Overview

overview

10

Static

static

3

f269d24544...18.exe

windows7-x64

10

f269d24544...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    129s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-09-2024 16:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f269d24544e8bb4cb82680bb396a5f1b_JaffaCakes118.exe

  • Size

    68KB

  • MD5

    f269d24544e8bb4cb82680bb396a5f1b

  • SHA1

    8283f4266a7782308b04a3d03c8b13a38eefaa61

  • SHA256

    ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097

  • SHA512

    c22f51697316c4d29e4b4ef817a1c73d4681fc02b0a2b0fee01e2aaf065d6a3aa04b7defc366cea012a723e600bd80a12083d54bb0907fa0b4cf6f12c41e68d1

  • SSDEEP

    1536:7ufJPTAoUei1obcxtZbW3BqlIS2IyUY4h2wEsOolJT+y9F:7upTAneif03BqarUY4l

Score
10/10
exorcistdefense_evasiondiscoveryexecutionimpactransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\DECRYPT-ejaJxB-decrypt.hta

Ransom Note
<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ejaJxB Decrypt</title><style type="text/css">body { text-align: center; background: rgb(192, 176, 176); color: black; font-family: Arial, Helvetica, sans-serif; font-size: 14pt;}a { cursor: pointer; color: rgb(68, 68, 68);}textarea { width: 90%; height: 200px; background: black; color: white; border: 1px solid black; font-size: 12pt; font-weight: bold;}</style></head><body><h1>ejaJxB Decrypt</h1><h3>All your data has been encrypted with Exorcist 2.0 Ransomware.</h3><h3>Do not worry: you have some hours to contact us and decrypt your data by paying a ransom.</h3><h3>If you don't pay in time, price will be increased. Then, if the payment is still not received, your keys will be destroyed.</h3><h3>To do this, install Tor Browser (here: <a href='https://www.torproject.org/download/'>https://www.torproject.org/download/</a>) and follow instructions on this web site: <a href='http://7iulpt5i6whht6zo2r52f7vptxtjxs3vfcdxxazllikrtqpupn4epnqd.onion/'>http://7iulpt5i6whht6zo2r52f7vptxtjxs3vfcdxxazllikrtqpupn4epnqd.onion/</a></h3><h3>IMPORTANT: Do not modify this file, otherwise you will not be able to recover your data!</h3><hr><h2>Your authorization key:</h2><textarea readonly>i0knP+Q7tugIBD25IyvkTo4vYmNJJWiS5VwPcHqluyirHasGEijODow/tK38hYW5 8t0o17SN4Yihgw/v+CdBhw6Z0RsBEYCUNzD6jK9H7ZylhsL9U8KOtD9usFkqEZyy /j8U3KRyv1VBMoAIX5ttHtIqvHhbNOGxxvIbJwbu31AXr3RWSirjy69pYqbGKMNw bzE80swjkPHBgYRRxF9JuCi7+S6l1gwCrcbAI+WF/HholwD/rKQgOgm2hJAw29qf +yNXcFALUYHThcDZ3OTbf3Y3qDTlFe+ujupFFytmu00PuKQEFM8L4nmI77rSR3cY xVj3NI8qcLLke0TI/mRnPXDihqbW8jeM4u7CqU5wHPnUjakzoPtv4rBfxqRtCH7y 48yYzUu/KnMt9rCSAUTFz7/SGTHSxM6j6KWa8eljX0kLtWKcxss1XswGgwY2cObB LQvc50yWhTl630tNqFSNggheqnW+dLEZYpxZhbRyvN0wOgi6KmFg9r5z/JBUJink 4IDk6ENKRaj6nV+L5kYucuA/65ok4WYjRGQeI1+poyKqlRf7Z5eE1TSjx6uVPmCq hArBZwekxoHmrdJHPFdLe6H/BKhk/YthyfXKZ46xypoDPDk3CI07MnJmBgPoBUdu +WgCETHSq2sNt4KVJFkNHpizmMGtcXR1RiUU5SHBfUfWKrBX4Iv0R4uugz6HgBfU WtXoi1KfO2kwGdAzxV2DcBNLMPHowcTltRwePx8TfEspeomREhZaYcY8VZ/NRpdH 2OXc2VIn7TOHxwgCZaSiFoAW9w4JKGdUxj1Ee0f6spVMygfmMtbfPHk2fwfgMD+Z ZQ8QPZxY34VVIxn+ysn7dPOSEvOSLNKMJIGKps52aDppKBQ2n4W4BgIXED94INjG mzUVZxOTDHqnr/TcKSVIPIrwY3BVHprgH9dhu3VFagt5At2d6XZT+ntfJ3lyqczZ vlGm0w4kW+MZUhutQi95VNqHUlvG1mefYav/6AKrk/ZlQuQL90sTDenX04kOdk7I qHoZ1ZFk2cJApm3dx+E+08JtF5nUeloPA8cR4iCdtDrbosbWLgt55SiEV++e0JoK Q9Z3t+KWV26PB1UV6R++UfwVzEFG9bI2c90xXJg3x1O8T309EwYrFKWmjuwuyScn tWptvXvlaDfF460EL5iOajmkiLooZmvy7PQ0d3jGI1ANq71+ogKecOjoi0OcZINE n9LEJMnyqfIVI0lhDdiBBCRPhgas8p9Cm9Jcb8QpyDAgvrrMFsnr/KRfDyerfOua Nelg1Kpwl0yPgecAoDjJHY38iywbF8F30i93zBcaE16N9JBV82dcR/7LOyf/7s9Q DtTtrdgKXbP96xCx1BEO5Ou+0DyBJowUzA76xuIv9uJXzlqxVuiPtNJyZGryBXD/ EEF+4/4vzEapybXh8rEK39fO+hp/MQflcedcwAsXejHLlJ4nsNFUqYGZRWwH54h5 YOTeP0KrciyN6teWgEtG7YH74OO8vfLqsS4wheeyur4fNqG8lIodhRcaeXbOwOqL Z7QYyeZCN0JxW/ApgHWRAavI9nWLS2i0lOdsUcJikjLl5d0rKF8xeNzi9RESC20D qivq8cALdMC49OurtKv16iK7PEN2gq2+trxzBTHhxIuISxn5Eqreh9zJjHznASXa XqIRz8XJQu6297AbSSXetJ27V+6sCxLxB5kipDyxcqjtlb7l5rHnLozted1wDBD8 63lQh7JoyLQiWo41wsLIQ6auepD5jQX1qfv//9RMNOX8AFvL6KdQ6Ss1FOiklfVz wmA3R3K9TihFE/wR3KnqMDviGqCDQIfiEzcEbeH47Nbzzv8ZIjml3s0HJsf7T9CV HBRzoK92IGHI7b45tGy7pZE1kWxx5slwLzYyXu3oWTaLOEogc7HHXqB9zdEvMCqF aoTmi//JIfKoVLbZRHndNizyoc7b8vikOoSfG11iSAxWbygbprW94oPN5gaoHebH +PncCPM317QHDnyqwykCiGzTRbBz1z/efau6d7Xuwz9c4hsxQmNi7Kp6CLTPBb+s GMxieOiHyYnLpERbpVkqYO5A15LjKNqnIhrCNpRh8Ex8wo5Z26/8fOfC44YRMs2y 9g+JTcBuPmD60B7wiJ1/pIm8aI1d4nTcEbSlI2zNUEcvAckAaJc8KG/5nljbTtaE Auhz73BYuZDxrlIq8dXBlpPzGJawCRmuTgpCwbyK/CoH2zyMDaiA32Iu9Ld0iqRa IAUHSEcez3y6pJ61/2j8eBsO2Gg/8xohwQ4tmAj3eTBRSKUAvq5+8wXtplh839YC VV0mJu1rAlFX4rA7vhd87yz3P/Y2oG2eqhWDS6eRGq10jaFT8b0byulqF/cDl4vJ fPc1mCykKDJza0n9o2IXP0C5b0Y/ECUlP+JLS5/9xOyhvujQbgFa+iclfQKjtO/C BVCyrFwhQrB6zhyRoJ2eWLruP2ZK8TOLBXC7RmuISiIdbwQde/VIkxZ7eA+NfZDZ JaAlY+oK1Tv/jGp2scVxQru9HBOXLVnGgDNa7IeFpgfprM51AryuGWtYdwPZqf4Y vktWp2bJPPFD91K3IqxPCcRe6V6rAA0m1aSQDPz0cvVEOYpF2nhZ+l8BGue91XDf NZ/igFPFe0AuDRxvrG8aZVVHGKSI80xD/3gfEcoxVrsWqZXan8UEvJ4+fr9Vl2Dy fwTR0vdW3p+TszE0kd3vjvNxu4KnWjWhCKCx/5UmeBvMrkCKWe12ps4yafBs6pX9 8c7yN3eb0DucUomJF7SlHD37bSk8ZN0jW6ZnqnLVceW4zliCYvrm17bduKLICF1D 16gVaiRRO+XjILYItBVvoQSzRms28Z7FHS3HMq8+pOQl+itDoKHCT8etWraLPX5j Sr+Mxm+NIeYG2sG1RKkA0ySi2RfvN/9dkVq2eiiPMvydS9gPN/uUzsMRwdhEn99W QRixmkxfI0FvRxflZo9U0fKu7+qILA4dG6kNKYo89jsEVbl7eEf+Eyh+sPIxVCPO qT8uQUSQgsXBbExbOg3vXl0xFXOvoewaNmQvjEyXCARFn+9PFqtTSzU6QFYbfUxT yrMK1bScGSXbDxHDypuC16J2UT+h4PFYBxvyTW/ncOJ/Qq0LheJ5hWsMQ1IgY9W5 6lN0Ci5QnOCoL2q4S9XDBID0EIQcSNUY3SxzJO/d+LQV6hpGnawIOsr1xHU5tIQ7 mA9oIMGURwWWPhpyjnc+k12wDZ2fxwrA7xeefCXK5YNRipN+Hw2Kf6Ag00LWu0uI VpHlGtn4+qBTGQESmZ4MWtG5+p/D3KTkCkYIWlCRZd38lPzCZVNTU7apVfFmHVpN BDzMeLqREJ5QakYl7ES1Km3Ty7uvKyY7upPH+iId26WHEPPazvEb2deg475knowP WahB3YDIRhg1/UMju9AAlBg9GMvutuZnYKS8mK++FtEYVFf+B7YC5x7CiBV7s168 pdfCVi+WKdoCj72c9OOpUGMoaIFD1dU8Kwg8usQYWH7JDsPRvmwQlIBk5nlGEn72 hO+ktUly5zq85z4yfq10FCl0vcM42kw+ilJ+R1eUXSeji4oE/lmUOGtgReUga64N 7YOmg39i3gc6jMvzt3mSGsQZEA/NxgN71dAq9vzcYwAaz3QKSWuKtLb+ujeYtY8o kuyKs0tXbiETQ7ojFdgMzAwa+44zYqUUl8QNW+MKhaC7JkIXmtKSst5aYP2S2Pd3 vJK6lFTqKOnS47VLqhuPRw8u0l981R6EltFzG1Tin3o2QjWdLw9fKmxoajOX6Kd9 LwL0kUM7lTnIHqZQ1WI31+vw4wRhS0B+An1TrpzkhIZdrVOgFtfjqvKnavnoy1Jb 9hmPv6gq5OBWOQXShV3ZCk7UkP59zvWKDHv565tyXHOBepD62eFp6JuwYpHRRs/5 1P9RlbGQ99/lsCxnGcW/wj+gQLoz+eVAXLE9mJ2lfwR7R2ddBEjqfC970LhcaNwd nYZ31FKxparPJiPSSYusktzj1a3jdrcsDV/qT5NK0VRDV4Cm4oxIH95/mIoX9TzS G9j1CM/4CIqZ+PDeEnJBP7xLYMyHTYVaAlBYpBPR6QjTiTP30Aq670u9vz3qZdUp Fqcx6XnsYqvnYbIuRzd7Y0AYaz0zgisWdFlH2k/EEiC0CmqlpIKU2TpbIjzMbLdP i6OB/sLqOjgOgsuphvLAB5/UF9jZY/EbjPd/qBUNtagy48JBd/1FEwaNrir9T/DX oquBbJn0K5lwsPhid4444THitTOSKVldoRR7dFxt5qkQ1ycTQhgINLDYp8owCLnS sAL6SwrZKh1i5haeMMalavnUHBhO6tiMJpvz4uhhkNUJHYy+lfXsvV2ikbcMIP2x 7Frku2KzUxaLOcrlaxQBizfH34Lw6mHLS6Ca8pSJv+vcsljJ9+XKT5F+vDgwX2fc AqvTshxFlUrxOGIzuBlnv7dGyZipn3IUJ+8wliHhDzNWzHdXPgYG20/gDeataH87 ivv+K4nchJXY/o+T8domjSdQ04+2Tt5NIYg5TRMcQZ/3oe1cjBGm5uvQswtW9Pj7 KtT3OXYpLzTWf5kzhH6i309dijJgbDQSxl1/3dbKr5Y7wDv+52m12StUrToDuqfS +BFCDTwTwV6a5yC85LMIVUwAYueha1jky84fguaI8cBDn77pNHPKsYrrKMilFjZI 8G1L2qhoafjWdxEXCCBzZwaQMFwqdR80lqc6VqtjyZdiRR2kVmEhFrGO76wDSEXk wW9icFQtB7UzrRAhpSi6kN93LyB0y65D717TSPSCjVM7NuGCNdXMHy9bYkK41GPJ 6qrjnPXhO9hG+UcxQikLbaZNN4AqfIhsP59hsiu/a3fNbiDqxuF/2s6hRbv5mmmc 30CMraWW4PfZSnLN9y2OvzJnVruXTTs2GY5Ag5+R/8La5oy5I0KLaOjm0HimDSQv rtJ3ooO9QBZO3yzkH+HIg7lbmzimLIBsDRY1RMOoWEFNFLVaUbq1nn2yxaEEv9V/ GoWN7mGZeD1d3GOCzWpUrTnNcB/Tqb+jy4w8A2QJ8bpmUBxCOkcZ6aHwY07ZBp3N </textarea></body></html>

