Overview

overview

10

Static

static

3

48460c1f75...18.exe

windows7-x64

10

48460c1f75...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    48460c1f75469995a67349fe0766f776_JaffaCakes118

  • Size

    88KB

  • Sample

    240515-15fnnaef6y

  • MD5

    48460c1f75469995a67349fe0766f776

  • SHA1

    7231c635ee7623977c79f8a44a77384a4ff4536f

  • SHA256

    648eb39a5e77af2e2069e196a5709a93e81b29c74dbe2fa4ead4440e0f535e97

  • SHA512

    ad2a372e96f6fbb83f0f8e213804b7c978afa7d28ac3a3a330d9dd1b103efc799824c3815593b9e4c41d05df8723445bad8040c42da121fd2330917d160c9afd

  • SSDEEP

    1536:HN5kEXLJj+EFTctJovSdM0wPC7KZhxKOn+nJI3pD34YsXm:t5kENj+EpcUSiHK7Kf+JI3B34YsX

Score
10/10
defense_evasionevasionexecutionimpactpersistenceransomware

Malware Config

Extracted

Path

C:\MSOCache\All Users\INSTRUCTION_FOR_HELPING_FILE_RECOVERY.TXT

Ransom Note
All your important files were encrypted on this computer. You can verify this by click on see files an try open them. Encryption was produced using unique public key RSA-1024 generated for this computer. To decrypted files, you need to obtain private key. The single copy of the private key, with will allow you to decrypt the files, is locate on a secret server on the internet. The server will destroy the key within 78 hours after encryption completed. To retrieve the private key, you need to Contact us by email , send us an email your DECRYPT-ID-249e8940-2d38-4f5a-9b5f-7b6c97be1abe number and wait for further instructions. For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. Please do not waste your time! You have 72 hours only! After that The Main Server will double your price! E-MAILS ADRESS: [email protected] [email protected]

Extracted

Path

C:\Program Files\INSTRUCTION_FOR_HELPING_FILE_RECOVERY.TXT

Ransom Note
All your important files were encrypted on this computer. You can verify this by click on see files an try open them. Encryption was produced using unique public key RSA-1024 generated for this computer. To decrypted files, you need to obtain private key. The single copy of the private key, with will allow you to decrypt the files, is locate on a secret server on the internet. The server will destroy the key within 78 hours after encryption completed. To retrieve the private key, you need to Contact us by email , send us an email your DECRYPT-ID-b7d118ce-9c2a-468b-ae43-b6f145904a33 number and wait for further instructions. For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. Please do not waste your time! You have 72 hours only! After that The Main Server will double your price! E-MAILS ADRESS: [email protected] [email protected]

Targets

    • Target

      48460c1f75469995a67349fe0766f776_JaffaCakes118

    • Size

      88KB

    • MD5

      48460c1f75469995a67349fe0766f776

    • SHA1

      7231c635ee7623977c79f8a44a77384a4ff4536f

    • SHA256

      648eb39a5e77af2e2069e196a5709a93e81b29c74dbe2fa4ead4440e0f535e97

    • SHA512

      ad2a372e96f6fbb83f0f8e213804b7c978afa7d28ac3a3a330d9dd1b103efc799824c3815593b9e4c41d05df8723445bad8040c42da121fd2330917d160c9afd

    • SSDEEP

      1536:HN5kEXLJj+EFTctJovSdM0wPC7KZhxKOn+nJI3pD34YsXm:t5kENj+EpcUSiHK7Kf+JI3B34YsX

    Score
    10/10
    defense_evasionevasionexecutionimpactpersistenceransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Stops running service(s)

      evasionexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1
T1569

Service Execution

1
T1569.002

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2
T1490

Service Stop

1
T1489

Tasks