General

  • Target

    683c46de5ff0b3453369565b86b3ae92_JaffaCakes118

  • Size

    344KB

  • Sample

    241022-bm1tfazfpk

  • MD5

    683c46de5ff0b3453369565b86b3ae92

  • SHA1

    567bcdd4b1d38ab4f66b1caf5a30a88c32e67ba1

  • SHA256

    e971b832058a8ac68376158f9def96d606b570e0b0b736b1c6cb590a6b9966a4

  • SHA512

    650de6ff2cf892aa68461a0fcf6cb7a260762a79890b2b2fd426bfefa0b6ee47f0be1fa182723b6eb7d373f0eaaa0e9d566c26fdf5c79ce1ae34d98223017ca2

  • SSDEEP

    6144:d6DdOsqgCFKNnhMA6GOopUtQ9KIwD13KJ181KUO:EZOsSwhCGbWWu13E0

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\{RecOveR}-ktuxo__.Txt

Ransom Note
<1%<$;/$?0:."-39-!:=7, <:6*:$*5 <1%<$;/$?0:."-39-!:=7, <:6*:$*5 <1%<$;/$?0:."-39-!:=7, <:6*:$*5 <1%<$;/$?0:."-39-!:=7, <:6*:$*5 NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? <1%<$;/$?0:."-39-!:=7, <:6*:$*5 <1%<$;/$?0:."-39-!:=7, <:6*:$*5 It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is a possibility to restore them with our help . What exactly happened to your files ??? *** Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key , which you received over the web . *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. <1%<$;/$?0:."-39-!:=7, <:6*:$*5 <1%<$;/$?0:."-39-!:=7, <:6*:$*5 What should you do next ? There are several options for you to consider : *** You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or *** You can start getting BitCoins right now and get access to your data quite fast . In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://h3ds4.maconslab.com/3E60E348FB9FFC30 http://aq3ef.goimocoa.at/3E60E348FB9FFC30 http://fl43s.toabolt.at/3E60E348FB9FFC30 If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Install TOR Browser and open TOR Browser *** Insert the following link in the address bar: xzjvzkgjxebzreap.onion/3E60E348FB9FFC30 <1%<$;/$?0:."-39-!:=7, <:6*:$*5 <1%<$;/$?0:."-39-!:=7, <:6*:$*5 <1%<$;/$?0:."-39-!:=7, <:6*:$*5 ***************IMPORTANT*****************INFORMATION******************** Your personal homepages http://h3ds4.maconslab.com/3E60E348FB9FFC30 http://aq3ef.goimocoa.at/3E60E348FB9FFC30 http://fl43s.toabolt.at/3E60E348FB9FFC30 Your personal homepage Tor-Browser xzjvzkgjxebzreap.onion/3E60E348FB9FFC30 Your personal ID 3E60E348FB9FFC30 <1%<$;/$?0:."-39-!:=7, <:6*:$*5 <1%<$;/$?0:."-39-!:=7, <:6*:$*5 <1%<$;/$?0:."-39-!:=7, <:6*:$*5
URLs

http://h3ds4.maconslab.com/3E60E348FB9FFC30

http://aq3ef.goimocoa.at/3E60E348FB9FFC30

http://fl43s.toabolt.at/3E60E348FB9FFC30

http://xzjvzkgjxebzreap.onion/3E60E348FB9FFC30

Extracted

Path

C:\Program Files\7-Zip\Lang\{RecOveR}-flrix__.Txt

Ransom Note
4573(51/203>/#2=1"*;0!*1:.(*--! 4573(51/203>/#2=1"*;0!*1:.(*--! 4573(51/203>/#2=1"*;0!*1:.(*--! 4573(51/203>/#2=1"*;0!*1:.(*--! NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? 4573(51/203>/#2=1"*;0!*1:.(*--! 4573(51/203>/#2=1"*;0!*1:.(*--! It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is a possibility to restore them with our help . What exactly happened to your files ??? *** Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key , which you received over the web . *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. 4573(51/203>/#2=1"*;0!*1:.(*--! 4573(51/203>/#2=1"*;0!*1:.(*--! What should you do next ? There are several options for you to consider : *** You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or *** You can start getting BitCoins right now and get access to your data quite fast . In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://h3ds4.maconslab.com/678D3B9F36EC48D http://aq3ef.goimocoa.at/678D3B9F36EC48D http://fl43s.toabolt.at/678D3B9F36EC48D If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Install TOR Browser and open TOR Browser *** Insert the following link in the address bar: xzjvzkgjxebzreap.onion/678D3B9F36EC48D 4573(51/203>/#2=1"*;0!*1:.(*--! 4573(51/203>/#2=1"*;0!*1:.(*--! 4573(51/203>/#2=1"*;0!*1:.(*--! ***************IMPORTANT*****************INFORMATION******************** Your personal homepages http://h3ds4.maconslab.com/678D3B9F36EC48D http://aq3ef.goimocoa.at/678D3B9F36EC48D http://fl43s.toabolt.at/678D3B9F36EC48D Your personal homepage Tor-Browser xzjvzkgjxebzreap.onion/678D3B9F36EC48D Your personal ID 678D3B9F36EC48D 4573(51/203>/#2=1"*;0!*1:.(*--! 4573(51/203>/#2=1"*;0!*1:.(*--! 4573(51/203>/#2=1"*;0!*1:.(*--!
URLs

http://h3ds4.maconslab.com/678D3B9F36EC48D

http://aq3ef.goimocoa.at/678D3B9F36EC48D

http://fl43s.toabolt.at/678D3B9F36EC48D

http://xzjvzkgjxebzreap.onion/678D3B9F36EC48D

Targets

    • Target

      683c46de5ff0b3453369565b86b3ae92_JaffaCakes118

    • Size

      344KB

    • MD5

      683c46de5ff0b3453369565b86b3ae92

    • SHA1

      567bcdd4b1d38ab4f66b1caf5a30a88c32e67ba1

    • SHA256

      e971b832058a8ac68376158f9def96d606b570e0b0b736b1c6cb590a6b9966a4

    • SHA512

      650de6ff2cf892aa68461a0fcf6cb7a260762a79890b2b2fd426bfefa0b6ee47f0be1fa182723b6eb7d373f0eaaa0e9d566c26fdf5c79ce1ae34d98223017ca2

    • SSDEEP

      6144:d6DdOsqgCFKNnhMA6GOopUtQ9KIwD13KJ181KUO:EZOsSwhCGbWWu13E0

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

MITRE ATT&CK Enterprise v15

Tasks