Signatures

  • Exorcist Ransomware

    Ransomware-as-a-service which avoids infecting machines in CIS nations. First seen in mid-2020.

    ransomwareexorcist
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies data under HKEY_USERS 64 IoCs
  • NTFS ADS 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\f269d24544e8bb4cb82680bb396a5f1b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f269d24544e8bb4cb82680bb396a5f1b_JaffaCakes118.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C vssadmin Delete Shadows /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2052
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:284
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C bcdedit /set {default} recoveryenabled No
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2088
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2444
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C wbadmin DELETE SYSTEMSTATEBACKUP
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2708
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2788
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C wmic SHADOWCOPY /nointeractive
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2852
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic SHADOWCOPY /nointeractive
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3008
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2360

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-18\desktop.ini
    Filesize

    129B

    MD5

    a526b9e7c716b3489d8cc062fbce4005

    SHA1

    2df502a944ff721241be20a9e449d2acd07e0312

    SHA256

    e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

    SHA512

    d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

    Download Submit

  • C:\Users\Admin\AppData\DECRYPT-ejaJxB-decrypt.hta
    Filesize

    6KB

    MD5

    3c8d6a2f9f25707270d0225a3b63d2d4

    SHA1

    7afa93b55c19301b15966bbd5ce6b7a267408b9d

    SHA256

    5682cb7b6704ac47e6374abd8fb2a30877dacf555e90feb9df950b2d68272d08

    SHA512

    d5993405b17d8f7453ae474b6de6889bbcac7b4e634a51962aa196370d21cefeed4e06391190ac8b5feb812d9cce3a18d0f55d5b3597f4779c936cc30bda43be

    Download Submit