Analysis
- max time kernel
83s - max time network
85s - platform
windows10_x64 - resource
win10v20210408 - submitted
27/09/2021, 13:20
Static task
static1
Behavioral task
behavioral1
Sample
HotCoffeeRansomware.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
- Target HotCoffeeRansomware.exe
- Size 776KB
- Sample210927-qlaceshagr
- SHA256 546f3a70ab029ad78105f1b7cf581038362cfbb3c7120326075552d72656ec98
- MD5 c054c0f03277f7f0bdad9350fa3d5c2d
- SHA1 752071b548bb3a4c45c91174fcf5cf95ce99638a
- SHA512 783a02a18f15c80c21cb08b9822ab02c0f62a11340edbbc44a364db9d820bda795db086f843ed3c2597d86c2933dc531ebdaa2ab3fc97e3f5e18aa3c437f6576
- MD5 SHA1 SHA512
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOT_COFFEE_README.hta HotCoffeeRansomware.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe\Assets\contrast-black\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\lua\http\js\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\et\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\tr-tr\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt.hotcoffee HotCoffeeRansomware.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\THIRDPARTYLICENSEREADME.txt.hotcoffee HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pt-br\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\it-it\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-si\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fi-fi\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\contrast-black\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf.hotcoffee HotCoffeeRansomware.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt.hotcoffee HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pl-pl\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hu-hu\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ar-ae\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Buttons\FullScreen\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-ae\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\css\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt.hotcoffee HotCoffeeRansomware.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\hu-hu\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\root\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\AppCS\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\da-dk\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\el\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sk-sk\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\tr-tr\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f14\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ko-kr\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\HOT_COFFEE_README.hta HotCoffeeRansomware.exe