Overview

overview

10

Static

static

6

516874.exe

windows7-x64

7

5479329c03...a2.exe

windows7-x64

10

54ab323053...1f.exe

windows7-x64

9

5600.exe

windows7-x64

6

56a9736b82...7a.exe

windows7-x64

10

59ddf36a9e...ws.dll

windows7-x64

10

5C53687F73...ViR.js

windows7-x64

3

5bfae47c9f..._2.dll

windows7-x64

1

5c6416f819...be.exe

windows7-x64

1

5f1fcdfb95...1c.exe

windows7-x64

10

5fc9230812...e9.exe

windows7-x64

9

61318fa1f1...5F.exe

windows7-x64

7

61318fa1f1...5B.exe

windows7-x64

7

6184f1def4...ss.exe

windows7-x64

7

61bc10e8ed...3e.exe

windows7-x64

7

6217ea6bb8...f5.apk

windows7-x64

3

62ebcfeeff...C3.exe

windows7-x64

7

62ebcfeeff...BB.exe

windows7-x64

7

647f242.exe.vir.exe

windows7-x64

9

64bfea1efc...99.exe

windows7-x64

9

64f540a7c6...B3.exe

windows7-x64

7

64f540a7c6...77.exe

windows7-x64

7

6916a006c4...9a.exe

windows7-x64

7

69ee634973...df.exe

windows7-x64

6f772eb660...bc.exe

windows7-x64

7

7077437251...e9.exe

windows7-x64

1

7175d6bb11...2b.exe

windows7-x64

9

728733095f...on.dll

windows7-x64

8

73c3d88d0d...5F.exe

windows7-x64

7

73c3d88d0d...BF.exe

windows7-x64

7

74add6536c...ef.exe

windows7-x64

10

757a661bcc...d8.exe

windows7-x64

7

Analysis

  • max time kernel
    835s
  • max time network
    836s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/11/2024, 02:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5f1fcdfb951dc4642ce136a5d3e6bc42021f8e0cd631975a5eb3842da020531c.exe
  • Size 160KB
  • Sample241122-c3zrraspfs
  • SHA256 5f1fcdfb951dc4642ce136a5d3e6bc42021f8e0cd631975a5eb3842da020531c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Windows\ReadMe.txt

Ransom Note
  • jaff decryptor system Files are encrypted! To decrypt flies you need to obtain the private key. The only copy of the private key, which will allow you to decrypt your files, is located on a secret server in the Internet You must install Tor Browser: https://www.torproject.org/download/download-easy.html.en After instalation,run the Tor Browser and enter address: http://rktazuzi7hbln7sy.onion/ Follow the instruction on the web-site. Your decrypt ID: 1498806328
URLs

  • http://rktazuzi7hbln7sy.onion/

Extracted

Path

  • C:\Windows\ReadMe.html

Ransom Note
  • <html> <head> <meta content="text/html; charset=UTF-8" http-equiv="content-type"> <title>jaff decryptor system</title> </head> <body style="background-color: rgb(102, 204, 204); color: rgb(0, 0, 0);" alink="#ee0000" link="#0000ee" vlink="#551a8b"> <div style="position: absolute; top:0; text-align:center; width:100%" > <h1 style="font-family: System; color: rgb(102, 102, 102);"><big>jaff decryptor system</big></h1> </div> <style> .center { width: 1000px; padding: 10px; margin: auto; background: #fc0; } </style> <div style="position: absolute; top:15%; left: 30%;" > <p style="border: 3px solid rgb(255, 255, 10); padding: 10px; background-color: rgb(223, 213, 209); text-align: left;"><big><big>Files are encrypted!</big></big><br> <br> <big><big>To decrypt flies you need to obtain the private key.<br> The only copy of the private key, which will allow you to decrypt your files, is located on a secret server in the Internet<br> <br> </big></big>&#10102;<big><big> You must install Tor Browser: https://www.torproject.org/download/download-easy.html.en<br> <br> </big></big>&#10103;<big><big> After instalation, run the Tor Browser and enter address: http://rktazuzi7hbln7sy.onion/<br> <br> Follow the instruction on the web-site.</big></big><br> </p> <br> <br> <center><h1><big>Your decrypt ID: 1498806328</big></h1></center> </div> </div> </body> </html>
URLs

  • http-equiv="content-type">

  • http://rktazuzi7hbln7sy.onion/<br>

Signatures

  • Renames multiple (4057) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops file in Drivers directory 6 IoCs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 64 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5f1fcdfb951dc4642ce136a5d3e6bc42021f8e0cd631975a5eb3842da020531c.exe
    "C:\Users\Admin\AppData\Local\Temp\5f1fcdfb951dc4642ce136a5d3e6bc42021f8e0cd631975a5eb3842da020531c.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\5f1fcdfb951dc4642ce136a5d3e6bc42021f8e0cd631975a5eb3842da020531c.exe"
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2612

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ReadMe.bmp
        • Path C:\Program Files (x86)\Internet Explorer\en-US\ReadMe.bmp
        • Size 3.5MB
        • SHA256 3c7952d6ff406e1d59cd5b214970f188711404d6c1240a99d1cdec9b1cbbf2e7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TAB_OFF.GIF.jaff
        • Path C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_OFF.GIF.jaff
        • Size 617B
        • SHA256 23f9be97c7cba6c973dbd7125672a18891af2ea5e17243eb21ba8992569b5318
        • MD5 SHA1 SHA512
        Submit Download

        TAB_ON.GIF.jaff
        • Path C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_ON.GIF.jaff
        • Size 489B
        • SHA256 5c5b8a98d508793e509cd1bbc160ae568ae86913924be7a0ad17f6cfdf83293d
        • MD5 SHA1 SHA512
        Submit Download

        BUTTON.GIF.jaff
        • Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF.jaff
        • Size 457B
        • SHA256 c670f6841faa29ebc4edeb8f3d240312a36a1dfeec0dfa5dd842db10916b3a4f
        • MD5 SHA1 SHA512
        Submit Download

        TAB_OFF.GIF.jaff
        • Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF.jaff
        • Size 777B
        • SHA256 c0a5c9eb0a5278251e2c406b6e2ab8e05c70e847c9e5fcc3a6c667482fde49e3
        • MD5 SHA1 SHA512
        Submit Download

        TAB_ON.GIF.jaff
        • Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF.jaff
        • Size 1KB
        • SHA256 f6fb0a01a40d0639e89bff18e474ea21cc71cab10eee5901c4b89c27a8759c30
        • MD5 SHA1 SHA512
        Submit Download

        YAHOO.NO.XML.jaff
        • Path C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.NO.XML.jaff
        • Size 1KB
        • SHA256 82c8393a955f66c433da6eed95b0c091a7c45daca784934f6c4c3e87a1e72560
        • MD5 SHA1 SHA512
        Submit Download

        win32_CopyNoDrop32x32.gif.jaff
        • Path C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.jaff
        • Size 425B
        • SHA256 b9f976ec1308fb228d8671aefe52339ae9b40784e13b36761f1baac61c5573c1
        • MD5 SHA1 SHA512
        Submit Download

        license.html.jaff
        • Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.jaff
        • Size 9KB
        • SHA256 9675200396d40f32d9960addd5c6e2362d38fb7dec43ffab7f4b01349daa38f3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        epl-v10.html.jaff
        • Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.jaff
        • Size 12KB
        • SHA256 6a55f97b066faa73cfc2add867e0b918ba53ebbc696fa851b81400ee74c013ff
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        000006.log.jaff
        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000006.log.jaff
        • Size 281B
        • SHA256 991f82f75631212f813a4645da91f27f1673c9865b06f7c34454de727dca2dcd
        • MD5 SHA1 SHA512
        Submit Download

        3561288849sdhlie.sqlite.jaff
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.jaff
        • Size 48KB
        • SHA256 11d378aac5259eab56e49ce817304cb3e5ce2a219f28e8f3239747ce099fa759
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ilasm.exe.config.jaff
        • Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe.config.jaff
        • Size 457B
        • SHA256 24a02a5ef27c8a2de32850506a674d2c237a8e639dec08e8d2d791bae8be79ee
        • MD5 SHA1 SHA512
        Submit Download

        selectedTab_leftCorner.gif.jaff
        • Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif.jaff
        • Size 345B
        • SHA256 b734324734cff089f0290529c0a531aaddac23b26134c95ef95e9eba208f7ede
        • MD5 SHA1 SHA512
        Submit Download

        selectedTab_rightCorner.gif.jaff
        • Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif.jaff
        • Size 345B
        • SHA256 ae6639c3ab5b3002d6da6ebf142df07ca1788857ea782dc854e141faa9e23144
        • MD5 SHA1 SHA512
        Submit Download

