e6af048666eb0bc4ba2e414d

    • SHA256

      0746594fc3e49975d3d94bac8e80c0cdaa96d90ede3b271e6f372f55b20bac2f

    • SHA512

      6a9e510ff772a6a3018d61b27b6f465abde75cbcb9c64dcdbae6ed4ff2c2d2d1dde41ed9ab14e5c5191bc7e061a100a3775ec456fc49357a317f05cd3d996368

    Score
    10/10
    ransomwarespywarestealersuricata

    • suricata: ET MALWARE DNS Query to Jaff Domain (fkksjobnn43 . org)

      suricata: ET MALWARE DNS Query to Jaff Domain (fkksjobnn43 . org)

      suricata

    • Drops file in Drivers directory

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Tasks