General
- Target jaffacakes118_samples.part026.rar
- Size 15.0MB
- Sample261114-m5nsdads2q
- SHA256 2bd509669c694baeb1234cc20b362e3b9a5d7619e200d949a0c9fd425e206ef3
Malware Config
Extracted
-
gandcrab
-
http://gdcbghvjyqy7jclk.onion.top/
Extracted
-
nanocore
-
1.2.2.0
-
sussyamous34.ddns.net:1604
-
127.0.0.1:1604
-
ec97bb2a-97e2-4ed2-ab3e-80470b0fcb3b
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-04-01T11:36:09.798698936Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1604
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ec97bb2a-97e2-4ed2-ab3e-80470b0fcb3b
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
sussyamous34.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Extracted
-
sodinokibi
-
48
-
2699
-
onlinemarketingsurgery.co.uk
-
skinkeeper.li
-
metroton.ru
-
fta-media.com
-
skolaprome.eu
-
carolynfriedlander.com
-
fotoslubna.com
-
stressreliefadvice.com
-
condormobile.fr
-
michal-s.co.il
-
andrealuchesi.it
-
1deals.com
-
hawthornsretirement.co.uk
-
gatlinburgcottage.com
-
voice2biz.com
-
enews-qca.com
-
thenalpa.com
-
modamarfil.com
-
primemarineengineering.com
-
internestdigital.com
-
net
false
-
pid
48
-
prc
mydesktopqos
pvlsvr
tbirdconfig
agntsvc
isqlplussvc
vxmon
CagService
VeeamDeploymentSvc
benetns
winword
ocomm
firefox
steam
powerpnt
dbeng50
bengien
visio
mydesktopservice
bedbh
DellSystemDetect
mspub
thebat
infopath
encsvc
synctime
ocssd
dbsnmp
sql
xfssvccon
EnterpriseClient
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
2699
-
svc
MVarmor64
backup
memtas
VSNAPVSS
WSBExchange
svc$
MVArmor
veeam
bedbg
BackupExecAgentBrowser
BackupExecDiveciMediaService
BackupExecVSSProvider
MSExchange
sophos
AcrSch2Svc
VeeamDeploymentService
CAARCUpdateSvc
PDVFSService
BackupExecRPCService
MSExchange$
BackupExecJobEngine
vss
AcronisAgent
MSSQL$
stc_raw_agent
VeeamNFSSvc
BackupExecManagementService
ARSM
BackupExecAgentAccelerator
VeeamTransportSvc
Extracted
-
C:\ProgramData\readme.txt
- Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom You can contact us and decrypt one file for free on this TOR site (you should download and install TOR browser first https://torproject.org) https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/ Your company id for log in: ea3d3d33-1635-47f7-a1a4-0078267b30bb
-
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Extracted
-
C:\Program Files\instructions_read_me.txt
-
blackbasta
- ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/ Login ID: 7cc99f24-1882-4709-8616-68d78879d895 *!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) *!* To restore all your PCs and get your network working again, follow these instructions: - Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency. Please follow these simple rules to avoid data corruption: - Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. Waiting you in a chat.
-
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Extracted
-
C:\Users\Admin\Downloads\How To Restore Your Files.txt
- What Happened to My Computer? Your important files are encrypted. Many of your documents, photos, videos, databases and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your files without our decryption service. Can I Recover My Files? Sure. We guarantee that you can recover all your files safely and easily. But you have not so enough time. You can decrypt some of your files for free. But if you want to decrypt all your files, you need to pay. You only have 3 days to submit the payment. After that the price will be doubled. Also, if you don't pay in 7 days, you won't be able to recover your files forever. How Do I Pay? Payment is accepted in Bitcoin only. Please check the current price of Bitcoin and buy some bitcoins. And send the correct amount to the address in this. Once the payment is checked, you can start decrypting your files immediately. Contact If you need our assistance, send a message by Telegram. We strongly recommend you to not remove this software, and disable your anti-virus for a while, until you pay and the payment gets processed. If your anti-virus gets updated and removes this software automatically, it will not be able to recover your files even if you pay! Bitcoin address bc1q5jcrkhupyahwqhqa8fjngftp6r4mz6r0wputkd Amount 10 bitcoin Telegram https://t.me/bbkte4m
-
https://t.me/bbkte4m
Extracted
-
C:\ProgramData\Service\SURTR_README.hta
-
surtr
- SurtrRansomware OOPS ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED AND STOLEN !! Notice : There is only one way to restore your data read the boxes carefully! Attention : Do Not change file names. Do Not try to decrypt using third party softwares , it may cause permanent data loss . your files will be sold on the Dark Web after 15 days. Imagine 1 million hackers have all your information including files, IP, name and number and location and ... Do not pay any money before decrypting the test files. You can use our 50% discount if you pay the fee within first 15 days of encryption . otherwise the price will be doubled. In order to warranty you , our team will decrypt 3 of your desired files for free.but you need to pay the specified price for the rest of the operation . How To Decrypt : Your system is offline . in order to contact us you can email this address [email protected] use this ID (fkx2d25z5eksxb) for the title of your email . If you weren't able to contact us within 24 hours please email : [email protected] If you didn't get any respond within 48 hours use this link (Not Available Now).send your ID and your cryptor name (SurtrRansomwareUserName) therefore we can create another way to contact you as soon as possible
Extracted
-
C:\ProgramData\Service\SURTR_README.hta
-
surtr
- SurtrRansomware OOPS ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED AND STOLEN !! Notice : There is only one way to restore your data read the boxes carefully! Attention : Do Not change file names. Do Not try to decrypt using third party softwares , it may cause permanent data loss . your files will be sold on the Dark Web after 15 days. Imagine 1 million hackers have all your information including files, IP, name and number and location and ... Do not pay any money before decrypting the test files. You can use our 50% discount if you pay the fee within first 15 days of encryption . otherwise the price will be doubled. In order to warranty you , our team will decrypt 3 of your desired files for free.but you need to pay the specified price for the rest of the operation . How To Decrypt : Your system is offline . in order to contact us you can email this address [email protected] use this ID (j3l3zfqqq703cr) for the title of your email . If you weren't able to contact us within 24 hours please email : [email protected] If you didn't get any respond within 48 hours use this link (Not Available Now).send your ID and your cryptor name (SurtrRansomwareUserName) therefore we can create another way to contact you as soon as possible
Targets
-
- Target a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe
- Size 720KB
- SHA256 a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96
Score10/10Family: Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Renames multiple (854) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Sets desktop wallpaper using registry
-
- Target a130125a498a358b75cd9a1256ea873baeacd81f77c3d2ea475f3e547f899509.elf
- Size 4.0MB
- SHA256 a130125a498a358b75cd9a1256ea873baeacd81f77c3d2ea475f3e547f899509
Score3/10 -
- Target a4337294dc51518284641982a28df585ede9b5f0e3f86be3c2c6bb5ad766a50f.exe
- Size 226KB
- SHA256 a4337294dc51518284641982a28df585ede9b5f0e3f86be3c2c6bb5ad766a50f
Score9/10Renames multiple (9274) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Drops desktop.ini file(s)
-
- Target a87658cd123b8352396116b4ee5fb36cfaf83493d30aefc01bd2aacc4d1c1885.exe
- Size 159KB
- SHA256 a87658cd123b8352396116b4ee5fb36cfaf83493d30aefc01bd2aacc4d1c1885
Score1/10 -
- Target aa503ddb166aff5790a44dc1cf64840fb7251d2b509f7b3eeb072f59b5cc7aeb.exe
- Size 2.8MB
- SHA256 aa503ddb166aff5790a44dc1cf64840fb7251d2b509f7b3eeb072f59b5cc7aeb
Score10/10Chaos Ransomware
Family: Chaos
Ransomware family first seen in June 2021.
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Modifies boot configuration data using bcdedit
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
Disables Task Manager via registry modification
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
Executes a file named after a Windows system binary
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
Executes dropped EXE
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Adds Run key to start application
Drops desktop.ini file(s)
Sets desktop wallpaper using registry
-
- Target aa7ef4bb8d0eab74af36162fe42056008d7e19e62ff1b50b870e72140a7b5bd2.exe
- Size 532KB
- SHA256 aa7ef4bb8d0eab74af36162fe42056008d7e19e62ff1b50b870e72140a7b5bd2
Score1/10 -
- Target aae8f441367e5b86a5f46bfd062c42886c6df0cff410a2a91c5334e321e54200.exe
- Size 1.4MB
- SHA256 aae8f441367e5b86a5f46bfd062c42886c6df0cff410a2a91c5334e321e54200
Score10/10Family: Azov
A wiper seeking only damage, first seen in 2022.
Renames multiple (10503) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
Executes dropped EXE
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Adds Run key to start application
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ab04ff1b0d5f70c43a0985f3b0b3b8bc1150ab9e74d56f3b1c4043a51aabf76d.exe
- Size 136KB
- SHA256 ab04ff1b0d5f70c43a0985f3b0b3b8bc1150ab9e74d56f3b1c4043a51aabf76d
Score1/10 -
- Target ab14f462141fd6d559fcf50dd92e7c7571a6ecf8986c9be7af85baf8f025bbe9.exe
- Size 73KB
- SHA256 ab14f462141fd6d559fcf50dd92e7c7571a6ecf8986c9be7af85baf8f025bbe9
Score6/10Adds Run key to start application
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ab24df3877345cfab2c946d8a714f1ef17fe18c6744034b44ec0c83a3b613195.dll
- Size 850KB
- SHA256 ab24df3877345cfab2c946d8a714f1ef17fe18c6744034b44ec0c83a3b613195
Score10/10Family: Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
Renames multiple (2390) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
- Target ab62ae9f4f7e797648fd4de6633357f704d4799f77844a0368a17ad21d2a2958.exe
- Size 743KB
- SHA256 ab62ae9f4f7e797648fd4de6633357f704d4799f77844a0368a17ad21d2a2958
Score10/10Detects PenterWare ransomware
Family: PenterWare
PenterWare is a Windows ransomware written in C#.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target ab8d097bd5fb7fe03f5e40abd77652210e635b0a253c578db76d2cf844e9147b.exe
- Size 281KB
- SHA256 ab8d097bd5fb7fe03f5e40abd77652210e635b0a253c578db76d2cf844e9147b
Score10/10Detects NoCry ransomware
Family: NoCry
NoCry is a Windows ransomware written in C#.
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Sets desktop wallpaper using registry
-
- Target ab8eee432fa636360b3c6724fe6851e9cf8eeae1ee9da6fc576bee1cd5d7fad2.exe
- Size 79KB
- SHA256 ab8eee432fa636360b3c6724fe6851e9cf8eeae1ee9da6fc576bee1cd5d7fad2
Score10/10Family: Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Renames multiple (143) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target abbac1d240758fe349c6765e118ff6a5e34e080d10542593a154ca32b222b83f.exe
- Size 61KB
- SHA256 abbac1d240758fe349c6765e118ff6a5e34e080d10542593a154ca32b222b83f
Score10/10Family: Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
Renames multiple (88) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Adds Run key to start application
Drops desktop.ini file(s)
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Sets desktop wallpaper using registry
-
- Target abd49fd6f57d4f0ffef794257692c61b2089ee412ae27fe36a9ffee41f9d5e14.exe
- Size 1.1MB
- SHA256 abd49fd6f57d4f0ffef794257692c61b2089ee412ae27fe36a9ffee41f9d5e14
Score10/10Deletes NTFS Change Journal
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
Detects Surtr Payload
Family: Surtr
Ransomware family first seen in late 2021.
UAC bypass
Clears Windows event logs
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Modifies boot configuration data using bcdedit
Renames multiple (7654) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
Disables Task Manager via registry modification
Disables Windows Security event logs
Uses wevtutil to disable the Windows Security event logs, preventing new Security events from being recorded and reducing audit trail visibility.
Disables use of System Restore points
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
Executes dropped EXE
Adds Run key to start application
Drops desktop.ini file(s)
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Reads SMB null-session named pipe settings
Checks which Windows named pipes allow anonymous SMB access on the host, revealing whether unauthenticated remote pipe connections are permitted.
Hide Artifacts: Hidden Files and Directories
Sets desktop wallpaper using registry
-
- Target ac73e3c9e7ee62be2d2138fa5f8ef28679c0a191882b7a30e35ce7b89786935f.exe
- Size 244KB
- SHA256 ac73e3c9e7ee62be2d2138fa5f8ef28679c0a191882b7a30e35ce7b89786935f
Score10/10Family: Wannacry
WannaCry is a ransomware cryptoworm.
Sets desktop wallpaper using registry
-
- Target ac7a0aaa0e361b368d88b60fe956e5f492e7c89135c0f3b8294a176ada5de2bd.exe
- Size 2.6MB
- SHA256 ac7a0aaa0e361b368d88b60fe956e5f492e7c89135c0f3b8294a176ada5de2bd
Score10/10Detects NominatusCrypto C# variant
Detects NominatusCrypto DOS executable variant
Family: NominatusCrypto,NominatusStorm
NominatusCrypto aka NominatusStorm is a ransomware written in C#.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
2Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
2Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable Windows Event Logging
1Disable or Modify Tools
1Indicator Removal
4Clear Windows Event Logs
1File Deletion
3Masquerading
1Match Legitimate Name or Location
1Modify Registry
3Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
5Remote System Discovery
1System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
4Internet Connection Discovery
2