Overview

overview

10

Static

static

3

9e5c89c84c...18.exe

windows7-x64

10

9e5c89c84c...18.exe

windows10-2004-x64

10

Resubmissions

16-08-2024 12:27

240816-pm43raycrm 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118

  • Size

    68KB

  • Sample

    240816-pm43raycrm

  • MD5

    9e5c89c84cdbf460fc6857c4e32dafdf

  • SHA1

    ee0a95846ce48c59261eda0fdd6b38dfc83d9f4d

  • SHA256

    dfecb46078038bcfa9d0b8db18bdc0646f33bad55ee7dd5ee46e61c6cf399620

  • SHA512

    6da517ae5159ebcb0ac138b34215924fb21adae619c3c15ede6863866648e445633f482b2beaddbe74de66b48e18d106dbde3253ee2d3ce86da667f7f8494cd8

  • SSDEEP

    1536:7ufJPTAoUei1obcxtZbW3BqlIS2IyUY4h2wEsOolJT+y9v:7upTAneif03BqarUY4l

Score
10/10
exorcistdefense_evasiondiscoveryexecutionimpactransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\DECRYPT-SEJClZ-decrypt.hta

Ransom Note
<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>SEJClZ Decrypt</title><style type="text/css">body { text-align: center; background: rgb(192, 176, 176); color: black; font-family: Arial, Helvetica, sans-serif; font-size: 14pt;}a { cursor: pointer; color: rgb(68, 68, 68);}textarea { width: 90%; height: 200px; background: black; color: white; border: 1px solid black; font-size: 12pt; font-weight: bold;}</style></head><body><h1>SEJClZ Decrypt</h1><h3>All your data has been encrypted with Exorcist 2.0 Ransomware.</h3><h3>Do not worry: you have some hours to contact us and decrypt your data by paying a ransom.</h3><h3>If you don't pay in time, price will be increased. Then, if the payment is still not received, your keys will be destroyed.</h3><h3>To do this, install Tor Browser (here: <a href='https://www.torproject.org/download/'>https://www.torproject.org/download/</a>) and follow instructions on this web site: <a href='http://7iulpt5i6whht6zo2r52f7vptxtjxs3vfcdxxazllikrtqpupn4epnqd.onion/'>http://7iulpt5i6whht6zo2r52f7vptxtjxs3vfcdxxazllikrtqpupn4epnqd.onion/</a></h3><h3>IMPORTANT: Do not modify this file, otherwise you will not be able to recover your data!</h3><hr><h2>Your authorization key:</h2><textarea readonly>Ob/5QaalAbbFYQYmEI5JzkNq0qmhX+E3KCLeF/Nz5ETf3evhBFxNQVdPvFCaV/bV ymjcd+65++IMGcgYK0Gv5jwAPCtts5Snggu2EvNJSj78eHu0m/CS3F7oB6vas+1q aKhnKeVM0evUPKI7HEo1cAGOauZ1LXnW0qSxat7EsRafPeueKpNpGRr/oHGmtK3I AhrXbu20KDAmPiPC3DEXXWQP2SdvxipZOVtXETcTGufGxZWKOfCrL2DiRsAkY8gg E0FZ88V9ltLa4OSp9vPpWN5Y7q/qg3540GafFclisu7zTZIx75+y3it8nOt4hd/x