Overview

overview

10

Static

static

3

JaffaCakes...cf.exe

windows10-2004-x64

10

JaffaCakes...cf.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    JaffaCakes118_25d7ebac7114de99058360ea17dcc4cf
  • Size 578KB
  • Sample250727-2f7xaasrs3
  • SHA256 30ec73110c97a5ac5e923324b6874c41777a31b9b8a95467babcb9fb6bd3e982
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
globeimposterdefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Public\Pictures\YOU_FILES_HERE.txt

Ransom Note
  • Your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. Open this link In the "Tor Browser" http://huhighwfn4jihtlz.onion/7dlrwhrvtghr Note! This link is available via "Tor Browser" only. ------------------------------------------------------------- If Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser: https://huhighwfn4jihtlz.onion.top/7dlrwhrvtghr https://huhighwfn4jihtlz.onion.link/7dlrwhrvtghr ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 2 file for free decryption. ------------------------------------------------------------ You unique ID ���32 A1 27 52 F2 5B 16 96 FD 13 01 77 F7 1A AF B4 7B 93 50 83 60 B7 CD 8D D8 ED FD 7B 94 21 E5 7C B2 0C 9D 90 C5 98 87 58 12 DD B3 D5 40 9D 12 F2 06 84 D8 AD 41 E6 1E D0 D9 20 56 D5 04 E4 BA 5C B1 82 27 85 4D 59 76 AD A1 7F A2 5F F4 78 9C 04 19 91 74 BA 89 34 07 AD 9F B0 1A 4F 3C A2 DE FA D1 A5 85 CA A0 CC 9D 4A 55 F7 56 F7 63 3F EA BD EB 7E 90 E8 13 AB CF 05 90 5B 4C 9C 92 74 9C 84 50 15 85 33 F4 3F 40 DA 21 DE 74 7C 28 35 1F D2 2B 88 CB 74 A5 58 EB 6A 4B 5C B1 83 32 5F AA 64 31 73 FD C6 DA 81 A8 A4 63 18 3A 9A B9 B5 70 AE DB 32 D6 BC 62 4A A8 AB 28 3B 5C 33 02 50 7C 3D 0E A0 30 0D A5 20 07 DB 55 03 D7 A1 E1 5E 3F 87 EF E4 78 06 ED 3D EA B4 6D 60 09 98 4B 2B 5B 80 9A AE 8E 3A 7F 4B 07 80 0F E0 C0 13 A3 5C E0 7B 66 05 18 68 C5 BE 2E 85 70 BD DD E0 D9 A5 52 2D
URLs

  • http://huhighwfn4jihtlz.onion/7dlrwhrvtghr

  • https://huhighwfn4jihtlz.onion.top/7dlrwhrvtghr

  • https://huhighwfn4jihtlz.onion.link/7dlrwhrvtghr

Extracted

Path

  • C:\Users\Public\Pictures\YOU_FILES_HERE.txt

Ransom Note
  • Your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. Open this link In the "Tor Browser" http://huhighwfn4jihtlz.onion/7dlrwhrvtghr Note! This link is available via "Tor Browser" only. ------------------------------------------------------------- If Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser: https://huhighwfn4jihtlz.onion.top/7dlrwhrvtghr https://huhighwfn4jihtlz.onion.link/7dlrwhrvtghr ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 2 file for free decryption. ------------------------------------------------------------ You unique ID ���B8 8D 5E 49 44 B6 62 2A 03 16 DC B7 02 6B 25 BC E2 BD FD 65 67 EF 30 DB D7 60 9F 55 E8 71 83 49 6C 8E ED 14 D1 9A 26 F2 58 EE 5C 6D 1F 80 C8 FF 48 96 F4 A7 02 A7 3A 23 7D 1E 86 18 32 AC 18 14 D6 24 EB 8C 59 EC D3 A0 AA C1 74 70 CC E1 20 0E 79 09 DB F5 1E 37 43 9A 3E 6F 30 AC 04 56 02 61 06 D8 15 5A 3B 91 8D 0C 28 5B 0E D6 3F E4 B2 98 93 B8 E4 57 A8 8F 3F BB C5 96 72 1F 17 91 4A 00 F3 57 56 22 BF 35 E8 E5 13 0D 43 E5 C6 86 59 09 C2 59 E3 2C 1A 69 FD 36 B9 8A 87 D5 7B 4D 83 6C 12 28 34 8F E4 01 B2 2B 5D FC F7 35 EE 5B 73 B5 C8 45 40 57 60 5B 73 31 F9 FF 23 64 54 CF D1 89 65 CD 44 83 9D 64 8A 77 AC 2E 28 C1 9C 29 C8 C0 8A 25 3E D2 FF AF F5 7D 19 E5 3C D2 70 85 A2 79 BC 2D 51 03 F0 22 8E 07 C5 7A C9 07 77 C0 8A 15 60 15 3D E9 52 54 ED B1 1E B2 42 91 42 F0 66 0C
URLs

  • http://huhighwfn4jihtlz.onion/7dlrwhrvtghr

  • https://huhighwfn4jihtlz.onion.top/7dlrwhrvtghr

  • https://huhighwfn4jihtlz.onion.link/7dlrwhrvtghr

Targets

    • Target
      JaffaCakes118_25d7ebac7114de99058360ea17dcc4cf
    • Size 578KB
    • SHA256 30ec73110c97a5ac5e923324b6874c41777a31b9b8a95467babcb9fb6bd3e982
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    globeimposterdefense_evasiondiscoverypersistenceransomwarespywarestealer

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Globeimposter family

      globeimposter

    • Renames multiple (9141) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks