Overview

overview

10

Static

static

10

cc3652c078...18.exe

windows7-x64

10

cc3652c078...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    95s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-12-2024 09:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cc3652c078fa2bdfbbfae33335c30bda_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    cc3652c078fa2bdfbbfae33335c30bda

  • SHA1

    b3d3ad0c2c9d526717f55c431d51c2f1e957325b

  • SHA256

    0abb4a302819cdca6c9f56893ca2b52856b55a0aa68a3cb8bdcd55dcc1fad9ad

  • SHA512

    d027e1df8c10516b81e47ef840f0e2baf971c0e0c4e77ff0fdc0122bbbb66ed210fd78336cb40d05c76d91838ae89ebb3304050dbf7fb7eeec73d47d1d26ec3d

  • SSDEEP

    12288:QKMzISi3LAStu+KxSgNrc+YCiYKjqxJUZGhEzXMOalwmtnvXigwwdAnIK4RHLrog:vMsSibWXpNrcVEnvXigwwdAIK4R/W3

Score
10/10
credential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

\Device\HarddiskVolume1\Boot\bg-BG\!!!HOW_TO_DECRYPT!!!.mht

Ransom Note
From: =?utf-8?B?0RFQctTF0YDQcNC60IXQvdC+IEludGVybmV0IED4cGxvseVyIDEz?= Subject: Date: San, 00 Jan 2000 00:00:00 +0000 MIME-Version: 1.0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-MimeOLE: Produced By Microsoft MimeOLE =EF=BB=BF<!DOCTYPE HTML> <!DOCTYPE html PUBLIC "" "">=20 <HTML lang=3D"ru">=20 <HEAD>=20 <META = content=3D"IE = 3D11.0000" http-equiv=3D"X - UA - Compatible">=20 <META charset=3D"utf-8">=20 <TITLE>!!!HOW_TO_DECRYPT!!!</TITLE>=20 <LINK href=3D"style.css" rel=3D"stylesheet">=20 <META name=3D"GENERATOR" content=3D"MSHTML 11.00.10570.1001">=20 </HEAD>=20 <BODY>=20 <p class=3DMsoNormal align=3Dcenter style=3D'text-align:center'><span class=3DSpellE><b>=20 <span lang=3DEN-US style=3D'font-size:20.0pt;font-family:"Times New Roman","serif";mso-bidi-font-family:Arial;color:#C9211E'>=20 All your valiable data has been encrypted!</span></b></span></p><BR><BR>=20 <p class=3DMsoNormal style=3D'text-align:justify;text-justify:inter-ideograph'>=20 <span class=3DSpellE><span lang=3DEN-US style=3D'font-size:13.0pt;font-family:"Times New Roman","serif";mso-bidi-font-family:Arial'>=20 Hello!<BR>Sorry, but we have inform you that your order has been blocked due to the issue of securities. Make sure your data is not blocked.=20 All your valuable files were encrypted with strong encryption algorithms AES-256 + RSA-2048 + CHACHA and renamed. You can read about these algorithms in Google.=20 Your unique encryption key is stored securely on our server and your data can be decrypted quickly and securely.<BR><BR>=20 We can prove that we can decrypt all of your data. Please just send us 3 small encrypted files which are randomly stored on your server.=20 We will decrypt these files and send them to you as a proof. Please note that files for free test decryption should not contain valuable information.<BR><BR>=20 As you know information is the most valuable resource in the world. That's why all of your confidential data was uploaded to our servers.=20 If you need proof, just write us and we will show you that we have your files. If you will not start a dialogue with us in 72 hours=20 we will be forced to publish your files in the Darknet. Your customers and partners will be informed about the data leak by email or phone.<BR><BR>=20 This way, your reputation will be ruined. If you will not react, we will be forced to sell the most important information such as databases=20 to interested parties to generate some profit.<BR><BR>Please understand that we are just doing our job. We don't want to harm your company.=20 Think of this incident as an opportunity to improve your security. We are opened for dialogue and ready to help you. We are professionals,=20 please don't try to fool us.<BR></span></span></p><BR><BR><p class=3DMsoNormal align=3Dcenter style=3D'text-align:center'><b>=20 <span lang=3DEN-US style=3D'font-size:14.0pt;font-family:"Times New Roman","serif";mso-bidi-font-family:Arial'>=20 If you want to resolve this situation,<BR>please write to ALL of these 2 email addresses:<BR>=20 [email protected]<BR>[email protected]<BR>In subject line please write your ID: 6558281558436675638</span></b></p><BR><BR>=20 <p class=3DMsoNormal style=3D'text-align:justify;text-justify:inter-ideograph'><b>=20 <span lang=3DEN-US style=3D'font-family:"Times New Roman","serif";mso-bidi-font-family: Arial;color:#C9211E'>=20 Important!<BR>=20 * We asking to send your message to ALL of our 2 email adresses because for various reasons, your email may not be delivered.<BR>=20 * Our message may be recognized as spam, so be sure to check the spam folder.<BR>=20 * If we do not respond to you within 24 hours, write to us from another email address. Use Gmail, Yahoo, Hotmail, or any other well-known email service.<BR>=20 Important<BR>=20 * Please don't waste the time, it will result only additinal damage to your company!<BR>=20 * Please do not try to decrypt the files yourself. We will not be able to help you if files will be modified.<BR>=20 </span></b></p>=20 <BR>=20 </BODY><BR>=20 </HTML>
URLs

http-equiv=3D"X

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (659) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes System State backups 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Drops file in Drivers directory 13 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 39 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 3 TTPs 13 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda_JaffaCakes118.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1528
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=401MB
      2⤵
      • Interacts with shadow copies
      PID:408
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded
      2⤵
      • Interacts with shadow copies
      PID:1116
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=401MB
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:2960
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:804
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=401MB
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:2064
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:4552
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=401MB
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:3244
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:736
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=401MB
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:1488
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:4828
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=401MB
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:4220
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:828
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:1148
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit.exe /set {default} recoveryenabled No
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:4960
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:2116
    • C:\Windows\SYSTEM32\wbadmin.exe
      wbadmin DELETE SYSTEMSTATEBACKUP
      2⤵
      • Deletes System State backups
      • Drops file in Windows directory
      PID:920
    • C:\Windows\SYSTEM32\wbadmin.exe
      wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
      2⤵
      • Deletes System State backups
      • Drops file in Windows directory
      PID:4764
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1112
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\CC3652~1.EXE >> NUL
      2⤵
        PID:4844
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:932
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
      1⤵
        PID:304

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      1
      T1059

      Windows Management Instrumentation

      1
      T1047

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Defense Evasion

      Direct Volume Access

      1
      T1006

      Indicator Removal

      4
      T1070

      File Deletion

      4
      T1070.004

      Modify Registry

      2
      T1112

      Credential Access

      Credentials from Password Stores

      2
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Windows Credential Manager

      1
      T1555.004

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      Browser Information Discovery

      1
      T1217

      Peripheral Device Discovery

      1
      T1120

      Query Registry

      2
      T1012

      System Information Discovery

      3
      T1082

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Command and Control

      Exfiltration

      Impact

      Inhibit System Recovery

      4
      T1490

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2367C848C1C8A11F6F3502EDA2855348.gpay
        Filesize

        824B

        MD5

        cfd5dce9cc724c94f81ed09deb8f3902

        SHA1

        49cddbd426def23e877db7fb50c60b5ddcc6626f

        SHA256

        965d9144b9438645c8bcf105aa8c8d671d1aad61a9388225aa56f20b7adbf6c4

        SHA512

        9f7a4a0b7e428d54e6a57cb003a38c01cf033724d98f1989f6e037a5c3dbba82ecaf14a776193fc7f04c60f0dfa8479b0ebd2cdc61c1953d6c18c03dae58e420

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\398EE64D66758B5715368AA94044B13A.gpay
        Filesize

        710B

        MD5

        dde54ea2cd8b40389ce13536b4cbe8c3

        SHA1

        3473db49c609997aa37c1a56aa24b14ab76fa928

        SHA256

        482e2840947f24448f75f99d5ab45215b1e352252525dc921ef2f003d7360388

        SHA512

        0178759e0f040a49943d70f08760ff291a4f79a849fd60cd932ca30a61486a0daf5fda170bdfdc7e35594f01f8b21f21a6874b0ac5981692621b8ff7e39184a4

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.gpay
        Filesize

        814B

        MD5

        975834e0499feb44654b97f204ccc6b7

        SHA1

        ddb467be5873ab21f473866cae0624a9ab452911

        SHA256

        ef931c66da099d7035facbe2e4c5f09e0b70dd1284b8cd075cf0f053ce9b9db8

        SHA512

        6661783098255e9fad40d2a6ccd59e701a25d7fd21b24afe5fad8f3a5e11d3b8538e484140202ae39ecda2f0fd175e6280aaac598c2d6fec6022b513ef0e21e7

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506.gpay
        Filesize

        840B

        MD5

        20d1844c7a721af7095a740465079aab

        SHA1

        d98f4a5bded46ba580881737cadaa67e015d44ea

        SHA256

        322850b3a7233d06e01f0e2a9770dba7bf82c88ec9ed6cae5d673ad01e2dd841

        SHA512

        f0e8ee3675592a1548a478ebe9c1319880d3f1aadf64e9bd4ccd38e00a6f632643ceacb60fe46f4da7131dce503ef898709fc7a0caadd08e4e61e85b92e96a9d

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F.gpay
        Filesize

        700B

        MD5

        524a97f5cb8ea24fdc4b25b8f8405e97

        SHA1

        478868cc38476c2800ba7752480ab93016c40f2b

        SHA256

        c1fb17d4f1584c71aa4bda4f9dc1eaf8a2c409ab83a9ea51fffa8b855a353661

        SHA512

        7d8b7a6dee755bf1439733aa15357525008b0a0fbdbc984427239bbe120419730078397d29358050c8a026f7580b36d76a4c5ef9228041aa3dc6274faa89683b