zVXH7PiTxbIUGSxosWk63US20BFtb5kmEc/FkAtMW0NtYEYdjTjB8aHO2bOajGgl qiSsUlSnxiAB7Rf+Nx4qEV9KFclJar9TgfHf85i84HKSXeeFLaxPSltxtsAMc3EV qbXzqWVhdK1yes3ykJwuu0cdC79z01FuWP93URIah3hn0OzR1hn6+a3+Dps8UKYg 1D8qUm0p11cWHkxNATS+C7aFq5201EMMsXnVM5oV6MvnulxZzRTprNSUpwfXVmq9 UCG83BrI1PUABBRFe0o1C8iGYWo3D8efFbX5ZD7enwFDobg01L4cxwVDevoJ32Uj uUq7JqioGDiBh0x/ue72pF69NUTSo7mkvN+7Mgkw4/C5w4St5Er5B1OHXuxj9puE PCV7chgCz7UsuapxXLP8irq937akkH53rl1smxik+BcxA0hA2iX1651CLZzgVDjy RKygIMqexn49cCXAkY1wTgYcu55D8ronIwv+ZAEqfSfIJkpwzYGPZlaVdvIJDTtw oeG5+sdVzul+xznn5FoCXqfK0zDMs26wAm50pM31BuV1wEiBThB45UjSZrj5d84d 9FeLqQDbrnB5+lJS55uUsdUmSh6qLs3KSDdFNuql9oTeLXwTX0rwI02WAJ8LppHo iZirJFGOjibEuJBaNEbYGN+YVxcc2DdQMCQbnx2XYQE+4CgB9Gbr75A60XMxknhK 4F9nsFAJUXF3JdrzJ9ICy/8DThMtnT3TTOV2IUrBCd7X1FnMjU3V6psHFSl5flQ7 JWKDWz7GVEKVztSBYRce1ketqTr4JV2NxYNahPd8ANX9BayHR2C52VKX9xns6B59 iYZiHOJS7Bvs0Jhar0Wb/hkQUFl9/kTO9DgJ5YIbQSyjg+9bT6Ev/p4wIPSy8SZL ZeQtyjbrYE8foabhAPbkDbFhzBzWoe6IrEJGPI0im5UlweFAXaBfiHh7Y+mNLfsD JaoKAgo3sEOd/bcKTH2BF2p4HwUef/EzEF68SXCV4pY6ZUhElzoyIq+bcbn8LczH DojA0w9DWDtbTdi1VPbD/fvQl1JIntQgLNVhrqgDXWUVIjOqEntbwAM3eqPvyMgL M6AAcm/MnawfguZb/ccrTwpsEF+Ta/IYjZdppy3DE/jGSIoVGROPcG80yASQQNO2 zlAFjWxMBjfx6U1PAZcmRxgzHaXS51f4H/OKApD9LYp/uKyhlR1QLvjtBkiNxr+r EuPW+g9Sy0JjTAQP4Jn6lYmawTbv4doA7FdGEnmYvx0wbszT2wA5w5KGwXqSsy2l 7ZhxqHr6sst11uB5/fC6rQH8ifIlSjJblhoP3ijaYx5vGyt9roNIdHEyaUcPeKrs HAowwdp0xq2nFAg1t3SUJV5KGQJTQshH//L843DEHkUNoPIp42ERWWZc1pEYV/9j JqEva/274uqj35JbhJxA+rCVPkyQofNBnaS3ex4orZBA+De2/FbswN21CotaGVxR QFElFFPbJU/6zTJbrCdBrH2mqFe2tCrJM4xlr8L2h99KJnM99+qteoOP+ki/CVmQ fCoo4LXct1op6mTzp1l4VGNn5lr4qK0D16bN8uFgbFeAH2sN0zhNFaTw7kYMvgI5 XM1wsEGn9JmrvJ0FoeB/QFRHbRhHqjeCw7TQRY+96qE0GpZu9LSmfZBwT2LYUd8U p2/jVtzqYFXjUx2XvCnFCitTukC8Zu2IXzq3WxZ9ql43xQFy0dy5KuDmiOI+0xnV npcJmuTZY9g5oNxdyZdOHYHPCaJqDxioOMlNPOcO0ADJNyPiTZ9k6B+pq7q4Bxd7 GwuUerpIfgowBL+RG0+p2+tiSM/a/Rp7LS+VhbW8nDpNW+xiO/+Up74DNwuF1+56 rIfWNO0WVz5pqATz2pglq17U7HyaqSNTCw034cc58xynygQKjExZOtJTb9ySiFq1 ETdE0uqrtHJVBpws5BBkEGcEHlIzWRPV10DJBGFPbp/+99qyoYcdlBMJycqT8WLP odrlvfjTDHOE6/X7Ek8VFAOj7pKWi3oLAz3QV3UdoIpgZxd4wvUp2BAYyIdR7M54 ZU7kmNEO+16bcHcBN0JMCOiwBWH1AXlVvc6qtWzd4SG5StYbZeG8BQwVErsGlsKf oNEZAqdVwa/ooXySxbz/NK3kikkW5f2+mbcPxGrF3J7s9DiY+Kn/XP0OqF5Ak/BD AI9gsy7nU2ZMA7i3sRW0a9ksK5BpRJAmaIlndmAenSUT9i+5vVO7fIuD84IEdsCk 1LEBD5xdryGbyT81CIjxl8+fJ8tqMTmjh6Jd+PuGLIQIliABULo4itaHO/yyDUhV brufrSmuOxe1PzaY8HUlYI/yV09hmQpesO8Jo3Z1VyNUPjBrMo9DDwYo6ZnZRJvs llHfEvoDijDvEPRAm3E2AbhhyK6F8CT+xe8aSaqvgQY657hiwilTtZOqxd2nyBKl l5FSeISh6maIi0PRpCCQ5UbK08v/DrBsH8V8mcSh0uHxa+HR/hDTvKQGphu34Ogv B+XO9cYZogektNTxi7jM+UeJq08eDurGDdti/85Ef0lTYpTzV6mHUC56e/59c6NY cUCuHoC0+NaJzoP2Onm+OIcKWTbK27B/OFFW+gXX9+ww9P1MRAGmCQg1FoO3TPcZ FyGZQlYdzgNf+YTMnOAyhjHSxOpxv0b8fByiDUX4r1H1xHlklR+j6s5C0HQQ5Jcz oPomHmmzU+w1qZOMCPHCNJtA/TiMplsGiT4patUyRwxOGKrLRDMtxcQ3C54GixCX G5ow+VW3n/2iE997XSguIoFpg7e2mCYGIYViw0itG1Sd5cuzT/+sgRcW/uEeOyIC Fi9iOK6rKlyGNjme5XRQN7/Nx0K5oUSoFypPH8m4AjPJNj0NmYwz/w1IAlHB1FuJ vfH7fbuj8RcOw968GA1q29leJVjGMEPw+Nxy3NW3MR9UQXtUVbfiIC6RUMsZ+Jtg mDr4clCjT+xJP6lQE8CeiWILqq1hfy98qrjwg8HiSuzvWSJbb4AP5fAwrt2Pfg2X d/XjGhlZxFrOilKRHLYk9gL1Rik0wquyzLYwe1gYntx4InZ+Yv4a1bJaEiDmm7bY ZGJt12B/nAwVmi2NgoN8SF7VSrL1TXD24eOIREx+AGjGrjKts8XVFHAcvW329jVD yDqI+jUMwpSvQrArD/12CAHMVEyZPB0nKJ9muZx5UsRYF2zH1KriCqxQ3FlLAxTk YkBFskDtYkseeWsdY5b+HNHR6s7/4XAycFzV5+YFIFl2JuSxBZ5WlLlV9HNODRX6 MoE8OkhLH9nBYDpi3Dgokfx2RPu5rQuPQWELPpU1/ABdeazLYFbwGDXAnOf/HF/L QT29QdON4gli9E32h0wNIEoX65cOhgUtDnsTqik5VL/0L9PHalUWvKSXQLFzo3Lu Time9BUrtM1AKHOP2LvWuEkrHv3lghNQCBSd+aVbjhd4fkMfxkXi615qmObcVhH+ big4v6STNdG6yqcle31ca1LBHFk0XGd0lWx8ywgVcvqGhjR066caz48nbEin9++P PjKKfML4RAdoc+KUVBe90epfBMttNi8/vW2KhfiPuRLRQJmINfIoBETFnRzFSRDM x8nEqOzmD+AWFgVaBiYG4xa2YDQ3FDm/nqvXhxuxEoIU7Ksen2jPA22eeKTp7Dz4 FGfxtyl+V+8zZjjs95WKM1rJRczzjd4S+V35YA2cWWlXsQ71PNQ0tSkb9tkZMjke lpVeE7oDFtt9vk6kxa9KJrTR1EZKMpoE04VBdt0zi7IotUyEixNT3FhOeQLhBZVJ VV/U41Kllp/CZap6UjE9UEtPKYLEuIt4TBtsbtccr0HDem1zAAZ5YluprQW+JI95 ikakrDjcajbA+b6XO8ISHtdu+AloWnhKSjjxez4lXTBIZBRbwOBrMGJAj2UuP1zt OVg3Kn44dqILKJWF4b74htY50T5fEqkKQsVX3n6iJwKHwjAZNKs7UtbOs7Sx1Vqo jNcMIH7eyeRhtDHDLbGquXyLYhXaZsfiAHxtOAfldnc9WBvmFETyzU5ssUgw+prD 8LjjTLhGXYcly/Fuui/wNVUSg6X1ST1+pN83wr+gjCWZ5rQ3HVqLouFSxTzs2QBw yRT0HkO1yr7mE9a2gvmlCzB0fHwDJPdaP/ddfjOO+U2f/XdL3N+5d+XBXNWJ7l63 KZmpdc/y+7JeiTYZUfPsAgrCw560eOcTbqRC1TIhIavI3Tgr8l6s3hB08okC9KaF ij8obJx/CC65BtAF2PAsAmxeiBg8+gQ4qtxo0gqufspoeco45tZ32nZCLcKr26EA jI948khqSPeH46THeluBIyggHeVJSrurTM0dfxgGhCH804Vum4XPdv5D0Wf5I5Rb q5ucQgMExNkFf0JwtW5qW7dQKudUIgFRQq+/GBFJT5T2uRh4KPeah3nrZMkgPJuV 2hmffaM2AGUCUS4AC5QzXp5tB1FUxd0cLEOzPWmyWpeHXXUSzSA1X8PKqQDfCnm/ 6uagr1pIR3x80ao1AIG1zzkfofOEOoqBW6KscdXMr28ucUI3tgR/WFr32dx3yAc8 AOsiN63cackgYonIzKSe+3OBooDV2/J4rNWwhhJIH02l8hZuUq8usGGmrUKY03V7 aJYgsfl65oK1Qj7MfSgkSU3zO+ZnBSG7XCPUyWcSZT/crdNw+l2tE6xIlXacOdDg ShNC/UkQ8abI2fPyD7+MgwwRAfrNlRU9ZOO9gPm0eQwAVC4qGx44qR96ROwouDCe </textarea></body></html>

Extracted

Path

C:\Users\Admin\3D Objects\DECRYPT-QCDPay-decrypt.hta

Ransom Note
<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>QCDPay Decrypt</title><style type="text/css">body { text-align: center; background: rgb(192, 176, 176); color: black; font-family: Arial, Helvetica, sans-serif; font-size: 14pt;}a { cursor: pointer; color: rgb(68, 68, 68);}textarea { width: 90%; height: 200px; background: black; color: white; border: 1px solid black; font-size: 12pt; font-weight: bold;}</style></head><body><h1>QCDPay Decrypt</h1><h3>All your data has been encrypted with Exorcist 2.0 Ransomware.</h3><h3>Do not worry: you have some hours to contact us and decrypt your data by paying a ransom.</h3><h3>If you don't pay in time, price will be increased. Then, if the payment is still not received, your keys will be destroyed.</h3><h3>To do this, install Tor Browser (here: <a href='https://www.torproject.org/download/'>https://www.torproject.org/download/</a>) and follow instructions on this web site: <a href='http://7iulpt5i6whht6zo2r52f7vptxtjxs3vfcdxxazllikrtqpupn4epnqd.onion/'>http://7iulpt5i6whht6zo2r52f7vptxtjxs3vfcdxxazllikrtqpupn4epnqd.onion/</a></h3><h3>IMPORTANT: Do not modify this file, otherwise you will not be able to recover your data!</h3><hr><h2>Your authorization key:</h2><textarea readonly>Nvf6NPsvzmLPymJl6JACK8o1ItMTT345jNKFakHZqQJuD3LsTBSIan0uDgAo/L4J MiZiCvhneooqxrQ8vS/7QBkjGkL73Gx9MIHCozv25PFvJT/JEdDTRVgSiI6hDMno GZ8/vOh6Hl1OOAKGonq/mim2Pn9qnIx9BpYT/FfZdJnDNY+IyRFlTWJdIxIsf1HN ZIwcrsuw6+FzEt2XXweMV7TOESVq7jyswEV/QOwnF+H2Yk7QhJhGR64AnLulq1Q4 bglMuQ2JxYBhAV2Efguxc2LxCs+uSty+kFsZrLxpF9pcRskrHw/e41esqD0x/P3V GHQ8GfarbzhWezxGSz7XpPK5Vuds/MdLFrq+J6Qf1ODQlRHHxTfOHlstEEKRMDvy JAWlnwZLc3fBPHV0uK3EblfXi4rhH87yaZcyc8P4qssvVfWzb0prekiP6AK38wsr EpBXZ9Tlnfvv5H9+OQGV+U2lAS7WKPDPigFachcIzwMpqnV4wJ3v+pnGHNbW/XfW xitZ8LikOKRu5pwvDwRpxpB0KpR75HwrUnYaLT3qgTCxt90/p9M4cERn35zlEJ8N SoAPs/hnRej51CzibPHrGNVbA/m/cqsvDv4EA7yPIe/sC1BLpgnwnoU2/Gg7E6sr isvvoqPGWE5gaVJ0cwG50hXQSpD3A1KcRzd8UfSDQ5LESqe4wf0XDPEhVZpQ1Vbc w4zt0BjYPjY15I2U2BfpybeDcbTQB3OnWXwfgXYVb7Zh8Qt2SlzVUo4cIZeZ9FXI TC9a0/uCjf3i9ks8+SWfOtPTsARkBM28Ilqely+0qKQZb2QhQSaiK3fdSjt6i0DI /6f0zzVvpKDZdGqvbrNZGf7E85YcDkV5M/+XnRPHDI2bIR78dKNApR2FVYkR38K9 MrK2xZhjcVN5XOQVfKeOGE4giR3B2VDR38+U1D4BPTWlvSCzS6eunzLndFZGYTCd wT/rwJGbziPbLN6OAms8L55Q2NOVU86Socl0UAq5Qz1ekSd+/4Ln81t1jM95beVl KiNIZlE4uA4Jal6U3S9cgKqVaZkxLOfehC9GuNQNTJTGnrmE7fDkkpMO+cQvXRlk 2VVhALeXNOxOqr8OqOuas3fL8rGf2gCz9R+xx7E99Me6726jxr0PW1IHbX04gFlq MYwFlLudxft7aA+T8V4C/cpQpw5VPHRclARFCkgcQiF0A38BOrwb8rodOJu5Qy6j +4s5IeE6k4Kiu3gmvnEMY/t5CyuDo6M5O4gnAw6nI/O0l68frfGOV6uxnRQ0T2Jd 90fpe3bwsgHIAuGSNnVxnw6lvTa8xSTmpH+TSpulZHYQ1JNLMDVlkopUI2fPSthk kaQMnO+Mn/MNoByKd+h+FDt1yHt/QHLHHWj+O9pzHAxkk+Rhx8pO53shQAJ8iiQ6 T9hX6ZL1KOljNJs708ptC9bTCbCNpwNT6SGHIjF4qYkPYLuW59cvDlMlVdrwffA8 wYOwderDtD2npHfTrh2IQLATRUG7zIM+LL4ESmihDpBDJz61FV/9/QXgCTpKNd/3 1BLUjTchjOcoKhAZ35vewKUp8NdUfeKpzM/Q0lE1DjAXaY5SqITRYmxZXM295Xmy 3HpQb1PNten3b0EGTYY0BTn2I7BLYKh15iI513Kgc4t+VodPTBleh4vxzBilGOkt xa6ahXsTzx2YEV5swCfKdQgRXWwHZOB0iBx5lsPiLMfPldJEFWwYR9z9EXnIh7Ea Bq5S4YZbPvNehCtXerxhzbvGR50FQX0NsScy5STOs5l0AhMY3qLA8a17UFCX38Ve IeOVq6bPkaibCoGle+ZXBFy6zjYd7o0g0yjXoY3nxAAuNjdDj5+tlr8gchxhfeI0 Y93un2VfdWdZvmSLuWLrXPcZqyP8Anvw3/7Bki0gpfKbKBpKxyiXzebwtmRAGquV l2XfudUNIbfcH0PIV2trYibyww/6O3tAANEt5ILy7nJzFlox/y+mUykh36GGIqMV 8wzI/kTRfSewCTmWVLF6fkSOO+ESHNuzg/RKWhxknWVaK7r50g0pTg1LzpyCbphK 9QUXytmrrKAfGMI6tHd0cqAZ4NwH3KdSRoVUlcjw+HRTDwI2XEzFw7aJUDdSiPNZ fdGKPmjcb8LOwfYg3rfae7kOAAVvOmDFq5oJo/ifH9CB7CSbyvU27tpYXaP+wz1K Y3cXXeJSd7TPcwfALxKBdeE36dObAa46MQ8NYYAKI5za9yVJE2VTSl0ctAsXYAxW FJn8demRUNRuiLAwjJTfRXJ6siiLFu/K79FScRWjBheCRd7H06tI3C+1HJ9u8Oxq ieaUKsK3uI6rhMzSaeEsbt/CnhWqCW0QNZWj638EnPjdWGehFDUuMSU1z9F53hB5 gkBw6RLSMb7SL8tnqQclu/uUea1LljijkAZ3OWJ3dWx7ZirKDVTBgbMlVvFfHmQm SqboUvQ3R6LS579WIMJggYzOgjqqS8Hqp+t04+tz9HW+nrvPz3N+n+kmLDwJLSxe zQY6m5C5nyQDmPSgDQcbtdeoAdlAT1mzfcY39xkjhdCG4aqjqotkqBFOssNKSCtE 2/6Fm9AL7NO5GGMvWH11AyxMY6g1CfdGdHBjUZ2uxoo3j+GYKgsD5MAUyk5VglPh Fa/oc/cl50fShmVi3PNoaXyoqgS+rm4EkBAVhBC3IT9HJTnCrWM+W8KQY3IR/wQk xpAWJqV72SbGpLtVPqJJlUgo9fKZOgpik/iHKpq/80llkX7j06BsYA7tYZNs/HDL wH0taf5CfGflW3cUaEKWgNPYsx2kmjjKgIZCm4mYs+7FNI/OHA4WRhHmgA2b5ZRH kcxVwQmcFc7z2zJIjPAH6wW/cs0f1QzACcy+qek4jHnmNfX7mHUps+wJOl+5abZ5 OBN00WW2L2dlOn39SuWYMOK/4Tf59WDuH5uOhRJloh2Gfkm6Am1W4f96GDy+M2R3 sjZn926F4jgQ9DnwbTm3JZLl0n2jggmqm959dOklaiqyNoy/pAJ1dZJ1BJ6xw7Ke Dt4Ix15OmOA8g8kWT9FnNfulKVYZaFwBug+H3LX6nEqSrAj04Btd8i0ZSw2ieZWT OIdixoGYw145q4QOsJXPFGGD7/U6q7a2NN5EMuy4MpNPUEBFNihS0SKI+LhF0F2K tpwTroVSyUZqtWotkK9CeHMcfWqFdWjkWWaeyjzDfyVN2WT7ncWmrS1wbJ+Dcxfy 9grJUdFeejCdvneYkULI7AAFJcYApsRkp3FAAKug+RO+oDCQx4yAqnsLBik3rdMq PWXwlGermPsWH8cFDT/LhNOJAPI/sdo3MD8GbNqdh4QducVv2uaj2ZnFeZzmOvan HkxlEdfswJZIneZBcZmhErx54y9JkR2Gw+smkNsjWCxzTQlTajdhdXKWIOL1AjDv zz47rgIWPeLMMmTdOIpotpDoo1/uyY8Fv+HG959RUVChlxAeBv//yA7eXBzwtBTk Seh/BRVQGarfRTKZBePMNC1TmP71Lkc6JfBgUXq6/KRCvIkLjn1rhTXBEm9VgNYS cqeoNZgETtXGchT0Ci0JG/bqNmRxcJi2vn1ftoBxNVFrbQAOic57ZYei5K193vhB zX9Ak36auKV7SvPtCxfaLFd2ddNGN2oWprp+6Y99WqQJGxMT4rCiTvAZmKtYkNNr XfAJkKpJ6yJwC7KLC0M48ROYGLwx9mc3xmMbUKAuZbjikr47tYkJNO64LTuJqX+E kKahWdG/lP4Wg5FDaDYtkL8fysQq7wARqRAsoSgjUG7xDUgtxWii8ZK0puhOp2+l /sSJujf+sCaDST16WHlTKII2Ll+Uc6teAA0sql416b2YfxaF4S+yM4dQmyh50sJq TmG7kmdKhXpGOYCazBSRhrDYCbLk+u+QapoEhAgJCBfMn9bS6V6rtA8atkvkewLM Kv6GCL99E8ekjvWIgI7cRIGsx5elDa96v/XH/+jQt26sfdPJycvpcJtJmY0YM1ba ipjAiBT55EvuyPc1jLk4wJh871c5vCTQ2YVEN2HQKfyFatx/Y8qVkRg+b1t6FZZf nBQOMEShjjTrGaU8ocGO9djugsLkwTy6sInpd8vEiISRcX8n9fjJCyQzql/KMrwF RwkgzACkkd5GNrtPS1m9oS2Afkzt4/z1IdX0HULrolYa4f1Tua7hxfcqM//qDoHa O576JRLByuMi70t83J8TX8HSk0xvuSI4zt9uSnMq+3AXjhWbY08G4saL+MHVQ9vF 9++Zkhbg+AZEYxhulBAcIRfxolclLk/zJQGyXjPnFVGehOij6VlLo6o+TrHbjhdl kvPEkCiwVnDmX3uARm6sfa9CfTrFLIj9/krIE/9axG4M/HDgStpXHxfcIyruPDN4 zdz1w5WH4SSQ1MG/p/vNkNuwsK5lnux+cb6At9Xhc2mXX90/a+HbDCkE486R1LjX LqpN1fSigIFvwJpbHOsBoE+MzUfpzHPIBsDrrz90xyjMvaCMFlGmCa9HCW571olG wXdaOPpK44rHUK7SmnQh+vFHBtkSbeA6LjDpHFpvq1z6GYQ//Hl0C1dxVGE1+5Hk daTGzGmls6w5PXCFQpocaSSVS30KfTUkbymze+LPeBWwBxR1xxRmAQ5HKfMIful8 k5Uq3IVpFrtaHA32m9Jvk84hDMnwz81sOF2PodsddJ/wKWd4Zv7TErHJmjqSSI4U XuvwR6EmFn6lSLyNWnRraT6NcFfQQS5D3II+RGWZa5P5qtihc3HtgRMyOuAzcmyu Ulq92QqI3bjuEAxEw5BkWNTJMdpiXD6eC/8hmwROINLe6Ylbo4f7IlTpssgfJZ9w tbyd9ZCvutNbi/bmLwVhzmsTOEJ6UpS/ramSawR6fd6fgV3kS1BsfEOn48TImK9J XhPTMVve2FsqEcfunQXbC8kxh9lQqVo6KHQtc4Hxd8b14uV1GGibJnp/CtJzT8GY oD1UALj3JCYC2+cGf1Vw5U+KMRkooyr6MRA/7JVayNr/22HW2zW5ZBWd1jhTQvfO OTJDdIuL7iWlcTXxL6RpS/lrp2G6FbT7eAhDgQsURlGzV8jG4vxNUpAcHBcOiuOL </textarea></body></html>

Targets

    • Target

      9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118

    • Size

      68KB

    • MD5

      9e5c89c84cdbf460fc6857c4e32dafdf

    • SHA1

      ee0a95846ce48c59261eda0fdd6b38dfc83d9f4d

    • SHA256

      dfecb46078038bcfa9d0b8db18bdc0646f33bad55ee7dd5ee46e61c6cf399620

    • SHA512

      6da517ae5159ebcb0ac138b34215924fb21adae619c3c15ede6863866648e445633f482b2beaddbe74de66b48e18d106dbde3253ee2d3ce86da667f7f8494cd8

    • SSDEEP

      1536:7ufJPTAoUei1obcxtZbW3BqlIS2IyUY4h2wEsOolJT+y9v:7upTAneif03BqarUY4l

    Score
    10/10
    exorcistdefense_evasiondiscoveryexecutionimpactransomware

    • Exorcist Ransomware

      Ransomware-as-a-service which avoids infecting machines in CIS nations. First seen in mid-2020.

      ransomwareexorcist

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (193) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks