Overview

overview

10

Static

static

HotCoffeeR...re.exe

windows7_x64

10

HotCoffeeR...re.exe

windows10_x64

7

Analysis

  • max time kernel
    68s
  • max time network
    21s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    27/09/2021, 13:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    HotCoffeeRansomware.exe
  • Size 776KB
  • Sample210927-qlaceshagr
  • SHA256 546f3a70ab029ad78105f1b7cf581038362cfbb3c7120326075552d72656ec98
  • MD5 SHA1 SHA512
Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\Desktop\HOT_COFFEE_README.hta

Ransom Note
  • GIVE ME HOT COFFEE You have been bamboozled by the hot coffee ransomware. Your files have been encrypted using military grade encryption and only we have the decryption key. If you want to get your files back you need to pay a ransom of 1 large long black with an extra espresso shot. Email [email protected] for further instructions. You have 7 days to pay or else.

Signatures

  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 2 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HotCoffeeRansomware.exe
    "C:\Users\Admin\AppData\Local\Temp\HotCoffeeRansomware.exe"
    1⤵
    • Drops startup file
    • Drops file in Program Files directory
    PID:968
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1652
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:1604
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Downloads\EnableRedo.txt.hotcoffee
        1⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:560
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\EnableRedo.txt.hotcoffee
          2⤵
          • Opens file in notepad (likely ransom note)
          PID:712
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\HOT_COFFEE_README.hta"
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1372

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/1652-53-0x000007FEFC4F1000-0x000007FEFC4F3000-memory.dmp
            Download