Analysis
-
max time kernel
121s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10-05-2024 00:25
General
-
Target
2c6e8b55ec2beb6ed16874e3e809573b_JaffaCakes118.exe
-
Size
369KB
-
MD5
2c6e8b55ec2beb6ed16874e3e809573b
-
SHA1
221f4a333fffd85f544c71949661f73b62eed173
-
SHA256
843c8d5bebe93aeaebeb940267b6b9fb4d8ddb392a316be0f6d58e0bcf940109
-
SHA512
8c48aa13e678ef8988d16198aa0dd767e6255e75f56c405fee03f1ea99852243b83c8e99bca703b7046eed97cf1ee8ffdce55580375805266b536d4dae3f9bce
-
SSDEEP
6144:2o07Ev9jgh+J0J+l/moekR1MlvlMa0FIe03ncsCMYZx/FqDN6TETpspvQrMX1r9:2tQVG+JIe/mGzMNlMVFC3Xi/YwOi
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+vqqgr.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/BE33FE44F9B1BE78
http://tes543berda73i48fsdfsd.keratadze.at/BE33FE44F9B1BE78
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/BE33FE44F9B1BE78
http://xlowfznrg4wf7dli.ONION/BE33FE44F9B1BE78
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (425) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 52 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c6e8b55ec2beb6ed16874e3e809573b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2c6e8b55ec2beb6ed16874e3e809573b_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2c6e8b55ec2beb6ed16874e3e809573b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2c6e8b55ec2beb6ed16874e3e809573b_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\pkcnkuwfvsgu.exeC:\Windows\pkcnkuwfvsgu.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\pkcnkuwfvsgu.exeC:\Windows\pkcnkuwfvsgu.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2600 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\PKCNKU~1.EXE5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\2C6E8B~1.EXE3⤵
- Deletes itself
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5460ffb30ccb9c5ad3bf3177d52227146
SHA160f035d11940a546814e20b785dd467fd8de9bc8
SHA25602c9ce3b5436f2ef2bad9017c73a43d73c4816a3c49bb8d6727c19688ef5f3d2
SHA512efce9312011732c1b82bc7ff17486ea9b6c03742fd67509aa5a5563ddec582026b519f626ec63ea87f1e024fe03242cda2e21492e405715f7586298630c2b99c
-
Filesize
62KB
MD5c90f3d74166d4bcd9137aa61f418e612
SHA1a68ac170433aa5563aa0cd993973cc505f7aef63
SHA25680845cf31810405dcbf011113d801359319a5c6bcda6d06acf3309b2d72f65a6
SHA512c0ca8593c60b9e998c85715ad0fd3632127fa49b7450c41abd13eda820fd7e18ee4de8aaf899f65c89f451a6cfab4cf1dc920d56356c9c1620efe8524369d0f9
-
Filesize
1KB
MD5adc5bdf20ba3fa2256032ebdb793a9ed
SHA16100c6b13d3e14601ce4799d85c978789ca536a2
SHA256a14ade5000c799dd5f59c27f155c6b32811add038d5e7617ca62e2f6ec676493
SHA512590b0f4bbd1d350d5488cd5b57dc49116bfc586d46ecb73e6bb17d816ef502e00a9c52b6b6c11b60c06ebc17f3b95446fd3e634cc2934614b9bac5986c386bbc
-
Filesize
11KB
MD505eba3dc686a0fcd6a930ef29f3e33ee
SHA17d4df9fc748a939548c25fc415e004e479c3d2b2
SHA256f8dea19ffe958d4d5d10f53e29e1db50be12126a93db1b878c5922c4b75cc386
SHA51283f1566b7c9bbfc691dab905e6e8639382ec928f7af5c38b9e89e56a629cfdab9ea61ef335d47a0aa93c76ec96a3bd9b575540a9cd6404453da1e0d488317706
-
Filesize
109KB
MD5e5f65fd5892865cf3909cafa95c13d94
SHA197c0a75531bead584c7bcabfd2d68bcfe97b7e44
SHA25698459deafe0d12475a5770a338dcddef8217e8ba47b3e843c98602b45eb11d49
SHA512dd08ebfede699734699e555538bb9c281996bf3868fce9add108685a205200a84a6f3ea7c14ab2b935549e97dabdc06ff5e79adc595dd9d14f627f543353f4b7
-
Filesize
173KB
MD571ebe1c8344fa100cd87f0aa6aa99195
SHA17c64cedd18792c3d86d9463ffcae689138330f82
SHA25649cfa547e7cbfb9f139018539707e4fa0077583b61f293d88b57a59948e18426
SHA512e2d8dc365e3f4e28395583bf25435ee57ef07751179b7f5233094c2a5dc29610c33097f1cddc9a71c9c23fb1b5ec713f8692893600baad10675fed7ac28bc99c
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
344B
MD57001bee8171d52dcb23641ac1c0831aa
SHA1ff2e8c53258b6954b09d676ebeba07ba46b5f8f7
SHA25606a02205037b1d16157e28314cdf12e5c7cc6f65dfb32da2b5cf2494eba57a65
SHA51278fbd17667fd90d4bd7bc5b1b9922d9c5738fdf57d4dfd5da79081e3fed8ed9f3a6aa1f7fc932d8dc8369b1df5f2ae23255effa41246c1e53dcc1e48cc23da45
-
Filesize
344B
MD58935b6b60d31cc803d92671525809684
SHA1560e319c53f6b7560127de1c6af725cbdf8b87c1
SHA2569c138bd3a475dda3d3a6c6b817d635f8036b0b2bc63ff65a1f9fc4e15d1cb9f1
SHA512e2a8ec489f34abea503556430983106f640be56dd1e093d84f399e3c0bf40cd29300192744d5290873a3cb82317e1377615aca97985ceeb530609eba63704f0f
-
Filesize
344B
MD51c960b4839850caa297ed762ee9c28d4
SHA10cb08cdf06a9264140ea8ed287d48055c8e783e0
SHA256de3dad8e5b7ffaee6735fc54320dbc3a51ef2790e7edbaa551e0489b9cdc1985
SHA51224d12e4988f3e4b811820583f56f796cb0a81d4e4273ba67056c6f916cd11bb0b7270bfca1fb25bcdbb6271487b1f32d29fcfff78cad7af89bd3c6368d422352
-
Filesize
344B
MD5e686a61284ce01596fbe989cc134a6f7
SHA1c09330410593caa467974f5f8957c2499eb4f42a
SHA256a35d04b761dc3d24b278beada74a0ad126ff706eb84493d6a1a9556c1530c65c
SHA51250e549864d56a24b8a28f6e0aec0b1fe8d23c8b2fac18eb89350f0530cae92676619dfca4a9734b83f1030613dc64a858a273542f2e06adff91cd63a2605b338
-
Filesize
344B
MD5b73960b520a1ed111ed4690006cd3017
SHA18d28ba6448258dc251953fbb39c15d9584b5c1da
SHA2562c17a2087eac1b046e5838d5d60f59db376dc12b0d5935eb495e0ab9f1a574e1
SHA5122db8f3d4c93a95ae6a549ea90af0814bc3a42480253938568ca0eebb89cbfe301c89f46987b7e41845badc57d004e86c867f55ac58c9787f646df366800b925c
-
Filesize
344B
MD5b260f5335aef9f82eccfdc3707001a84
SHA1f5b5081b1f76b51d1a1d7a8b7b94fb0264b1f4db
SHA256b185d26df56fdea255cbf2f1475ab25b79a1fff4476991021cca130e9f708555
SHA512d5af0d5329caba2f9dd2eec9823885833b38da986e97e84402ea231aebdbb1f5e14471ee1694b86d7dc6297a1897ebbafb2275d163f1175361b17280c5ee7584
-
Filesize
344B
MD56b8778ad035061005a9cfa8f3eb438ec
SHA1f976f21cfd1e8055502a9be2bc10dd0c34de130e
SHA256f5f3856eeb7965552675b725fc3bbb57de484c0da107eb6932743cd5df6d471c
SHA512c76e08e8ed0fa10482e7f207254033ddaff9f7fae17177e7ca586f67571e52309e500ae4128447237ff9831141da9e967e6b15a03594065329af26fa76aae011
-
Filesize
344B
MD5abe7b4b663e6515606c652c36ad1eaef
SHA1e6afe63e51d0bc298f0eef66a1784020c8157837
SHA256f46f863094e3fab6eb42092dfe12b46a573b31769d6807061dc4b287f891eb36
SHA51205543ca0f06b2849aa1a98705d3d53025d2a26b45b1580e973ea9a6cdf847127ca57800b56f16fc734831b9a6a7950a4535ef4bdc5171644beb38b388cc53b5d
-
Filesize
344B
MD5a048f0de71fafadc0368071064e50909
SHA12e6cd3956b402fc372435d7e38144d7224cb1b09
SHA256f6c5be7aae9782c7469723312bfa91da71907b8f0a5514900ece5563f50370f5
SHA512a9a14eba4b7b64567d6ac7614f048439b52705e2e86b45cb3f29092a38685f18b0b0a3a60fc9a681e61416fefca36095019c2e635357ea9156a046a1010d48eb
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
369KB
MD52c6e8b55ec2beb6ed16874e3e809573b
SHA1221f4a333fffd85f544c71949661f73b62eed173
SHA256843c8d5bebe93aeaebeb940267b6b9fb4d8ddb392a316be0f6d58e0bcf940109
SHA5128c48aa13e678ef8988d16198aa0dd767e6255e75f56c405fee03f1ea99852243b83c8e99bca703b7046eed97cf1ee8ffdce55580375805266b536d4dae3f9bce
-
Filesize
1.3MB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
8KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
4KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
8KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
