Analysis
-
max time kernel
122s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
23-05-2024 18:03
General
-
Target
6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe
-
Size
340KB
-
MD5
6bcc066e2a81f34c7e052895001f44c6
-
SHA1
6f892ec0287ace1c4c7c86e3945b44de6c9d3ba8
-
SHA256
39a70938288eacf5eab1002150cb06a8299475ad6064fb131aa6e9118c66b4bc
-
SHA512
b11b924dfda23d28019879acbd790778049f4f711134b0003967408b28532544745d12081a9da538f9ecd84f3791b621d3d9c1b4a62699b22d7c56274a1f9f2c
-
SSDEEP
6144:2//b5dx5w2hahQGvPmZ8n0SylbvO+MeTHLlj9HhRbr3ET4b7ODRJT0luqig:SddvwdhHvPmZiyIXgLl3ZoMq4wO
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+bepev.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/BF5DC33221B461C
http://tes543berda73i48fsdfsd.keratadze.at/BF5DC33221B461C
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/BF5DC33221B461C
http://xlowfznrg4wf7dli.ONION/BF5DC33221B461C
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (413) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 36 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 52 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\ergnycdlrvjo.exeC:\Windows\ergnycdlrvjo.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\ergnycdlrvjo.exeC:\Windows\ergnycdlrvjo.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1560 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\ERGNYC~1.EXE5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\6BCC06~1.EXE3⤵
- Deletes itself
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD555285e9b7f4b5402e4c8541532b4f29c
SHA120302278f9f5d02817efad643db614b08d533d86
SHA2566f519ad88c8716f331772a1014a6f7aaf79a73f7cec9b4f5a6e5668c981e4fb5
SHA5128f55f2d56e5ed84c65f43036276310f9d0d90bb86a62d468f284417604f8995134b147db0076feeb4d6b1c93782a11fb3cc7b9f8db0bb54c1d24626449ada261
-
Filesize
62KB
MD5fbac862d164da32b527379054e1648ec
SHA1ec4716939ac281ed4477638c14612948e949b492
SHA256bdae52ba7a8a81667c3043aacc34840f25889268f6879ce874f254e546a8cae6
SHA5127c8dab75d73ab7e71c97fa4ac589f1a15ad30638b6950f9afe03c92c1431f55e86f1f2f2791f99362b70bc4562d577f8284ccd5f021c8a421711869e831c44c3
-
Filesize
1KB
MD5ba4753bbc5fa905380223b17e4930f6c
SHA176099f812b0fb3e88d82c7132e1ea633be7527ae
SHA256bd4858ac7438e39c62cf4ecbe27e86554fb3c31a6b79b754e84e5f1b0688ab11
SHA512e15a5e3f130a7e1da48d626b0a4785634e3997ecf8a3774aae1d9945b1712f1b8fecbd6d529324145a9242b63da693c7a7acd487b0392c13984f7f7f833c58cb
-
Filesize
11KB
MD5cd4a52ebd46f492b67e8209551c752f5
SHA1dd526bda70e77484f07edde6d5986fc9bea22d04
SHA256de1b4e8dff4babca9f428ef249913bc904991667ac3f5a1fea47bf21d175bee1
SHA5122d404f653cf95e2708a496b517d54ee328dcec98b4170ec86859d319af7831588002efd500ef5a301ceb389e43c6243d559c0a89235d586f66b68a76ad3ab95a
-
Filesize
109KB
MD569fbdb9b12865891d265dbff2b8b1168
SHA1cd672ac3fa68b786646b5747d8a172d4d3313937
SHA256c6192431ee6ad07ff53f9fa8368a63d896950dcdeba695b5c7dd04af5f8324f8
SHA5122e609dc759713c2451e18e74df164b7454c95e376399877cc84e4e31b27ca3bb07036b1603121c95ab4851a9c9b2d746a734f10c763bfe22d9ca1012e3129da3
-
Filesize
173KB
MD54a2571302667cb3a7ee024f8a55f7a8f
SHA1fd110724d9c635d894060230c14300fef4e09f93
SHA2567de86d9ac99ba974bd1f5db28d162d85bea334ce6040dbe3f497e5a50f9d949b
SHA512ee4a5b9dc7d082ab49693e8eebf10c1e1b23b80846db9d832e10e20b1fee45cfbaf897159ac84c6141ff33f137005be4786a91b850f9502f59b1a18e1f7c20c5
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
Filesize
252B
MD5775758eca0d4ec6f823830d141589dfd
SHA15e12d37b0db66794ae04116b65e627e0ab02323e
SHA256b80b2dcd7082319360ca294ed1f680341c2b3e488cb3376dbc8d899822e79db1
SHA51262d43078d216266b3832ef8ecd337df7eaecf8360a433c2b8c9a724491f75cf9c7bae9ea88d3eb84dbd87798c6536054ad8a1e2d886bb2bfd9179ab9944df142
-
Filesize
344B
MD57b2dd25d24add688828761df6742f207
SHA13a4f52707458f768ca78c750d759773064c8c12a
SHA25662d4dc7a0de6b785de9700c793334468c4012f1a63ee4788fb0ce53246c02b30
SHA5124feb627e44485cdb2b242da223baf87a37127a72bdd063c492f8552d43e8f9bda4e600fe7208870138c94f27589e48d242cffda19aee54cba761ae944adca0a7
-
Filesize
344B
MD5c221317dda84168dcbc99e0a8e1a041e
SHA1e64921ae8158a4bbeec944019779a8f83e551b76
SHA25606870f465256133ce73ec74254141aaeaf0671fa487df9e35757a8a33c4dfa3e
SHA512f7cdf6d95b676d0eb168d479b7d52538d4ae9b5eaf40248f1138ee017dbcd98830f33859f7375c24d280da74dfe4642efbb95251c7853bbf0d758f2e5dcec985
-
Filesize
344B
MD517605bf6d1bafe0e4f544e237e8de85b
SHA18a8696a240546229fa2e7fc9cb297cc63e6aecf7
SHA25619ab7737889d0db06cb749f59813848f79fd123bdfb3b859057abb91af8bffd2
SHA512b0067f4753c50184376e27ad9880ca2a20f924d9df4d24e19e90c719b20357c89c2c1f611c10d61f966c6d2608a87dd4e9c7f417724f8b5cedfe40cd6f456b70
-
Filesize
344B
MD52509e528855f4539d84a446be5194270
SHA1ad2ced34227fc4bd7b3cf6afc6912cd236a4cb81
SHA25663ef3e9cbc102f0d907462dbdb550d1d6be55561e390f34e279bf8e7f0c4f5d7
SHA5121aa17bb5815fc421799d5f50f25fc22883d1520fbe81ad719dcd312c82c537665aa4c906e1e2acf6831d29a7d0dfb9d9496e3e4c7bd6e86a30dc4c0efd6929e9
-
Filesize
344B
MD54b2da11a78703799c02bf200dfeb2d2a
SHA16de91afab2378105397d6bccb2744417ebee5f1e
SHA25689a57be08b8b4e435a7620d3e9157048220c85ad621835a4624292f579f886d4
SHA512acc9bb77b90548ea87cad7add0572f4bc23ba54363aee3a894b38f43881dfd57ceea7f569f37d4aa934f9c37bae695e565848efe7d2222de2b14b3cbe3560037
-
Filesize
344B
MD53eb0baa0b4037728aaf5740572c0273b
SHA186f8dada7277c36f06c99b8a18e41871825f2a3f
SHA2562a03f488220aee5c7ec57378f12db6ea9ec85750cae7fde756a2ccff375a2a76
SHA51249e88b141733246f2c132c20f5265315b4d26c345f0e0e12d4a099c74a64efa86eb2edb0ad4b1d925c52c884603692f405f1f19cef19bbcd040bcc477cc0d53a
-
Filesize
344B
MD5f21a965684ee872e667abf2652f56ec8
SHA173ca6291bf2a37d17a3abdc806c2f2f3a644e311
SHA25611e996f36709f6e73431c751131d5926fa73d5269efd9a27ca81baa3df99cf54
SHA51214c19ffee4bed05512982568e17e3537026666369e5f3c6de47c40008e4031986570f746ce86f5564cbd765eb1c302f4221589a7a40fe3385b46a2731b873de0
-
Filesize
344B
MD593be37057a2cf1701ddca96500f64f05
SHA1e46bd31de07c62a16ad2269216416d6ad2209024
SHA25610152bacbfd81fcc78c4d4ca22847a3401d1ce79c382500e9baf4db8a346ef02
SHA512f6f014027a1a12cfd5b66269e75454f46c9b29025e24a49bcf236b9f7ea303f996da3e92ace74e893a248e807ab684afb78077bedc1713a5cddec3cd6dd24993
-
Filesize
242B
MD500c0c6c2f2fa09e584fe57e27e130fbe
SHA1c543db698035af8978aaf7db1f6eb8ac430a53d9
SHA256abe3a3d54c6941c0bfdfec3fd81e0bf8b1234a5569b11c2b06978f416e8464f8
SHA51205c463c51ef5865e48ec6ab8575999dbe37f2dcfc2a27fccc72ba1bd5ce534a333bf0053df75b62b487604849efe5afead201e1f47156727ffc5bc7304ebee4d
-
Filesize
4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
340KB
MD56bcc066e2a81f34c7e052895001f44c6
SHA16f892ec0287ace1c4c7c86e3945b44de6c9d3ba8
SHA25639a70938288eacf5eab1002150cb06a8299475ad6064fb131aa6e9118c66b4bc
SHA512b11b924dfda23d28019879acbd790778049f4f711134b0003967408b28532544745d12081a9da538f9ecd84f3791b621d3d9c1b4a62699b22d7c56274a1f9f2c
-
Filesize
8KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
8KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
1.5MB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
4KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
