Resubmissions
15-05-2024 07:41
240515-jjclfaff64 1015-05-2024 07:38
240515-jgfkbafe78 415-05-2024 07:26
240515-h9jxrsfa2t 10Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
15-05-2024 07:26
General
-
Target
45193536497856842273bcf3ba3eed80_JaffaCakes118.exe
-
Size
360KB
-
MD5
45193536497856842273bcf3ba3eed80
-
SHA1
9936812c27e92c8f7f7183ed3a8730ea1c6e167b
-
SHA256
9bf59f52f58052e0644fc5d0a8e9efcc8b7db586a365bd8611228c42ed4d0332
-
SHA512
3ea4cb9916f01b00d7dd73fef6a9006d1c521a225037a44a136991d98db1a0abb74fbc2a09dd2905e2404ca2956382dbb274e346e84be99bdb0377a3ca44f785
-
SSDEEP
6144:gZtBZh5vTOAWJx4u1l05Lpm+SemsrbK9XbgwJU2WWIBReISOuO8I:Qn7vSr4+sLwRnXbg4U2WWyN
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+lojlm.txt
teslacrypt
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/FD457E744B4F9E99
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/FD457E744B4F9E99
http://yyre45dbvn2nhbefbmh.begumvelic.at/FD457E744B4F9E99
http://xlowfznrg4wf7dli.ONION/FD457E744B4F9E99
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (415) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\45193536497856842273bcf3ba3eed80_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\45193536497856842273bcf3ba3eed80_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\45193536497856842273bcf3ba3eed80_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\45193536497856842273bcf3ba3eed80_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\trkauipglhte.exeC:\Windows\trkauipglhte.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\trkauipglhte.exeC:\Windows\trkauipglhte.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_ReCoVeRy_.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1340 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\TRKAUI~1.EXE5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\451935~1.EXE3⤵
- Deletes itself
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD57b02d24c6e7782b45f42955dac38bced
SHA1f6e4e448aed8149c9b0c63f45eac8d2e1a4f1f07
SHA256a068c97fdf2ec96d30c93d2a45fb0308063a5c504e355d1e457c2555bb5d4d80
SHA512e1740f8ae2173933ce89da42fd86cb7b686d26a45fffdc3333229ba81bb97e06907a510b57895841c234ef3219a222a47be5854a2f5d5bad8ee4458a772d4627
-
Filesize
64KB
MD547c3175d755b5eccea0d0cf8b2c34aa5
SHA1554c90dfe7d81b26fbd1dce4ff0e3dbe8f0b6050
SHA256b8e83a440e2c119379f82298ac66f9917e7a027c02ad642e84850536c4943321
SHA512986ee0a36429eefd6a8f49d5ce1086fdc61c5ca120d5ab88b5b2f45ae385d6d44b87cfd9dea9495855e45011581f91323352870450e49a8a122652aa65b37528
-
Filesize
1KB
MD558186fe7387250bddfe77fbdc53c9788
SHA1d2b9e4f19dd1aafc5c7c29af7e868da4ea691a14
SHA25662859300aaf550951e0b7712904c86e28aee1f3273c7a44df3bbfa5a1f965ba9
SHA5126c5833c966203e3860f3dd01c8b12ea8daba61946917b9d6b6c943477e4866fb2a82fdbe737afa2bebeaec3e9aa6ff3abacc031847fa88739e6a2418421b06b3
-
Filesize
11KB
MD5d0de82b06779ff3fe816d84542c218e3
SHA1d0b357db82e1a5e4c13484eec765f775a7438ab4
SHA256f0fb9c18a4ffd473b0e94e3a2955c2aacc21e635250841ec8efd9d4c82c0bcd2
SHA51227bee4aefc598c0447c5e2d7e1288c4f57b9cdf45cd3e52ea223fd93c591298cbead63bd3cd0c4eee61027a9cbe85996edd19bc89d362ee3475f8df759d0cf38
-
Filesize
109KB
MD5196e48b5a008b2f2d9a21da2770572b6
SHA175fba79b9a03fd4bc369f28e71c2df0f79c2d053
SHA2569b5c3b735fc9a992ee069eb14c8bbfa52f0e57c2e0e658e56f83878e41fb5a25
SHA512ae1994c7e1d66741881fd199ec8ba70ec39095b20b6938c50cbe5e6f9f358a1baf85649d9bc5a1d385d4552c461c4c56e0f7d3cd87b319b04b9f4f7a95e9abbd
-
Filesize
173KB
MD5c0e31137240c4098a7308111c804930f
