d059aa3256671f00f255d11fbba5225c40d6f50ec42e433cd49db1724483f70b

General

Target

8b3414ac059606a111a1e5a63aad7346_JaffaCakes118.dll
Size

164KB
MD5

8b3414ac059606a111a1e5a63aad7346
SHA1

2e9e72fc4266fb2277c18b1164ed15ba1d8babe6
SHA256

d059aa3256671f00f255d11fbba5225c40d6f50ec42e433cd49db1724483f70b
SHA512

6978e151ab8c5372ef71a38fee294c93a0893ff6f48d3a14fa6686217a9df02deab3aed60583d1947443a1df1261b0f3dc7f26ecf2c8200a4fc395e1c12af70a
SSDEEP

3072:v0XoUeZ/DVS8L73ea4MoCLfqQvFf5pbslEPF:veoUeZR2TRCWQFf5pbK

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\1h74962-readme.txt

Ransom Note

---=== Welcome. Again. ===--- [+] GDRP dangerous [+] We have copied financial files and other important information about personal data, it will be published on the Internet and will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 1h74962. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/589D42FB1AF7AAAB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/589D42FB1AF7AAAB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: rsTkptxeh0zab89N6KNsolzpjocdu1koKpi+sYlxGlxzSL7evJz3gM9+0dz1ap+0 LcR6kyn+U38kk6EOxMbS6OCpWFUPuYm14+JlLmctbbWixxFwS2o2N8nxLoiWRijp lSTVvkw0S20NQT0eigEQUCwc4Fu+3r2OIThgp31Q0XsxkKYCEEgTXDFto52AZ2FS WIQTtcilhaXWDNHkFTAnlSty1EDUcxQTFjlhh5AaPyvnkZWsF5MVkBbl8a8XbWDJ VSmgwa53F0uSa489Sy9YFmUZmy+QsvqVgtblIle9J2Dkm2UY4tQbWM/ZZ7wkKInX osE3kjx4QbXgch9nCdb5xOCfIphOr9e7mAbCKk8WiHM3WALcvpg9p+6kdCJAehE0 WhRXo0wKN+kpW2UTLtgxQuog5QKlFzLqkgIyq9b5QZVxFXQurEkyT+hiXdi7CBh/ K+19QxaVYu5RtfPeKCblXMpL1/Lr75eI1HDmm0ROaOd63qNcE0iLSbQgrlDhT0KQ 1o14XJMj8TJG4Tr6ee1ArMxPq57BKg+qqBUJoi61x+3i6t05GkERRoYeHKKkBtzE EbnKi+O0IfxXdoKCCz8pROiT40rZeIMbczf8dusXqoakMreUcj3wQic4KaV5wpP9 VKHLB54HnXyXt3X8VEDfCpR1CRWmMIft/aWIzmfsda2vIW+WuG/1IH7bjFrW929G aOHC+g7pN3z5MMjzPDEii530h7LQfvxC2+ewv7Z9fP3oFl2kd/MRwASxlotmK5bW 2aus3u2vEfl42NkqS5VPudRL9RQHuAvfBCEbqnxCkIvLaqRXTUVEsqvACkfcjWMu p+hUS2vD7hUrbTCHEnnNrhJWKEBk+oZ3qgabHxQRK0dlClwZ/rjvgu7k5zfi73fk fmxdmU/lyUZmVmWZ66bhDLpTvumcx5zl3wcJxpvb2gDBa7Qt4UjsTn3E+Ws67E/D DK3gZS3H+G2h/C/HMnzYcTqIpQt+GfkERcdXUznir7yU8ktU0BbyGAR7y9Oa0lnu NN3BSBkd3KwFzKQmyn1R4eUdCLa2WzhiQlY5Fcik8o0Oy1C24TVYhs8HBEOkS1Da 2mON0jjQDnQ+/KVtrIjpPK+8em1r6EI8oNIPwopPU02GvxByEssiq8PVXn7BymNv voftebhupR3aq+O5R1yvAOhOY9Vx4ndB69uSA/7cK9wgBtyIcqgkITBC1WdGcLtP MoFzMFYDVL++/aYR8ccjZr9kH6c= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/589D42FB1AF7AAAB

