Analysis
-
max time kernel
129s -
max time network
55s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
05-10-2021 19:56
Static task
static1
Behavioral task
behavioral1
Sample
HotCoffeeRansomware.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
HotCoffeeRansomware.exe
Resource
win10v20210408
General
-
Target
HotCoffeeRansomware.exe
-
Size
776KB
-
MD5
c054c0f03277f7f0bdad9350fa3d5c2d
-
SHA1
752071b548bb3a4c45c91174fcf5cf95ce99638a
-
SHA256
546f3a70ab029ad78105f1b7cf581038362cfbb3c7120326075552d72656ec98
-
SHA512
783a02a18f15c80c21cb08b9822ab02c0f62a11340edbbc44a364db9d820bda795db086f843ed3c2597d86c2933dc531ebdaa2ab3fc97e3f5e18aa3c437f6576
Malware Config
Extracted
C:\Users\Public\Desktop\HOT_COFFEE_README.hta
EMAIL@protonmail.com
Signatures
-
Drops startup file 1 IoCs
Processes:
HotCoffeeRansomware.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOT_COFFEE_README.hta HotCoffeeRansomware.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
HotCoffeeRansomware.exedescription ioc process File created C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Mozilla Firefox\uninstall\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\DVD Maker\en-US\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\am\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Java\jre7\lib\zi\Atlantic\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Java\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\sl\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File opened for modification C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt.hotcoffee HotCoffeeRansomware.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt.hotcoffee HotCoffeeRansomware.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\WindowsPowerShell\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File opened for modification C:\Program Files\Java\jre7\bin\server\Xusage.txt.hotcoffee HotCoffeeRansomware.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\WindowsPowerShell\Configuration\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt.hotcoffee HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Filters\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Esl\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Common Files\System\ado\en-US\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt.hotcoffee HotCoffeeRansomware.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt.hotcoffee HotCoffeeRansomware.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\HOT_COFFEE_README.hta HotCoffeeRansomware.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\HOT_COFFEE_README.hta HotCoffeeRansomware.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
mshta.exepid process 2044 mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HotCoffeeRansomware.exe"C:\Users\Admin\AppData\Local\Temp\HotCoffeeRansomware.exe"1⤵
- Drops startup file
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Public\Desktop\HOT_COFFEE_README.hta"1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Desktop\HOT_COFFEE_README.htaMD5
6e7b27b7aefb0b372b672ca6c4105d6c
SHA1690ac02d79345d25b9d68315429c82089e284ceb
SHA2566648a5494ef3ab26252c30c4f63ef76667c718126839ed8ac7bc3496fde8f64a
SHA512f81fd765119651631d439a945cc8ee26f9e3bb80a24e8dbd5ad91d5073b2611cd163a540f9b96b562fed87bc9601811f8d4e3fecca7fc9c016cd18e4a012662a
-
memory/816-61-0x000007FEFC2E1000-0x000007FEFC2E3000-memory.dmpFilesize
8KB