General

  • Target

    1f577c6f861c87a6998b30e75de33246_JaffaCakes118

  • Size

    395KB

  • Sample

    240507-eb6gbsgf5v

  • MD5

    1f577c6f861c87a6998b30e75de33246

  • SHA1

    109846d60ef48057cef383ceb2ab0ef56a5b7e53

  • SHA256

    4d6c7f67cf774e66779f8f31440ec1d86fb4d7a93b473b9e1d4ea6af0f77a5c7

  • SHA512

    204dd1a5fcd5ec50ae61be3310a50c139e459adb9855b7ce51c53caec3d0628e228a18cc5450fba31eb8a7dde288b07d7a447b9b09edda7965779b49e951a787

  • SSDEEP

    6144:3myHvNqRbPD0MNja+o0Is37qeG/AJuzhwvTrUWU6sXQFJEES6fiJYu65syhrv8M:FygMRWsL2hwLQGsXQ7JNiauqsyhrZ

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+veeje.txt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA4096:https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? It means that on a structural level your files have been transformed. You won't be able to use, read, see or work with them anymore. In other words they are useless, however, there is a possibility to restore them with our help. What exactly happened to your files? *** Two personal RSA4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key, which you received over the web. *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. What should you do next? There are several options for you to consider: 1. You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or 2. You can start getting BitCoins right now and get access to your data quite fast. In case you have valuable files, we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions, please access your personal homepage by choosing one of the few addresses down below: http://t54ndnku456ngkwsudqer.wallymac.com/45FF7EFEE2ADE455 http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/45FF7EFEE2ADE455 http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/45FF7EFEE2ADE455 If you can't access your personal homepage or the addresses are not working, complete the following steps: 1. Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en 2. Install TOR Browser 3. Open TOR Browser 4. Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/45FF7EFEE2ADE455 5. Follow the steps on your screen IMPORTANT INFORMATION Your personal homepages: http://t54ndnku456ngkwsudqer.wallymac.com/45FF7EFEE2ADE455 http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/45FF7EFEE2ADE455 http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/45FF7EFEE2ADE455 Your personal page Tor-Browser k7tlx3ghr3m4n2tu.onion/45FF7EFEE2ADE455 Your personal identification ID: 45FF7EFEE2ADE455
URLs

http://t54ndnku456ngkwsudqer.wallymac.com/45FF7EFEE2ADE455

http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/45FF7EFEE2ADE455

http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/45FF7EFEE2ADE455

http://k7tlx3ghr3m4n2tu.onion/45FF7EFEE2ADE455

Extracted

Path

C:\Program Files\7-Zip\Lang\_ReCoVeRy_+wyrkf.txt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA4096:https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? It means that on a structural level your files have been transformed. You won't be able to use, read, see or work with them anymore. In other words they are useless, however, there is a possibility to restore them with our help. What exactly happened to your files? *** Two personal RSA4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key, which you received over the web. *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. What should you do next? There are several options for you to consider: 1. You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or 2. You can start getting BitCoins right now and get access to your data quite fast. In case you have valuable files, we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions, please access your personal homepage by choosing one of the few addresses down below: http://t54ndnku456ngkwsudqer.wallymac.com/D54BB423ABC7BA15 http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/D54BB423ABC7BA15 http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/D54BB423ABC7BA15 If you can't access your personal homepage or the addresses are not working, complete the following steps: 1. Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en 2. Install TOR Browser 3. Open TOR Browser 4. Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/D54BB423ABC7BA15 5. Follow the steps on your screen IMPORTANT INFORMATION Your personal homepages: http://t54ndnku456ngkwsudqer.wallymac.com/D54BB423ABC7BA15 http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/D54BB423ABC7BA15 http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/D54BB423ABC7BA15 Your personal page Tor-Browser k7tlx3ghr3m4n2tu.onion/D54BB423ABC7BA15 Your personal identification ID: D54BB423ABC7BA15
URLs

http://t54ndnku456ngkwsudqer.wallymac.com/D54BB423ABC7BA15

http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/D54BB423ABC7BA15

http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/D54BB423ABC7BA15

http://k7tlx3ghr3m4n2tu.onion/D54BB423ABC7BA15

Targets

    • Target

      1f577c6f861c87a6998b30e75de33246_JaffaCakes118

    • Size

      395KB

    • MD5

      1f577c6f861c87a6998b30e75de33246

    • SHA1

      109846d60ef48057cef383ceb2ab0ef56a5b7e53

    • SHA256

      4d6c7f67cf774e66779f8f31440ec1d86fb4d7a93b473b9e1d4ea6af0f77a5c7

    • SHA512

      204dd1a5fcd5ec50ae61be3310a50c139e459adb9855b7ce51c53caec3d0628e228a18cc5450fba31eb8a7dde288b07d7a447b9b09edda7965779b49e951a787

    • SSDEEP

      6144:3myHvNqRbPD0MNja+o0Is37qeG/AJuzhwvTrUWU6sXQFJEES6fiJYu65syhrv8M:FygMRWsL2hwLQGsXQ7JNiauqsyhrZ

    • Renames multiple (430) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks