Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16-05-2024 05:59

General

  • Target

    49b3ed4c73d8d5a6613b725d40172590_JaffaCakes118.ps1

  • Size

    902KB

  • MD5

    49b3ed4c73d8d5a6613b725d40172590

  • SHA1

    07e30496992d7087674cf5542c78856f66ff7737

  • SHA256

    1899ff66b76a3f6302fea0afbc26c8452949345d2ea6d987b683c6a0037f22d0

  • SHA512

    026c0a58a56747cbb9efab721382924d6da48c65483325ec868c9c894ff601a0461fa3674f4fa01c570635521cc6e7e8c96efe8765fcf68aa7eb713df988e2a3

  • SSDEEP

    12288:aeeKC+CqCJCqCwCqC7yH5A7+vEeJaZkeq06aQKLI1XqO/bYyoSWjUUFy55576GYj:J

Malware Config

Extracted

Path

C:\Program Files\Microsoft Office\Office14\F9D1F3-Readme.txt

Family

netwalker

Ransom Note
Hi! Your files are encrypted. All encrypted files for this computer has extension: .f9d1f3 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_f9d1f3: 3eVJuy4ymrNvv7e5dkEFKDoYCIZdc4rwR8v6u5lHfy4ci8/Q1k 29DQF0k9beNzS3Jg83UsX7fuvwhENvOLd4B4ZyKKxtC9wGCB+0 Z37z0flN6k6u1dhkZJsdKDyTo6IyqYyGbPo1J8//DWs3cJ/+mc m7yJ93m/X9At06P/fOmG+4bqDgcaUdmZr3WSChy48napJ2lqIb OKOipsrzR9s+xXEum3XtF6b1qte9/iBIw9KpXY7SFGlx+OFwAd qjba9LizvBW9JH6Eo8bgR5u3471Qrh+4W55+YQqQ==}
URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Signatures

  • Netwalker Ransomware

    Ransomware family with multiple versions. Also known as MailTo.

  • Renames multiple (7461) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1208
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\49b3ed4c73d8d5a6613b725d40172590_JaffaCakes118.ps1
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2208
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x26egocd.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2608
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2CCC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2CCB.tmp"
          4⤵
            PID:2768
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bwcs4-bc.cmdline"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2596
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2F6B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2F6A.tmp"
            4⤵
              PID:2436
        • C:\Windows\system32\notepad.exe
          C:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\F9D1F3-Readme.txt"
          2⤵
            PID:13180
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2088

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Microsoft Office\Office14\F9D1F3-Readme.txt

          Filesize

          2KB

          MD5

          2c51aa9a01d8b5836d17dd7342df90d7

          SHA1

          54af3bb24b8e6bb1157ac4aa6dea1964b1c0b298

          SHA256

          82a950483a8adc146882de6d2020c9d16fc1b152b3a2442ab88bde05200050ec

          SHA512

          896f7c99a2f3a7f12eeb47a9cc92e8523fb611f394db05722bba953edc8c8d16935ad52720d53ee91176240632076f88dd1b00cbd1a567e80868ed78b7c37a91

        • C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MKWD_AssetId.H1W.f9d1f3

          Filesize

          229KB

          MD5

          0a53e5c07f92f52f09657da1877d6b9f

          SHA1

          b065761426fa21c79ffd7a2039e59d6de379b7ae

          SHA256

          96df1e56a571c86337324e2059cc32e9bdc01a2c7dfb63a7fafdcd10e3ee2255

          SHA512

          799798d33b3f2a5d4992ae475876a146d162e4b8504eb2b6e30b6a734d63903f9a8b588794e6798033681b8eeb405f11a7342fda26678c1cfd1cb5e16431204d

        • C:\Users\Admin\AppData\Local\Temp\RES2CCC.tmp

          Filesize

          1KB

          MD5

          edcfdf6a73f2525a34e8d9a35e65531e

          SHA1

          917a608dfb4c6c9b38f1e35d53341b5bbf0cf717

          SHA256

          8c11332d34979a2dbbe10e591f0f10c3db085d4966b5d3d799a03216dc89031a

          SHA512

          9945953757c3365f3f3cbc069ff295c2dd6da2dd9781d3824e1cfba1ada611ac2e811c94006ce1c48fd4e9339d73243efa6a8dd0f3a82da0f79d98eb85659e0c

        • C:\Users\Admin\AppData\Local\Temp\RES2F6B.tmp

          Filesize

          1KB

          MD5

          e87998f030bedd1a8d040404126c36cd

          SHA1

          0bb5ae649f02b03e69bdc0e9f999ac47ebb9770c

          SHA256

          e39e9b241a5110cc89d62f35947fcc9a72ac3eeaf45b9f94a4c7932824e3e688

          SHA512

          7a31d2f026b74fc083cbd5034508e80524fde62bcb0097ed903fcd16db4c597d6f7ece82b54e8291dc0c9a8807169d27a52699163736c8cabb445616b3018332

        • C:\Users\Admin\AppData\Local\Temp\bwcs4-bc.dll

          Filesize

          4KB

          MD5

          778e9d5c45fe0150d03a294bacebc0ba

          SHA1

          ce28ee2f14214e98722a413dcf94a24a135fc1dc

          SHA256

          7b6a9987d64f54bc0a698a5fc412f5db3fdfe2525634b6414ec731b16b9db4cd

          SHA512

          bef9082ddc84508f66d607dd6f1922bee443d1d6cc1440973fb2eeef291825dfdf44085bb28c4729e84e1ea9f45e984d63afce59e963046c13cf05b127d26950

        • C:\Users\Admin\AppData\Local\Temp\bwcs4-bc.pdb

          Filesize

          7KB

          MD5

          ecbecb88efe9139caf19acaa49cb7643

          SHA1

          8f46d1ec8b005827ab90b3256aac0b0a384b40b9

          SHA256

          81e453399c9e1e62aea5f3e338e7cd031333b6284c2da4f5e20e27ca29c7187a

          SHA512

          b089eb66f68794f4ba8cc626a9c95ee88f63e93d4ec74574ccf032b1e428af2ada90ea404b7cf34955a7b42fce14640eff68a63ce32ca9648c65d48e938c84f4

        • C:\Users\Admin\AppData\Local\Temp\x26egocd.dll

          Filesize

          6KB

          MD5

          3693afb9529a3b168a99ca73cd4d88d6

          SHA1

          2da331a0d008b53574f135c57b193e2dead1b2d8

          SHA256

          db4e17704580ea179b5d7fbd481169e7ca79934e8850ccfbf93a86b52ad61967

          SHA512

          829490d253d9d355cd1c98068b1d0efb33af32ab75170772004ef43ed7c9b6983388982c13ad525c02766ea86f93cf0f632408823a1c19ad18f3108b1dc5eab1

        • C:\Users\Admin\AppData\Local\Temp\x26egocd.pdb

          Filesize

          7KB

          MD5

          80da185c04cf8e9bab4ffdfab629dd90

          SHA1

          ab60f4f0e5f755d029a2170d1ad8201c152f4d9c

          SHA256

          ffb1ba9b8420cec407334f7300b1579299d37ef266b7eb80292ba928dea19e79

          SHA512

          2889533b42940f27102f2f1b306d963895c285e0c12f37e7e573e0a97102f98fe32457219619733d9bc5b2f8df0adecc31c6a98941f0ab23593305ac5e8d64e0

        • \??\c:\Users\Admin\AppData\Local\Temp\CSC2CCB.tmp

          Filesize

          652B

          MD5

          3886a03890facd508e130954548b7197

          SHA1

          359b074a99af14df4cba9bd01787ed15ad60a979

          SHA256

          f913fee53c98376e47fbd8ac7340f756d106139458e7bc3e8df28ce510d9fa5d

          SHA512

          d559f444742b6fed799261717fe16c97b3d85cd9c9cd1603ce5aa3ee306ae0ad917e51c6ef241a05c284b57463dc75ce2f6739fffe47adb25bafe2b71c639f19

        • \??\c:\Users\Admin\AppData\Local\Temp\CSC2F6A.tmp

          Filesize

          652B

          MD5

          b0df9a847354c768c3d7230283feb220

          SHA1

          5c311daa3b3c9305f3804fe048c2b4351b6838f8

          SHA256

          4ff36a45ea92bd9444244d6ba83e248aa1162e62c553e4423458a57c32fa0ad1

          SHA512

          50ef5efe70790179cb4d6af17bce03ffc349e273e36d0f2c3729a6eb323b6c5ca01ed16857727c0d0d410782e9b767b550abdcf1d16ef4bd307d38b16497c80a

        • \??\c:\Users\Admin\AppData\Local\Temp\bwcs4-bc.0.cs

          Filesize

          2KB

          MD5

          a743f528f761e35ac1dc7a017c5da581

          SHA1

          e73fb085f518f6a5f673bc4714b976136bc21ef0

          SHA256

          f8b1b7b2ce8d8b2ca62f154a633bdebe0b3fd778786d084ec9191b333b3f9636

          SHA512

          373ef7d8ccfe75824e80fa7eac151021a4ca2e3e4ddb9aecbd01f61092179665e00216acd434c049bdf0d8c987fc3d9a570deb0017c71bd83e1f7a7a42038990