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C86BD7751D53F10F65AAAD66BBDF33C7.gpay
        Filesize

        770B

        MD5

        15cb71840b844b0339a6603f1b1a78e7

        SHA1

        89d8ce40511b0b070fd0d28c475ae68e07d4616e

        SHA256

        d18b2a9c15873d0e5d7efb6ae05581d09b5279e420bfe5ba0fc5d2240c9bf77f

        SHA512

        b6fa84dcd5d2eeccd956f7424de62a06786eff08974646bc35e7b04addfeda79383377a97bf4029db008b56f0ac9f3185b6d86e28dfa98cdcb61287b7cafa9ae

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749
        Filesize

        290B

        MD5

        f755ab1073ad912ff16960c0a1763967

        SHA1

        ed4f8f40c6d46b08c7417cdfccb9cac16cfd03e8

        SHA256

        aac549c86409fdfcde6c8de9368a16dbaa13296218f3bb2db0f895080031a5cc

        SHA512

        dc8193d921c13969878b098dfe396020da437b6a1b2bd283953a2a4cc943b46d9874a4206fbe3f26b820ddb01eaee5acf3e93520cee8c63e37d5745927cc55d8

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749.gpay
        Filesize

        842B

        MD5

        2f58d6778adb8b40947a6c4463800da2

        SHA1

        87ffe44b7041f1b8bc89e64be8494f6d4b67f17a

        SHA256

        69e3c4fcf4638052f383d7d697828f05af5ba5e0e4051a6f717e4fc3061dd37f

        SHA512

        314c474b8333efc30704612ec5c4c06af319406f5f21c9911977526bc541577452ead5f00581e320c361673736f62ba32d7a2c8d8f3143a663ef56f312abffe6

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB5E2F83CE9B8330B0590B7CD2E5FF2E.gpay
        Filesize

        782B

        MD5

        e3829caf717b29c5c9db8a1fe3150a09

        SHA1

        06bb57161b91fb647a3e8431a111133759ea1ad1

        SHA256

        738cedd288c80aaaed4619db4476c77c2342192f40ba2dc92bb532bbc6e40f81

        SHA512

        2e0298a0f96929a457248c3261fc8d691a6acc4fbc07a1d08751082a6a303fe6418885b6f2227d12455ac98f9ebbe9c7dd2769a2526f0218c4371590ff410939

        Download Submit

      • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.gpay
        Filesize

        850B

        MD5

        a3087921ed9b29655464711a03bf15bf

        SHA1

        602cc06dd940bce592e28f1dd3509d7026973844

        SHA256

        61ad93d3339eb6abd1f423f7fef50cda4d5b4d7c878bb7da2c41be4487b6ae96

        SHA512

        b8efbd654c9b8c7c90da38957a86b45ba73ab720127f423d227e31d3c2435bb93260049d0a22f0fb5ba8a53afcf13695bbc69e8c87ba5016db3d01c8de019edc

        Download Submit

      • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506.gpay
        Filesize

        802B

        MD5

        20218d6b7e82fb442dd05069dfed321d

        SHA1

        da414a9b729e8b20863ca91965bb4e1fc0df534c

        SHA256

        b5c70bef2bd2720659b787808b53cb5ab4bad36dc23e6dc07815b166e38e5778

        SHA512

        15e923894008bc7ddfd7b1fdc44da174ebfbb150f6746cab3f8e45638574d78fdedc0159c425ee4c297dea6d936d57a5bc63d97f07b2cf9a80e6a828dffc48b6

        Download Submit

      • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749.gpay
        Filesize

        842B

        MD5

        cb9f2daaaa1dce8186ea135e00d9b29d

        SHA1

        ca7988e3e76efb03d92f1247d5593ae968baa7c1

        SHA256

        e687c94b190258c51dbf46f2951e1fdf1fe5c86ab7c778fe3b3dc24675f9f330

        SHA512

        0bacc5ce73b739d485cccda18dd27ab19f54b514bc0d446413752ac2e8651cd749ed31d4ee45bf1da12ac7e302d0cb2f478988bc77ced195b6f4e856113d0a80

        Download Submit

      • \Device\HarddiskVolume1\Boot\bg-BG\!!!HOW_TO_DECRYPT!!!.mht
        Filesize

        4KB

        MD5

        28819d45b71f3198a258260522dff2e6

        SHA1

        d07cf355ba82439e59f3bf2b3a0447ed5a77474d

        SHA256

        30c49fa42f659e56615f1cb6c65e4766eec7f7f9a1d9c6f03f222f3bacd82b2f

        SHA512

        cb55f830428e89f863f25aaad04031fdd139d66061b05cba44ce48b81cb27337d08c19021cf73b04b1e33cdecadaef9aa5b268d850146039821d2cfa719b1406

        Download Submit

      • memory/304-831-0x00000278105A0000-0x00000278105B0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/304-825-0x0000027810540000-0x0000027810550000-memory.dmp

        Filesize

        64KB

        Download