Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
05-06-2024 00:30
General
-
Target
96c53da97c6cf0c79d278f0f69609ed6_JaffaCakes118.exe
-
Size
356KB
-
MD5
96c53da97c6cf0c79d278f0f69609ed6
-
SHA1
c57ae0b44b2feea3e4722c672e4d2c20aaa4d2de
-
SHA256
c1f58f6b35fba846df52983a880afa4aea441e19b446c753eff7da1a942c09ca
-
SHA512
08e04cecef4b1e4d6fc710115c1065de2d0e4ff358046ac5d00920a66814905af51f5859e4dbe92a7d2744fba092cb4addb96f349caaf608177de1766330bf44
-
SSDEEP
6144:rnuEzhHd/Opk3p1JWsjCLmwRHbN4mjc5SWH6NJBZwb9:rth9NJWsjDwR7NvjcSdNJBZw
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECoVERY_+runwx.txt
teslacrypt
http://yyre45dbvn2nhbefbmh.begumvelic.at/6BD7F62D35A8F850
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/6BD7F62D35A8F850
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/6BD7F62D35A8F850
http://xlowfznrg4wf7dli.ONION/6BD7F62D35A8F850
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (373) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 32 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\96c53da97c6cf0c79d278f0f69609ed6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\96c53da97c6cf0c79d278f0f69609ed6_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\qsyjejblvono.exeC:\Windows\qsyjejblvono.exe2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\QSYJEJ~1.EXE3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\96C53D~1.EXE2⤵
- Deletes itself
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD541b0a1bfdb23901708e4b1bd71faa7c2
SHA12c8d1dcd9c2d5470a0210cabf4bf35d9da054c7d
SHA2566aa5cea77f4cd85d91e609cdd45ebab37b3754feb8645d9f5b0035741fbceed3
SHA512684b59ba9b2fa7e48eeb999f1c24bbac7e3fdf4ba63f583fe8c42d4d882fef95535ab140f88484050c8d7922b31b6af6f071e627c564369e23c602be3fcf39b7
-
Filesize
64KB
MD5c33f305cbecc3a44eb067c2a9e002b51
SHA1435285ccb5052f62109b6ae3c01905481d81e616
SHA2565fa5243157be6ac4a732663d6c93706786b01d76f035f274aebab300553e00cb
SHA5127f65c5bf2df05c3e024fd5712f92db95f8c63ddd1d6a6a3a08b77f6e28452b9633c7b54c61d60a006af3c3024138ed408f1c29c77163c4ea20f7f13a54c3bd22
-
Filesize
1KB
MD5d12a2a3d7f099748274a3eff786f1e57
SHA1873720396d3c5303683aacd12135827ef33471c6
SHA2564c2304ee1b708f258c2705ae91ff5881ac2e93a60314d4b67107f6622fb7053f
SHA512d0eab52a46dbea59bee91f2822f087d038800dd7aeed7ad32f690144df3ab18e16e98ae35e9d1111a7a11e5fcffbcf8f6953345dd9a87a20d36ac56d1f9a339f
-
Filesize
11KB
MD5cbaccae0e5b482bc91286c3da33959af
SHA1d48e3d32604847ac51af8da1bfd6f251a71e6aff
SHA2567c5addc28808251e62710df0380f0296811bd9bbd779bee68aec7767adeb874d
SHA512dfa8fc4727b67c63eff7abd4b78a7d000d97fc337e08d791f42f0812455ffc72ed6f571128a3f1e96f99ad3804ec12e2123e2b774680ab4ecdb247de05cb9f3d
-
Filesize
109KB
MD5bed7dd53f4bff0ec9c97099ff29bc3ea
SHA197b36d17ef8f37cb60317ce6463fdd9c493e199f
SHA2565186ccd05dfc05304df088a1f09e393e14fd25c42f40b95296d5b556ed1cb322
SHA512b7696f55b7ebad35eedc096f186aef8c9ff3a9fb661a048d9760ce7ea31bedcfe938220400b6993addeecf8b9b24d4f71479259d65632dd1c54249e9952ba9a7
-
Filesize
173KB
MD534377dbe0c32c79261933ec979754450
SHA1ef9d51afb926afbe1afc7f5f562da980defb7037
SHA256701ba9ceecc024e79a54fe4fed14afc36a8fe9446e5ec8cdd606738f430fe7ae
SHA512a2b32e7b9ab8a5d3b2a2836d120c269ec6a3877e6dd7844a62c27d155a9724bfb267f3c546937bbb428c5a70a26ef7c36a6f59e49bd29554c17173e354c26e6e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