        • \??\c:\Users\Admin\AppData\Local\Temp\bwcs4-bc.cmdline

          Filesize

          309B

          MD5

          4f22016cb7ffa21cd6b672c29659fd8f

          SHA1

          3e76841044af4454a8205a2712d3d4bb17a2edcc

          SHA256

          0f40f89e6fbbb8d8030bcd00e9317bf7fc3bec3580dcee188f609296f78d4f64

          SHA512

          0e22fa058cc156030902082ea6f33e5cf5b5857034796735ede33d1a186c71cae902f1ed663d2f06ef58cc43bf100cb9e3c501ab12279827083329c98d83e842

        • \??\c:\Users\Admin\AppData\Local\Temp\x26egocd.0.cs

          Filesize

          8KB

          MD5

          a6fdb1be50d474af2e6256b67312df1c

          SHA1

          37e6afca5aed0ffe685f420c086b8deb5101cedb

          SHA256

          fed2ae961915149cef840afc3f89abd70494a58a4000748299f8a43581697cd4

          SHA512

          4e0ddf25074533850d0b0339dd4a447202b824b67a3ca949c87a270db0cb5d5bad1301f739afa1ee98075cf3e3e3abd57b9aa72db6b8cd479a77904ec42297a3

        • \??\c:\Users\Admin\AppData\Local\Temp\x26egocd.cmdline

          Filesize

          309B

          MD5

          876b6d4ff3cbc585a7eeac6fffe732e2

          SHA1

          0887c71865cda09f0092c6bec872af434d0734db

          SHA256

          aeac41141b1bae5736705befa7ddee236d059954f40c08023b2079d24dd33bbf

          SHA512

          7475815571747ec5a189697ce5d1f43a5add147d7a633d06792156d27614539dfde333f1e2759ceb0ef2a2df726534a1f013a0b9f697b9bfb9151ec3afabaf8e

        • memory/1208-78-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-96-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-64-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-65-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-66-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-67-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-70-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-75-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-76-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-84-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-87-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-86-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-69-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-97-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-55-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-71-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-72-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-57-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-60-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-63-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-62-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-61-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-68-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-73-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-105-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-108-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-107-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-106-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-104-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-103-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-102-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-101-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-100-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-99-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-98-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-74-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-95-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-94-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-93-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-92-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-91-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-90-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-89-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-88-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-85-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-83-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-82-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-81-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-80-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/1208-77-0x00000000025C0000-0x00000000025E2000-memory.dmp

          Filesize

          136KB

        • memory/2208-48-0x0000000002AF0000-0x0000000002B12000-memory.dmp

          Filesize

          136KB

        • memory/2208-51-0x0000000002AF0000-0x0000000002B12000-memory.dmp

          Filesize

          136KB

        • memory/2208-4-0x000007FEF5A9E000-0x000007FEF5A9F000-memory.dmp

          Filesize

          4KB

        • memory/2208-8-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

          Filesize

          9.6MB

        • memory/2208-9-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

          Filesize

          9.6MB

        • memory/2208-45-0x0000000002AF0000-0x0000000002B12000-memory.dmp

          Filesize

          136KB

        • memory/2208-46-0x0000000002AF0000-0x0000000002B12000-memory.dmp

          Filesize

          136KB

        • memory/2208-47-0x0000000002AF0000-0x0000000002B12000-memory.dmp

          Filesize

          136KB

        • memory/2208-50-0x0000000002AF0000-0x0000000002B12000-memory.dmp

          Filesize

          136KB

        • memory/2208-49-0x0000000002AF0000-0x0000000002B12000-memory.dmp

          Filesize

          136KB

        • memory/2208-11-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

          Filesize

          9.6MB

        • memory/2208-5-0x000000001B850000-0x000000001BB32000-memory.dmp

          Filesize

          2.9MB

        • memory/2208-10-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

          Filesize

          9.6MB

        • memory/2208-42-0x00000000028A0000-0x00000000028A8000-memory.dmp

          Filesize

          32KB

        • memory/2208-7-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

          Filesize

          9.6MB

        • memory/2208-26-0x0000000002970000-0x0000000002978000-memory.dmp

          Filesize

          32KB

        • memory/2208-6-0x0000000002000000-0x0000000002008000-memory.dmp

          Filesize

          32KB

        • memory/2208-8811-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

          Filesize

          9.6MB

        • memory/2208-9057-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

          Filesize

          9.6MB

        • memory/2608-14101-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

          Filesize

          9.6MB

        • memory/2608-24-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

          Filesize

          9.6MB