Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
14-06-2024 07:33
General
-
Target
a88a800bcbb2085db77ee1e6169330ef_JaffaCakes118.exe
-
Size
340KB
-
MD5
a88a800bcbb2085db77ee1e6169330ef
-
SHA1
45737b9bbd250a604f2bc066e4f811cecbf29cfd
-
SHA256
d4c33fa5c8029230ac4dcb181ea1899855e6cb3e22d33ceb0b361d014ff98dd5
-
SHA512
cf5bea6231187f5de20e6834799f122a19467d5959b266066599e4e5a9b4641ed8602bc41bca6658cd2f478eaeffa33cff4acfdc6bbf744df387447efb70df75
-
SSDEEP
6144:V/f8fPWz3Tz5denLftACItq4JZzlZ4VnJVF+NVttoxeM4cbtn:V/fCK3TiftYNlkZ8rKeM
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+lxcge.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/EA37A1B0722770DA
http://tes543berda73i48fsdfsd.keratadze.at/EA37A1B0722770DA
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/EA37A1B0722770DA
http://xlowfznrg4wf7dli.ONION/EA37A1B0722770DA
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (416) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 48 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a88a800bcbb2085db77ee1e6169330ef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a88a800bcbb2085db77ee1e6169330ef_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a88a800bcbb2085db77ee1e6169330ef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a88a800bcbb2085db77ee1e6169330ef_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\xswjohhjefsj.exeC:\Windows\xswjohhjefsj.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\xswjohhjefsj.exeC:\Windows\xswjohhjefsj.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\A88A80~1.EXE3⤵
- Deletes itself
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD59fe5e07de55c154fdaa98a09fd52e252
SHA1f4346bba8308a36dface341fd8bb94c7e81ef44b
SHA25626554b627b0b52431fc49b3b9478e4e1d9897512e40f0d2e918a65695af0f3c4
SHA5122af3e3e76920c3506836f01630a9fb72afc7dfacd6d0d7eb047fa33ea89aef8ad1d8a58fb5bd194777b03ad379c7a393ca036c95efed8eedee60376b53632d4a
-
Filesize
62KB
MD538f0abe7ffe016755780e3875cde2796
SHA1aff5e4fe60c075806760fc6c70e448e05baf7c63
SHA25653263d84a8d1b1d39d4e9081ce4267c62d1f155e9a14bdd44459b28d391a4639
SHA5125e634901ae2de36946c7d8c43c1b47e3dac2bc77a798281638c510e3e645f6fe2beaded123d7b444118d034ecef79ddb83b180bb120671f986a36e0057745cec
-
Filesize
1KB
MD529f76abbacaa727c36925c880d55d75d
SHA1254b3b2fabdaf91a8521145e93aca4ed53646396
SHA25608ff06b40719fc40752f94be75997508cf6d7f61a856ef6e8c740a5610d87def
SHA51215e6fa8e0e017fb827dc10ffa1e44b673586ad1a71385f1d544b883834b9840417d2de5b77073f5cd98a413d65d987ba0128695db9cc30be457686e1523faecd
-
Filesize
11KB
MD51b11c43595cae8d4b7e30c5a450f3911
SHA1bc14f19428a12da19d25d20021efd6de7c83f177
SHA256dbf22ffec0f672d9a6e5201aaf84fbfdfe9a37f98d0d7ab2ca0ccbd25776941e
SHA512ab56534bba7b8c0c6bf344cd2cb74ab585381a82cf0917561014e9f957af671689ea7315a569f4d8c27a9f8fc1bf283dc7d5c86f570299306f4dd4e7ceb6eb8d
-
Filesize
109KB
MD59e11c26a998c19babea97e1fd03d1b85
SHA1dc8a9c38b6fbcdd88fcd09d05ee6a0d87f5d6300
SHA256b11dc04871d5d92872c57e8d80d10119e0a52335a41c952c0fc2d3cdc641d1ec
SHA512683098d922fc862a0e0edc943c587187b23080aa7663f565e7d553f889c56151ddd879fdd5607f850eb1951edfd365b3313fbe7a8a7cb62c997983918ada887f
-
Filesize
173KB
MD5437cd8de1642aba965abed830a940e4b
SHA114d4866e81304ee07410ad3f1f81424baed109f1
SHA256b97c3b9949578215d9efbe118c238824fc2462542eab2f228dc1ff645465aad3
SHA512b6f24fabf4dbc0d762eefd8e49923afb06cf7e15c1311e16101da04f530b16eb94e29bb7cb891cef440ea1df3e6491915aea2cd0ec9b566ea93689e5c6404512
-
Filesize
340KB
MD5a88a800bcbb2085db77ee1e6169330ef
SHA145737b9bbd250a604f2bc066e4f811cecbf29cfd
SHA256d4c33fa5c8029230ac4dcb181ea1899855e6cb3e22d33ceb0b361d014ff98dd5
SHA512cf5bea6231187f5de20e6834799f122a19467d5959b266066599e4e5a9b4641ed8602bc41bca6658cd2f478eaeffa33cff4acfdc6bbf744df387447efb70df75
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
8KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
8KB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
