Overview

overview

10

Static

static

3

a239735cdd...18.exe

windows7-x64

10

a239735cdd...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    128s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    12/06/2024, 20:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a239735cddd49236ae3562d43d83a8e4_JaffaCakes118.exe

  • Size

    2.4MB

  • MD5

    a239735cddd49236ae3562d43d83a8e4

  • SHA1

    35bad8d66c79af9dabdcdd8dcebfc0440efc42a1

  • SHA256

    cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c

  • SHA512

    34bbfc20d82c4227f9e745f0f7cdb5ce68c684a4a84cde0340fa82601f9340fcb7d21c6060564be8580dcba8c3d1b5a16b28ab6964508e0d1ab994b59a818fef

  • SSDEEP

    49152:czlsjR3QZgRWsu1s8thudV3HGSQFsBL55:Q2aiRWs+1Uo2

Score
10/10
smaugransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\HACKED.txt

Family

smaug

Ransom Note
Your files have been encrypted using military grade encryption. They can never be accessed again without buying a decryption key. You can buy the decryption key at http://smaugrwmaystthfxp72tlmdbrzlwdp2pxtpvtzvhkv5ppg3difiwonad.onion. To access the site you need Tor Browser. Download tor browser here - https://www.torproject.org/download/ . Once you download enter url in tor browser. If you do not know how to buy bitcoin here are options-. https://www.coinbase.com/ , https://paxful.com/ , https://changelly.com/ , or locate a bitcoin ATM like https://www.bitcoindepot.com/ . If you dont buy decryption key or make threats then we will auction your data , passwords, documents, files, ip,router,company server details, along with decryption key via an darkweb auction to highest bidder.,We stay in business because we honor our word. upon payment All your data will remain confidential, and not leaked.
URLs

http://smaugrwmaystthfxp72tlmdbrzlwdp2pxtpvtzvhkv5ppg3difiwonad.onion

https://paxful.com/

https://changelly.com/

https://www.bitcoindepot.com/

Signatures

  • Smaug

    Ransomware-as-a-service first seen marketed on forums etc. in early 2020.

    ransomwaresmaug
  • Drops file in Drivers directory 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a239735cddd49236ae3562d43d83a8e4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a239735cddd49236ae3562d43d83a8e4_JaffaCakes118.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:2080

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\HACKED.txt
    Filesize

    921B

    MD5

    a30e60f273ba38de6829f0e1767f8e38

    SHA1

    38b1b683837c2604b0880851fa0f1a56c2990982

    SHA256

    c9f16826e578e396ba5eb74cbfc566a2a35ca2a0d834c38c50579a0b08f5fa98

    SHA512

    f09c34d68f059f8e228d93e61b148b5fffe3ac2887685b254c4e755a6d004394a03ea478a5ca10f8efe2f2a4ef84f247368efced9840d44927f2efe43f51ae61

    Download Submit