Overview

overview

10

Static

static

HotCoffeeR...re.exe

windows7_x64

10

HotCoffeeR...re.exe

windows10_x64

Resubmissions

05-10-2021 19:56

211005-yn32hsacd9 10

27-09-2021 13:20

210927-qlaceshagr 10

Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    05-10-2021 19:56

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Remote task has failed: Machine shutdown
Report Analysis Logs

General

  • Target

    HotCoffeeRansomware.exe

  • Size

    776KB

  • MD5

    c054c0f03277f7f0bdad9350fa3d5c2d

  • SHA1

    752071b548bb3a4c45c91174fcf5cf95ce99638a

  • SHA256

    546f3a70ab029ad78105f1b7cf581038362cfbb3c7120326075552d72656ec98

  • SHA512

    783a02a18f15c80c21cb08b9822ab02c0f62a11340edbbc44a364db9d820bda795db086f843ed3c2597d86c2933dc531ebdaa2ab3fc97e3f5e18aa3c437f6576

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOT_COFFEE_README.hta

Ransom Note
GIVE ME HOT COFFEE You have been bamboozled by the hot coffee ransomware. Your files have been encrypted using military grade encryption and only we have the decryption key. If you want to get your files back you need to pay a ransom of 1 large long black with an extra espresso shot. Email EMAIL@protonmail.com for further instructions. You have 7 days to pay or else.
Emails

EMAIL@protonmail.com

Signatures

  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 56 IoCs
  • Suspicious use of SendNotifyMessage 56 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HotCoffeeRansomware.exe
    "C:\Users\Admin\AppData\Local\Temp\HotCoffeeRansomware.exe"
    1⤵
    • Drops startup file
    • Drops file in Program Files directory
    PID:656
  • C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\HOT_COFFEE_README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
      PID:3860
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Drops startup file
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1648
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x0 /state0:0xa3aff055 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:2300

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HOT_COFFEE_README.hta
      MD5

      6e7b27b7aefb0b372b672ca6c4105d6c

      SHA1

      690ac02d79345d25b9d68315429c82089e284ceb

      SHA256

      6648a5494ef3ab26252c30c4f63ef76667c718126839ed8ac7bc3496fde8f64a

      SHA512

      f81fd765119651631d439a945cc8ee26f9e3bb80a24e8dbd5ad91d5073b2611cd163a540f9b96b562fed87bc9601811f8d4e3fecca7fc9c016cd18e4a012662a

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOT_COFFEE_README.hta
      MD5

      6e7b27b7aefb0b372b672ca6c4105d6c

      SHA1

      690ac02d79345d25b9d68315429c82089e284ceb

      SHA256

      6648a5494ef3ab26252c30c4f63ef76667c718126839ed8ac7bc3496fde8f64a

      SHA512

      f81fd765119651631d439a945cc8ee26f9e3bb80a24e8dbd5ad91d5073b2611cd163a540f9b96b562fed87bc9601811f8d4e3fecca7fc9c016cd18e4a012662a

      Download Submit
    • C:\Users\Admin\Desktop\HOT_COFFEE_README.hta
      MD5

      6e7b27b7aefb0b372b672ca6c4105d6c

      SHA1

      690ac02d79345d25b9d68315429c82089e284ceb

      SHA256

      6648a5494ef3ab26252c30c4f63ef76667c718126839ed8ac7bc3496fde8f64a

      SHA512

      f81fd765119651631d439a945cc8ee26f9e3bb80a24e8dbd5ad91d5073b2611cd163a540f9b96b562fed87bc9601811f8d4e3fecca7fc9c016cd18e4a012662a

      Download Submit