Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
03/06/2024, 13:29
General
-
Target
91f480971a54e41cf899c9bd0d7bb009_JaffaCakes118.exe
-
Size
276KB
-
MD5
91f480971a54e41cf899c9bd0d7bb009
-
SHA1
150d74e9ba69d69dac4064c8966b3f192131d872
-
SHA256
a4754955412700a50ec0778aee21e500c6a0b64a5e82c472f87af87cfc7c9de6
-
SHA512
14f50fb4445f2c5409e434f8ab3166e610485c2d2d87bfb65782b5d81860176529d6aa914ed89f30c5d70ad88e0085d78a0c9aa719507e0960349eda0b115a5f
-
SSDEEP
6144:ML+ROMHXZ99JX2WngMNSYZh1r0CLf2dWsLf2EUOH9:MQ7J9PgMN7LsqEUO
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+fyndr.txt
teslacrypt
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/34556B9214AD24BB
http://gfkuwflbhsjdabnu4nfukerfqwlfwr4rw.ringbalor.com/34556B9214AD24BB
http://oehknf74ohqlfnpq9rhfgcq93g.hateflux.com/34556B9214AD24BB
http://xlowfznrg4wf7dli.ONION/34556B9214AD24BB
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (408) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\91f480971a54e41cf899c9bd0d7bb009_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\91f480971a54e41cf899c9bd0d7bb009_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\91f480971a54e41cf899c9bd0d7bb009_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\91f480971a54e41cf899c9bd0d7bb009_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\egnctpuqixca.exeC:\Windows\egnctpuqixca.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\egnctpuqixca.exeC:\Windows\egnctpuqixca.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_ReCoVeRy_.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\EGNCTP~1.EXE5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\91F480~1.EXE3⤵
- Deletes itself
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD590062bf1d762a09304b4e96ceed55681
SHA1d61037945579d305b8472cf5858d418a4cef176e
SHA25661994d65da56b73f7b5ee88017a53ac965de8936c5d701055c23f5ee6e5fceb0
SHA5120eac54fa10db7a2fe54a97826870e484fadf892b4afb4fa394a1a7689e2f4867917fc157bd42ae7f95bfe94b22b421063558915de0a15e7ce8d22cd3bf6e2e3a
-
Filesize
65KB
MD589275b78d84ea99fa42bee74d00f4711
SHA1040e929e991203ea8461acec3601979fd2c6dfcb
SHA2567b65b59ae65f5c0b08c5424ca4aace0950c76aa00f24a19ee6bfb6b9de7e7d1a
SHA5123322854498e156b870a1bd47f4ed6af47f58602790b99990b723a6231b7e61cc28652b1a316c47ab48c09645d00c2b55dda7a583908a5ed4003bb77051192492
-
Filesize
1KB
MD57f63189653eaf87002c03242329d9050
SHA14e04edbbdc390868c552e9352ceb5b204e4f0f07
SHA25669fc32baa82ef782ca6aa7a7d1d4d58de6b980c948d6391bb40ceb064cf0f92c
SHA512aae949fcddf5e268c3da562059f786c6fc2e1e99d38979c3f2573a7e2d6b42033fc2861a2505c409a3d229a01fc48bc1f9f45142f14b9018a4618b3c8b3283ad
-
Filesize
11KB
MD56674bd046dae9333a9b089e219546ab9
SHA1cbf28add09b98a0f753db2a07366d2bd41ad0875
SHA2564399257eed8d80213ab31f7206bfd7bf17708cb5d9789972f0beb5087c8a8722
SHA51203bf5131912b0b0dfc61a8a7fe997bf06d46db9a6b1af204da448140b058f4fc9d8135c253f11a503a5c608b7ba0cb41eabc9879c69209ce62d43d5a9ac3f1c7
-
Filesize
109KB
MD55df67703ef1cd0630cc23db2227f1685
SHA1d07123f58e7b9e5008e65805c52ca5d6d0ba3178
SHA256632b76277e9d0f88dfe331ab882b5f3445aed939392ebae82575fd497e400d80
SHA5121b2c9c7dfd251dbca588b9740946985ed7d3e94068b51c84366c2b638dc36a19abcad203d097df75c79079a9057f600cfc313d2c1b2c9c3cb89cc9818dc617e2
-
Filesize
173KB
MD5f310c7c7380c2db07c553c8d59d49b46
SHA12ac64109644b5437691dc8094f723701cd316767
SHA25638cd977dc173793ce4ad6011158dc2b50d37592ff5f3dc0bd72a2816d2cce008
SHA5124aba9e933997ef47db184aa229fa7b7049ee37ef19d64140907eeff7caa70d5726f7c9971107c6132593ee7474ba84c7fe12cd5bbe50cfca2688a832fa5bebde
-
Filesize
342B
MD532cada3564b5c3bcb00b1e38cae7d8d4
SHA1b1172e46321600919f13fcb7c4b128d88ffcd725
SHA25690ad35e2e87f626da363bec4eb6f9b42c807f4def8096736747ce80873a7204f
SHA5122c1632a63349e774c8662cf06aff39a0181e5467bae4085a7a5d4c26e82a8c5f2fe38045c95abfbc248705c4000b3eb9257b62a6f2d6176cb88e9ed4c736f125
-
Filesize
342B
MD5f1d58c990d09fe13598fd137a46c6f45
SHA1a559965a1083bf9e809a131635c855f87c8b83f7
SHA25648040f8a9946b078d6d59b32271e2cf2d4a731be11ac44f94943c72924eb7cdc
SHA5120df72ebcb62be63e16bb8f928f7d2508439346e711db0dc0043fa24e468e969dd52bfa81e5fadb3dbd806b3666707216270c89f1a80a8bcb6012b8e9a04b500a
-
Filesize
342B
MD554f07f914147eb8b4b4c99ac0bd92c21
SHA17fd28fc08c11b504ebb04d7179ec8f3ae6bdde0c
SHA256d71a66a2341316fc45b907ca4b88c1e5a17553310bd193e237930cdd999996d1
SHA512059cd7b71574fcf7b55ebb9920c37d3907cb78f3896b9d11fc1b32cef3ac1d43b362df572c956629e744603d84cf361173718098cf56a3ecbd2ac1e907628a80
-
Filesize
342B
MD50d51411107b4e6ae55bfa83cafd09d7f
SHA14ee2a0ef08983d798f38589c2e101335b95b8ecc
SHA2569892b8a91c28e5356d669ff811e11631112c1b9ec1881e16eebc6793cce6b776
SHA51235369182cfb5f02e184dcb5825c168d1a6127ca86c3305c6408ef4269f66510cd5e5f62f4bce6f6a5eb67469108d0ee3aaa582ee4926b926c690e7115a2e458e
-
Filesize
342B
MD5f150225881352eddbd90d18b83a658dd
SHA18eb90bcb0c3c3c4b6fb30287946d03553de5bac0
SHA256f5934bfc45a3e8966791226404f8f371c38fd20165873cd66543d552af364385
SHA512a19b66c4e2a056b5b3c2035cdd218a6fa1927647dbbd51ab90ecd026d18455caa8629239473f25311271cd542bf7e5d1aa61919c87c74e3bd28e7159aab83e84
-
Filesize
342B
MD5263e09966c7b5dfa579fe4fe844b89c0
SHA16fde3ccc2174c0653a7d25e0e454ce8f4e69ffe6
SHA256c5315d36cc1c327eaea6bce298ee4438579ff02dd1fdbb14566352657c597a78
SHA512f07672ab064248fabd5324b1b9718927ef2caa59427169aa1e7ee22aee145ed8ea8b5c12937ed965418622cc9efe8e546eb747033a07ccf818d7b453af87fce3
-
Filesize
342B
MD50b66862ad6e30061b8c144a151363f86
SHA1dbecc0997f00a86ffe292956ca35b663c4b72ef2
SHA256fb2fcdeece5f0cd33cb2db65b94cd053802e4a1ba2dce30491aad2a850f7932a
SHA512cdf678f54cfd8f8ca9f66c5b9d61dc6e9381dfe71dfd63a26ee6a0b439d0046a1a1445612eb684bc9f93a66cb3bd0b2e2fddfcd266d1ba271605e8d99c08cc8c
-
Filesize
342B
MD573e7fadb6ce3bc3fbe8f04a31a3cad94
SHA1b36e4d3e371fdfad47017e1fccea27585e907dff
SHA25606a4a1d8badf80f9ffce0fc1ff225a6ab8c041d2cec11a8781b58fde2e1386b4
SHA5120e1d9e1be8efd99332b1cdd9a80ab38d17717844cf12dd6fef096119ee25bb21f6fe9fe986d96510e3063c6c9b050e4be86d2a9f97855551025f5d34a28b0a09
-
Filesize
342B
MD5d74c6a51e3689e5ed06ce064c740c90d
SHA15ee5123a376dc1100633c2b28e2ba1c3ac286c1f
SHA256a2ca4d61ae8370028179b08491937fa7cdee497bf7c81c9743c40dd033916ebe
SHA512e49d1539f50fd4f33553ac08095129f4be343dd6444c44e7d42c2920dee7042750a864a644a13582765d7846227199d4bde374c06dfac5acd1c0ef0244b76fb6
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
276KB
MD591f480971a54e41cf899c9bd0d7bb009
SHA1150d74e9ba69d69dac4064c8966b3f192131d872
SHA256a4754955412700a50ec0778aee21e500c6a0b64a5e82c472f87af87cfc7c9de6
SHA51214f50fb4445f2c5409e434f8ab3166e610485c2d2d87bfb65782b5d81860176529d6aa914ed89f30c5d70ad88e0085d78a0c9aa719507e0960349eda0b115a5f
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
8KB
-
Filesize
812KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
