Overview

overview

10

Static

static

3

9527cdac7f...18.exe

windows7-x64

10

9527cdac7f...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    04-06-2024 14:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9527cdac7fc502e825e6a83f601d8352_JaffaCakes118.exe

  • Size

    50KB

  • MD5

    9527cdac7fc502e825e6a83f601d8352

  • SHA1

    52fbf432e41029f5ddcbbad8b49211688e93f74f

  • SHA256

    6cf11f4d901e8c183ed473dec7673954464d4e9b4516017f53f56ebda7beafce

  • SHA512

    3fad754cd34feedf1e33d09940ccfbed1d3ff2aec036dbd8e094251fcad0af670610e784401cba74075a3f71668500c724164fab2910a0a282a65d7760e43331

  • SSDEEP

    768:tFvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5CN:tteytM3alnawrRIwxVSHMweio3MN

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Public\Videos\HOW_TO_BACK_FILES.txt

Ransom Note
YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. DO NOT TRY TO DO SOMETHING WITH YOUR FILES BY YOURSELF YOU WILL BRAKE YOUR DATA !!! ONLY WE ARE CAN HELP YOU! CONTACT US: [email protected] [email protected] ATTENTION !!! THIS IS YOUR PERSONAL ID WICH YOU HAVE TO SEND IN FIRST LETTER: ��������6F E4 F1 84 A3 61 3F 1B 31 D0 D6 C9 FC 96 7E 52 F2 7F E2 70 31 A9 AD 84 2D 30 82 75 D0 67 8C DD AA 8C 44 AA 1F E2 30 03 55 A0 A5 87 3C 8D 90 84 C5 26 1A C7 F2 F6 D8 D6 6D 56 0D 1E E4 DA A2 96 0F 1D 7C 45 69 C8 0C 45 A1 B1 8F 28 04 BE 8D C4 F1 1C A5 5F EA EC 54 56 8D E4 BF 92 33 74 47 E9 C1 7F F1 09 72 CE 37 C3 6D 83 0B 32 A9 D1 09 67 DA 98 14 77 CB 43 1D 3F 50 FC 37 55 55 26 BB 80 91 19 93 BC 69 92 DC FE 30 8E F5 9D B4 E6 AA B2 E9 CA 07 B5 B1 7D 58 E2 48 DC 68 B7 89 46 4E AD 31 72 52 28 A5 45 BE 65 95 99 1C 44 B5 9F 65 6D 65 B4 6F 90 55 E0 BD 94 A1 E6 C4 EE FC FE 23 96 22 1F C2 16 3F CB 97 4D 75 AE 39 09 8E 90 DF 96 40 47 F9 27 E7 54 AF 63 E4 01 00 76 3D D4 D1 31 14 D2 C3 4B 12 E8 55 B0 5D 48 DC 5B 9A 83 26 47 4F 38 72 AA F6 40 D1 7A 8D 1E 75 E2 F3 B6 7D 5F ������������

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Renames multiple (8577) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 38 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9527cdac7fc502e825e6a83f601d8352_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9527cdac7fc502e825e6a83f601d8352_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2784
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9527cdac7fc502e825e6a83f601d8352_JaffaCakes118.exe > nul
      2⤵
      • Deletes itself
      PID:2164

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini
    Filesize

    1KB

    MD5

    313e00cdf93d0c2170a39d695c339c9c

    SHA1

    1f141f4854368d514a0b6b7a3e924bb6eb023d4e

    SHA256

    5dd29f839f50238a775f5f83e63b92a2caf57cadea63d239cbf2b353bc5187f1

    SHA512

    751f5bb9968c58a382e07c47709de5b9a1513a182626881936e947ced605e553cb606939e2b2cd24cfedd273b1689dbe26aec538afa6a1de0b815db8026c31a0

    Download Submit

  • C:\Users\Public\Videos\HOW_TO_BACK_FILES.txt
    Filesize

    1KB

    MD5

    a107344515db2ca1059a6d23b8c9004a

    SHA1

    0d62bc5acf935b37a1454cad56231e490545b801

    SHA256

    6446225b32e0b152e248d0978940a3298fc654ec2413674f7007b770601a22a8

    SHA512

    ab901ff2e522084e3efb60a8ec19c6356fce1c48a27d978d1811ebb0494d527665a9b25e09e0a5b10725cb7a4a43bc417035997845e15d380910f71e478e2b1d

    Download Submit

  • memory/2784-0-0x0000000000400000-0x000000000040D600-memory.dmp

    Filesize

    53KB

    Download

  • memory/2784-7642-0x0000000000400000-0x000000000040D600-memory.dmp

    Filesize

    53KB

    Download