SHA1fd21a8bc154732bc1bfb025680214175f4461951
SHA25688964f3527b99b8e91c56596c742c861d93a3fe7a511bc4f5b5dbccfca4d7b6d
SHA5120420226ae965966851c1b92d27b35aaf784761707acb68fbee7e83a6e50003166c9abe89c9daff6b2d9f3a5421be30a4c6adf6645a4e92665624cb3a82a5295a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
344B
MD54c443f10a252dbcebe2f05c689f19f67
SHA10136b3601507f9ef849074f60dec959b4bdec48b
SHA2568e9ed323e3c255fa9e3c153ad97bd199f07e3ec92a087994accf46c71f5e0a9b
SHA512ba9f6a10ab5df71b9561634bb6078a79503eb9b2cad9e797ebd094ffdde81782d33adcb45c0d81aa72d6366e0e8ee9973c616acf4321d9ca641601c168d18158
-
Filesize
344B
MD59baa784ad9d7e4a9a9cf0349f558fdec
SHA1577179011fea58f84781713ed98908e7c84859d8
SHA256abdfb3c206a4c6f2ea43a5d275bf624cce94bfb260868b873bc4c167e91e65d9
SHA5120ad8f854c6eae365672ebc6584f2293a5ae1a5e38ce66cb9a4ac36e729c570ec971f95ae49dd675ad4ab72289294e0226898f2e1378eee09681505ab49e807eb
-
Filesize
344B
MD5f33314c8fb809e333d727251dfd7439c
SHA137f4800caa48fe4f04e2179db310a341ee895c1a
SHA2563a887d40fa9f0a5741138172fdef638040828eee3df0dc4a13e737c77a3f38fb
SHA512087231928808063ac20ac388657eaf7ebd31732627bc4456a2fcaa651f1956b2fbfd02dbd448f799f679b80aefb1357ed3315335b23a3a27b85aab0f06deb5f4
-
Filesize
344B
MD5a86fa81c245e18fb86d22e2006dcca24
SHA19c65b8bb756e2b2314d8ceb28ba3aedfa898b315
SHA25695433d09025de4e34e69f3b1ab5e5e95696575aa3e26dc5e451a18cf696113e3
SHA512d546ec65557974e4b7f4859c656e330c2a441c1904c33386fdc599a7fc7541d5762a34090f56496af50856ee9500ac4e8698ae09f814dc8231816f94238ab2f5
-
Filesize
344B
MD5af482fbc394c6dd00711e54f49972c17
SHA1dde095fd7558ed7ed032de58b6b7ac03cd31131b
SHA25683d8a02e2bdbb37829acfd3cffc58841e986c36f3e342893d6957c048bb8234f
SHA512751c8cf758e4fe2fb05233da4e442adf75ed16fee773b73251b78b7a8b054034b065eae583aa572aa5a9485200818d917cd574b9d7d4f257d7d095005740c577
-
Filesize
344B
MD5a7a39715a97388039b4c8ae0d283a2a7
SHA1102fec56011fe96b7c87189f07cfdde861ed63b8
SHA256b8aef7ce6dcd46cf627decb8f59ecc5cd3f46f1bd7601cf89f506ee5feba6483
SHA512c025a352b40607254710fa2dc6e2087064ec01148fe751a29cefcac31c5e70679d1e7ab4a73482319782c2bf37bae2e34d64565eea50d1e6c60989a0dd4688ae
-
Filesize
344B
MD54907dcdf3b602d90d59ea12c9e2f548b
SHA1ede80685a1156dc49de76dccf4d80b20bea63926
SHA2562a5c39330c3919236eff8dfb3265e29feb8a1f692143e908a5fceb193256d91c
SHA5121c659ffc83909893c2a5974c50d935c9b4d7b4a07db1e96972de097fbd1369effa69627b08f6aea236c6c8dd7e87004d94a5c7bd0429a9473fcea7a5cb8474bb
-
Filesize
344B
MD589cec8e0e231db71a5a0035ac4147a3a
SHA1d7f25be477b65affe33224740974154b934db31a
SHA25626eeb79670a48d551c6e0ff45498edd24dd8196d44109929bd5bbb7a27399444
SHA512233bb5f09adebaeb5e52e4283ea94cecc122357ad51634edd8730c7b348525bd0f3e3fbd942d3fb568b0946970f05454a49d629fa894e3a4c88dfff86ace6548
-
Filesize
344B
MD541d3cf466ac2efbc3fdfb182a20491e5
SHA1113cb459a6032f5ed374556224f5d1b3d54abd04
SHA2562515cd1df4d83787ea5541ccd53b6c8814f43ccce9e8bc8c19d0057e36251072
SHA512478f45a431ef4cd597868ebef369a8109e238575fac36a5043bacfa08e698762bd756c94bd92d534f05dcde63f1a449612f2d5e1e395f06c5469a2f67e09d44f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
360KB
MD545193536497856842273bcf3ba3eed80
SHA19936812c27e92c8f7f7183ed3a8730ea1c6e167b
SHA2569bf59f52f58052e0644fc5d0a8e9efcc8b7db586a365bd8611228c42ed4d0332
SHA5123ea4cb9916f01b00d7dd73fef6a9006d1c521a225037a44a136991d98db1a0abb74fbc2a09dd2905e2404ca2956382dbb274e346e84be99bdb0377a3ca44f785
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
896KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