http://decryptor.cc/589D42FB1AF7AAAB

Signatures

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\F:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\D:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\A:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\ImportInvoke.jpeg	rundll32.exe
File opened for modification	\??\c:\program files\PingEnable.odp	rundll32.exe
File opened for modification	\??\c:\program files\RedoResize.wvx	rundll32.exe
File opened for modification	\??\c:\program files\RemoveStep.png	rundll32.exe
File opened for modification	\??\c:\program files\UnblockImport.ADT	rundll32.exe
File opened for modification	\??\c:\program files\UpdateTest.odt	rundll32.exe
File opened for modification	\??\c:\program files\WatchRestart.odp	rundll32.exe
File opened for modification	\??\c:\program files\DebugCopy.fon	rundll32.exe
File opened for modification	\??\c:\program files\UseConvertTo.xltx	rundll32.exe
File created	\??\c:\program files (x86)\1h74962-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\GetRestore.rtf	rundll32.exe
File opened for modification	\??\c:\program files\MeasureInstall.xml	rundll32.exe
File opened for modification	\??\c:\program files\NewInvoke.mp4	rundll32.exe
File opened for modification	\??\c:\program files\RestartClose.htm	rundll32.exe
File opened for modification	\??\c:\program files\UnlockClear.tif	rundll32.exe
File created	\??\c:\program files\1h74962-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\ProtectBlock.ppsx	rundll32.exe
File opened for modification	\??\c:\program files\SendBlock.dwfx	rundll32.exe
File opened for modification	\??\c:\program files\CompareUnblock.scf	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3256	rundll32.exe
3256	rundll32.exe
4856	powershell.exe
4856	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3256	rundll32.exe
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeBackupPrivilege	2940	vssvc.exe
Token: SeRestorePrivilege	2940	vssvc.exe
Token: SeAuditPrivilege	2940	vssvc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 3256	1668	rundll32.exe	82
PID 1668 wrote to memory of 3256	1668	rundll32.exe	82
PID 1668 wrote to memory of 3256	1668	rundll32.exe	82
PID 3256 wrote to memory of 4856	3256	rundll32.exe	88
PID 3256 wrote to memory of 4856	3256	rundll32.exe	88

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b3414ac059606a111a1e5a63aad7346_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b3414ac059606a111a1e5a63aad7346_JaffaCakes118.dll,#1
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4856

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2920

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\1h74962-readme.txt

Filesize
7KB

MD5
a3f282d0eddabffb08fe1dd7083ac514

SHA1
53bdbd0cdcc5bd3f2b12b6060522f6899ef3bba2

SHA256
dc6de89ae234d69fbc08f9e028443523b99c1d7b1d9eb57c41f2c80faa3f6d45

SHA512
8837d9d604fc288d4f00e9e20ccf0b9dcfc5540a07a08a39d30365ea8e3e1445795475c2706d3ef1dbb726ad44b86c60b2f77ae65436d354e9d6e4b3001581ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jxkym0yk.gqp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4856-0-0x00007FFEC07C3000-0x00007FFEC07C5000-memory.dmp

Filesize
8KB

Download
memory/4856-6-0x00000253D5FE0000-0x00000253D6002000-memory.dmp

Filesize
136KB

Download
memory/4856-11-0x00007FFEC07C0000-0x00007FFEC1281000-memory.dmp

Filesize
10.8MB

Download
memory/4856-12-0x00007FFEC07C0000-0x00007FFEC1281000-memory.dmp

Filesize
10.8MB

Download
memory/4856-15-0x00007FFEC07C0000-0x00007FFEC1281000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing