Analysis
-
max time kernel
129s -
max time network
55s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
05/10/2021, 19:56
Static task
static1
Behavioral task
behavioral1
Sample
HotCoffeeRansomware.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
HotCoffeeRansomware.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
HotCoffeeRansomware.exe
-
Size
776KB
-
MD5
c054c0f03277f7f0bdad9350fa3d5c2d
-
SHA1
752071b548bb3a4c45c91174fcf5cf95ce99638a
-
SHA256
546f3a70ab029ad78105f1b7cf581038362cfbb3c7120326075552d72656ec98
-
SHA512
783a02a18f15c80c21cb08b9822ab02c0f62a11340edbbc44a364db9d820bda795db086f843ed3c2597d86c2933dc531ebdaa2ab3fc97e3f5e18aa3c437f6576
Score
10/10
Malware Config
Extracted
Path
C:\Users\Public\Desktop\HOT_COFFEE_README.hta
Ransom Note
GIVE ME HOT COFFEE
You have been bamboozled by the hot coffee ransomware.
Your files have been encrypted using military grade encryption and only we have the decryption key.
If you want to get your files back you need to pay a ransom of 1 large long black with an extra espresso shot.
Email [email protected] for further instructions. You have 7 days to pay or else.
Emails
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOT_COFFEE_README.hta HotCoffeeRansomware.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Mozilla Firefox\uninstall\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\DVD Maker\en-US\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\am\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Java\jre7\lib\zi\Atlantic\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Java\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\sl\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File opened for modification C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt.hotcoffee HotCoffeeRansomware.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt.hotcoffee HotCoffeeRansomware.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\WindowsPowerShell\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File opened for modification C:\Program Files\Java\jre7\bin\server\Xusage.txt.hotcoffee HotCoffeeRansomware.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\WindowsPowerShell\Configuration\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt.hotcoffee HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Filters\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Esl\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Common Files\System\ado\en-US\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt.hotcoffee HotCoffeeRansomware.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt.hotcoffee HotCoffeeRansomware.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\HOT_COFFEE_README.hta HotCoffeeRansomware.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2044 mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HotCoffeeRansomware.exe"C:\Users\Admin\AppData\Local\Temp\HotCoffeeRansomware.exe"1⤵
- Drops startup file
- Drops file in Program Files directory
PID:1860
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Public\Desktop\HOT_COFFEE_README.hta"1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
PID:2044
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:816