342B
MD5c7824bfaecad0a5fb3af86ed4d321110
SHA183562c3acabef96070c07c88c7db9559e58b75cc
SHA25667f9fb6f3b5d437b8dfb51130a9f0057d9eda69d201fc516af65b10a030fb80e
SHA512a137e5ade810de1014d62c73b7bfc7b40f7bb133fd9e323115292be235744cdde44a543f304fb430a567d7a03585bd8ffe02e9fec17ec41efe0e0b1b845cb198
-
Filesize
342B
MD56676ece72c6b5b2470500f431cd9f79e
SHA17f062ff3a1cb6e21506510e6f7b4e47d51893419
SHA256865500139ed87178bcf19d9ad0941d0761dc2674c3849921f0ed2f999a75395a
SHA5121b7e94b1284b2004902307364fc643ea8cd8ee56a4b9243e30d32ab9eaac8517cb47a9e05d743cd3a26e767a2c5ab5feff4d900283bab1a8fb6ac5391b101868
-
Filesize
342B
MD5a54bd2b1653ac24dbb8f91c5ff2239d5
SHA11405bfa549a3c19ae4a14ec286d5f6a8d5e73585
SHA256d1753a813d7d9e86be2e44a3239dc0761e847798343c38444394594b7a5a00fe
SHA512423852e96a27c4ad4855396dd2e89a142fcff05404f9d1c47db1d0f546bcbbc9bcca64160e046ecbd9a3b53130ef3cb921feacc34b62a077b7afa2dc32effb48
-
Filesize
342B
MD5af76d083bcb757936c9ec81b9431c242
SHA1f2d0ac3883cdc4dde3604e6d9b9ed78f3ea01d07
SHA256f8df8fd4e9158288ecf01a7d659cffa238aa845383c74f2c5aa33e69de13f2d2
SHA512f817eafcc64bc2e9817d5245a5b6daeb5a4868adeb0778e4a01d80ba762af6576a21cee5d1c30d843104f8bebdcb6cb94c38859687a137284f425e01d724a347
-
Filesize
342B
MD57b96ee3fb4285d0478297b9c8329412f
SHA16863bd2e0cdc7e2c19cc5ba6445edc37f51c61c6
SHA2569ec0f857c455128ec49b5cd497d7598370a80cfd0acd7576da3e1cf2bb882c2f
SHA51288ec512aac18761af60a7924b96d40d1b899c31f1d4149ca4d06aecd2c14690212c0b5f2dc2ca3d41e082d203d2a543d574a8358e0a64aabac9c36d9893f361c
-
Filesize
342B
MD53ebb9e061d5b52c5be52b1d249e1a9d0
SHA13a26234cf205f572ae0b9e42e1be5db7e3e22161
SHA2560804d46d0176f0d4e0cdc42575bcba570952dc04d405d7838cab4bdca5bbd516
SHA51213e5e421076d0c4f14fbe1c9874fb0cf769a91870e4aad3e82ceda0115d7269e32f49bcece8d819f988e1d0d3ab48b239970301ab00fc706c17064974d03a76c
-
Filesize
342B
MD5972db55db9f773db84e2198e97a6edd5
SHA1b2814879035c7ae54e13477601655959bb0f9397
SHA256f8417a757490f0bf0098bb55d554e3e29916c67117346f354f7e2e3e09d12de9
SHA512467c5a02e7e03bf1874ba1dc97c091a394d584b06b441545e389e1fd89ddd2f3aca4fb66cd62fdecfdaa8433dd813df2d0e4d5e7eb6e7865fa3b88e428952ed2
-
Filesize
342B
MD5aa3c7228d5e23c04da34844273880c7e
SHA1b9bcf312f6d3a9f017cf0a1fdd4a2f82a5b960f1
SHA256065d2a483d1e3b34826a71306ae9d7601e463c50dd56c012e516084edb522d77
SHA512ea13d514f05824c8d18c282fba79eb93a952134f29f62880ab6c0556d6b25a59c602527430c0dbc95d4c722810df5ad2c523f42af6c331a67b7e4188ffdd382e
-
Filesize
342B
MD509df5fcd5a73b899312aea4a27b2e55f
SHA1fe1d343faf0251d8559a0be5616c4a0178c95073
SHA256d5358a43ab7f5e79920cfaf02b7b88b8195bd432d56373f7fc7716cee4973e41
SHA512a9965d31c9828443e3f97e1c4d3fcfa07ea0af24ee4335b676d9886205f987d79889fef382caeb333ea4acfba9e175f2de654d790a4dd0431aba39a5e44d02fc
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
356KB
MD596c53da97c6cf0c79d278f0f69609ed6
SHA1c57ae0b44b2feea3e4722c672e4d2c20aaa4d2de
SHA256c1f58f6b35fba846df52983a880afa4aea441e19b446c753eff7da1a942c09ca
SHA51208e04cecef4b1e4d6fc710115c1065de2d0e4ff358046ac5d00920a66814905af51f5859e4dbe92a7d2744fba092cb4addb96f349caaf608177de1766330bf44
-
Filesize
536KB
-
Filesize
628KB
-
Filesize
536KB
-
Filesize
628KB
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
536KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
8KB