        DataSvcUtil.exe.config.jaff
        • Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe.config.jaff
        • Size 425B
        • SHA256 31c0c24d7464bc1f2f4ec66366ef157f1fd743df00e59159fddc088c251c447f
        • MD5 SHA1 SHA512
        Submit Download

        vbc.exe.config.jaff
        • Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe.config.jaff
        • Size 457B
        • SHA256 c90817959e5b6ed0378923c8d6cf0b2c26020b9e0b7a2b5388e424b14636ec5c
        • MD5 SHA1 SHA512
        Submit Download

        vbc.exe.config.jaff
        • Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe.config.jaff
        • Size 489B
        • SHA256 2a5d2551b9c0cce93d207385ffc4d78c80cda8ddeee02e5fbe24963c4e7c22a5
        • MD5 SHA1 SHA512
        Submit Download

        SqlPersistenceProviderLogic.sql.jaff
        • Path C:\Windows\Microsoft.NET\Framework\v3.5\SQL\it\SqlPersistenceProviderLogic.sql.jaff
        • Size 13KB
        • SHA256 9f8e81d946216411247a677cdcb4357d8e35fe8c0747cd4c04b7ce311cd3c439
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        DropSqlPersistenceProviderLogic.sql.jaff
        • Path C:\Windows\Microsoft.NET\Framework\v3.5\SQL\ja\DropSqlPersistenceProviderLogic.sql.jaff
        • Size 2KB
        • SHA256 73af997b692f36b09660e62f02bf49d4fa74faa27f0bcf3b640c7d44cd5c1488
        • MD5 SHA1 SHA512
        Submit Download

        selectedTab_1x1.gif.jaff
        • Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_1x1.gif.jaff
        • Size 329B
        • SHA256 6cc908b6872957334f3edb0e724ea4d2a3123cb8db62dca3871972d2262d0db7
        • MD5 SHA1 SHA512
        Submit Download

        regasm.exe.config.jaff
        • Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe.config.jaff
        • Size 553B
        • SHA256 1b8d17ea2e73e2fd3ce2bb2446ce60bac72553714584aceed4bb89e86d8ae25d
        • MD5 SHA1 SHA512
        Submit Download

        ReadMe.html
        • Path C:\Windows\ReadMe.html
        • Size 1KB
        • SHA256 2bb32e84fb4dfb3225bef7ef5624e439e5d3985d710d1700ab66410d7f30e6de
        • MD5 SHA1 SHA512
        Submit Download

        ReadMe.txt
        • Path C:\Windows\ReadMe.txt
        • Size 482B
        • SHA256 35f5eda766ba1d49f38336054afa75e903118c110f88d5396d05ea283d319739
        • MD5 SHA1 SHA512
        Submit Download

        ReadMe.html.jaff
        • Path C:\Windows\SysWOW64\en-US\ReadMe.html.jaff
        • Size 1KB
        • SHA256 2f48bae64cea5567dd3273ad2cec203f9526485360da5eea16175e0e65d626eb
        • MD5 SHA1 SHA512
        Submit Download

        ReadMe.txt.jaff
        • Path C:\Windows\SysWOW64\en-US\ReadMe.txt.jaff
        • Size 761B
        • SHA256 bce309bf04f9e7f4654a4f3cfaf207348f9fb84bce90e644e3b06b4f5d80c4f8
        • MD5 SHA1 SHA512
        Submit Download

        ReadMe.bmp.jaff
        • Path C:\Windows\SysWOW64\ja-JP\ReadMe.bmp.jaff
        • Size 3.5MB
        • SHA256 94351483b45329219eaa923d9a1daeef44472023dfd667d5f3c932ed30540e80
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        perfc.dat.jaff
        • Path C:\Windows\inf\PERFLIB\0411\perfc.dat.jaff
        • Size 31KB
        • SHA256 da06abbabfb6ee84c5a744325883d0349debc9782e01b6fad0c648e07e29697c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1992-2-0x0000000000400000-0x0000000000410000-memory.dmp
        Download

        memory/1992-4221-0x00000000002B0000-0x00000000002BE000-memory.dmp
        Download

        memory/1992-18-0x0000000000400000-0x0000000000410000-memory.dmp
        Download

        memory/1992-0-0x0000000000290000-0x0000000000295000-memory.dmp
        Download

        memory/1992-4-0x0000000000400000-0x0000000000410000-memory.dmp
        Download

        memory/1992-6-0x0000000000400000-0x0000000000410000-memory.dmp
        Download

        memory/1992-1-0x00000000002B0000-0x00000000002BE000-memory.dmp
        Download