Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
13-06-2024 01:35
General
-
Target
a362450bd0ca83110c1509f09497f76c_JaffaCakes118.exe
-
Size
347KB
-
MD5
a362450bd0ca83110c1509f09497f76c
-
SHA1
6d417bccb8e80cceac70be15040e82a0a3471b82
-
SHA256
fb8faabbb27afe1fcae20d8d1d10896d484c42bc7bd714bf5ed4fb783945f0fa
-
SHA512
c3cc44e6f6ba42fb97c1c7b313f1f273306c2d600e59388a8830fee4eec6c3dd1844a2a353a33157726a75ccc5b18975a7ba76c78f519adfc0f059c7f74e6c05
-
SSDEEP
6144:Zul3JU9DhrPjzXZxOMhb2ZLWc4pPLJahf5WbQlFIJ8WDamSETrNVD2Og0z2Wov:ZulEhriMYZLWcKPVa5UO6J8Wum9TrX2h
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECoVERY_+pvcae.txt
teslacrypt
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/64DC63C0248CEA55
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/64DC63C0248CEA55
http://yyre45dbvn2nhbefbmh.begumvelic.at/64DC63C0248CEA55
http://xlowfznrg4wf7dli.ONION/64DC63C0248CEA55
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (389) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a362450bd0ca83110c1509f09497f76c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a362450bd0ca83110c1509f09497f76c_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\lvvmahpwewsm.exeC:\Windows\lvvmahpwewsm.exe2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\LVVMAH~1.EXE3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\A36245~1.EXE2⤵
- Deletes itself
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5780334e656e662bee13f1d747a39e604
SHA1f40324bbaed15a2ec0b3cfd190d9eaf34a7741b5
SHA2563aa3719d71b99aae9ff662aef3d9da73d6cc699eaabb5677ef71ea680abf493c
SHA51238463089433c4ca6c7c2b7d71f6d23423a57f42c32e3e1289e0eb2323d714e8d6973bb1eea3f2bb00fa0570cc5004db92d4f240ef2a7c65b7fdaf0369cca78ed
-
Filesize
65KB
MD5787b23da7b84b92342af8367b9a656b9
SHA13e5904a0e82d09d003fdd50d398792974771ff90
SHA256111242744ff8bd61e7e194cebd8ad2e8a3260212b6759df5d0bb91311ca87ee5
SHA512d1f75b12faae6c0acbd88300a6662dd7edfb2cfca2f029597a0a51b8e2f6adc168473b17777fb9974c8c822d1c66b13a380a2d8cd53cfa23a9a40e7660eae86d
-
Filesize
1KB
MD5081821d2da29263aa1db0033efa726ff
SHA1c4ef78e1981961357d7055d82071f017aed0666d
SHA256d29af3b492af3a2cb711ad8c59f69c3fb176cfbdbc65f45c413f7bb19e224f17
SHA512f65657ece984c0b1bc526a3717d447d9f09487123e6267e24973e4b9182e60c59a2ff8559f7f790937895710dd29507a2a4ad0bbe1d49e114b3123dc3eee34ed
-
Filesize
11KB
MD58eb195721c1217e93d5291a77bfb4d97
SHA1599f40b2dcd7f7faf907017fe9a8e7de2acc2c94
SHA2563bd520e69f79329061e405edfc72fcd62e4a7680c58b1f64b638c7fa3d202e76
SHA512181daefe2ab00fa561e9188ef9ca0825a8158f0034a18d6d946ecd2d27fcc13bc6ecf64700e8ef4663844f0811d0589870760bb9eaea141f53c6b58dfaa8bfe1
-
Filesize
109KB
MD549b0b695ecf218735d74ca4d50cdb8be
SHA1001aae33172e1e3e55f04612ba1aca3a0af5db04
SHA256d8dd09e02140d34eacaf4d673129eef890ec4f1f6c460d541a7f84e7f232e748
SHA5121e04dbd471370dfc91422d4a754a7c89b0cd89d02ecb92393f5dd92e8b2312f8ddd618a8f491420c994f8b4aa25514f238a154f3a859dfecfbd2356c2d92e694
-
Filesize
173KB
MD51282da44fcce5703515b75ac930d5632
SHA1ac34d2b8ae0c00be8daf69fba8734b55cfefc942
SHA25684aa937fc53beb3a3f408a82937dddafd15a55f7b443a8595152b1b2fa7b8cdd
SHA5121fe25fbc77d383bff13daf617884b402301349781f8fa97380b08c522fce72bf25922c0e0feccbe0f5d31e6072623aa544dfd26e6f607ca2d92e6d4306951246
-
Filesize
342B
MD5ae72b3094c0b87e7cf6d75290797ca0f
SHA1706aed1e2241840722cd48e422385a97db7c3474
SHA25660c96cf2fabe689c9968feb0dfd9463d15bec9f3b4d6182f81905a98817dd0af
SHA512bcc45f6350cc064904f013ec296ba1687b30f4fd8d7e0c25bde1638cc08bf27c2a07278aafb81ac8a295c0fc3486ad24518e6f014d2f9c4682d7e942ca852450
-
Filesize
342B
MD5c9f0cf2b09eb99d0da4b24e5314f4807
SHA136bd97bae1c0e29510785c806382c40b01c79470
SHA256773ed25ec6b06063b8a2e3f80b9e5d728d06a1636c059c28b84cb0b1d0480345
SHA5126e92fb81c0b895a6a6f93443f0666f574778e6f8af6c192e9f705ca72b925b1ba7d0b2129ef208f8663ae7b6cf101b8fe815564e6e62dbb906c049362a7b29b5
-
Filesize
342B
MD50f216ba3359c47cba1b169ca7a001852
SHA18ed04a0afd5cccc82da9caf4e026e6452a5fe480
SHA2566adf85c41862a0544f7e8c2d3bd73c9b354abb066f3f642173e67abc0049fe60
SHA5122dee7970295d9768351751466c0c495eeefb55ec5d38c4caa78c62c0f21af0c96c676670d82831a29f57bfb25b781ebe9fbc8dd32778bb4e35e2441d210ec26f
-
Filesize
342B
MD53a002b4558a00cad87edb19d95d6e1ef
SHA13499bc09a4bfcc637f6f37cc852c7684b8e31c38
SHA256d0183ebda3a01d03f89818ccd768049f5ddef0ad281d6f962e25f8926922b120
SHA51270f17d85bca2ba4d1ad2eaf086a3237ecafd514936f2c42324b5a4d693d96bf98d807762f24e2a3c56adc34aca0b3d595cbfe768e1497ee094284a9f2ae15b2d
-
Filesize
342B
MD56dc08b2234436908b23dfc59ac1faf62
SHA1725f5105d4a3c954fbbcfab2d8091f3584b1034d
SHA2561af4515d38620451d2ee8ecd7bc915c1a7112f5646eedc45e5c1650e7ae55b95
SHA512c03b4d99f0d69664344062dd42190e6a4980a6496d2f3de7fc055f9b82fe2740003bb00a9caa056b60ada00e2e40d8ad1f39bd07bb8a96d1c4171adb0231a506
-
Filesize
342B
MD5bb5f482517d58bfd318400a89bd29266
SHA1285aa37777a8597efb0be3a7e4522e9ef06dc12c
SHA2561994ed409995f600561a2fc5afdfcc7974d6d60c770c384f085ba4c92be89d63
SHA512a807baff8486f97faa56a22cab1def7defd868fbefb869d360408e23aa7372a18cabd5104e7a97c2d56fbebd03d9fbe6b4f97c7e612314784932cbbbb337cc2f
-
Filesize
342B
MD5a6afb53ab6cee21bfa23fa14c369b975
SHA1ebdc5846c949aac589049dbc8ec99a0a542f2703
SHA25622fe180ce37e7e983bed602f51cc107e28a7d8112d90dc5b68dcfab5f2dad232
SHA51225f5e50111b20878d7ee51176c386083f456f28859d27648f9e3dda54c545a82230d9878fcb27e24f4c02a3337b7fc2adbd86445c1ef02ff6426de3c22c01887
-
Filesize
342B
MD5bd1cc0d110504f5c98f48b5423a72068
SHA1f01b08723545a52beda2d9a4ed920f1d766d5548
SHA25687850383471dd40c990028dabc236484c31df967241a4065cbd984bbce05ef78
SHA5123c4a9f1b648a019237931646122cf6e11d60ec78a79f944ed1f611b8f05acfb50696992253e9292231aa75e90170fc9f3f4b612551efe002737d55d527a13786
-
Filesize
342B
MD50b8da555c8e9bde5b899dd61843c96f1
SHA127755fe016e41629f636949fa654ccda065591d8
SHA256d4937946f3c9951f45807b807df60f40e169a45cba0780ce4bab8482f7437564
SHA512dbccd456d69cebb74bea7486df5a9b9dcfec789d0c8c96c9ec469133268f6e2943ceba089c57c52b202d04ee0ef8be50e1921255ef0c11670951f4813ff56928
-
Filesize
342B
MD5c97b5e13a46ca1ee4c6d7349b38b116b
SHA19b67b7b4eca1fa34a62c1b315385751e6e506b36
SHA256090b55458354d012db751dc337c9ee543324fb28b80c31cf6e11a989df0aaa49
SHA51296d3833c51a7a1caf384c4604dc7ac0f5d9c883ef957c9c53f07def8c8e01eb172bd5f60af2969d17ef6201f541387e00906b93081a5e725521b0095c958a9b5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
347KB
MD5a362450bd0ca83110c1509f09497f76c
SHA16d417bccb8e80cceac70be15040e82a0a3471b82
SHA256fb8faabbb27afe1fcae20d8d1d10896d484c42bc7bd714bf5ed4fb783945f0fa
SHA512c3cc44e6f6ba42fb97c1c7b313f1f273306c2d600e59388a8830fee4eec6c3dd1844a2a353a33157726a75ccc5b18975a7ba76c78f519adfc0f059c7f74e6c05
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
188KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
8KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
