Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
15-06-2024 10:12
General
-
Target
adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe
-
Size
384KB
-
MD5
adef96848ae6e61ed0d3782f6711239b
-
SHA1
581aaca2d5fafadef12a0ad1556d7e149a71da50
-
SHA256
36f910cf4a63afa86b711c14d4aecca3f4887232ba341d7581a0e5baa0fd916c
-
SHA512
4860fe56a5dc55087a8e152d5b4d87f00941721d2ae2787e6e3bc6b79db5df228537d66d2750f95aab6d0ab685c28a51e223141bb3256bc91fc89abb2e4a7d94
-
SSDEEP
6144:FtguKU1XD9oEmWMF6L2IzjAqXuxoaqHwdfOUavNJ3en9THb3IA/OYILI:kuRBoOc4js11GUfVsNJ3entMAWp
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+ghnsc.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/8BF4DD7AEFDE425
http://tes543berda73i48fsdfsd.keratadze.at/8BF4DD7AEFDE425
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/8BF4DD7AEFDE425
http://xlowfznrg4wf7dli.ONION/8BF4DD7AEFDE425
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (409) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 50 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\kfxvghyuernn.exeC:\Windows\kfxvghyuernn.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\kfxvghyuernn.exeC:\Windows\kfxvghyuernn.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1304 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\ADEF96~1.EXE3⤵
- Deletes itself
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD583d4b00a7d9e840fec7e5922f4397742
SHA198abdbac9c88fd5fd2a39a8b30eb3042a6dfc2f7
SHA2565c4f211c3e956f924604d680a5566275cbcae6c28dc98ce89473eb929e5a3d51
SHA51247120d6ca131a8f6ba1f916f507c0368a1148f6c75b84d1c66dea88eae0d241e63ff09e576231298088da1583735aff13f937fe2bccae4dcae5f0ed1df6d50fd
-
Filesize
63KB
MD57840c5af103cd0e572e98fd4344fbb36
SHA195a2a98475d6db3418f1c6e1bbf4bb4adba15253
SHA2566c8287dd0b2f97e05cb2d87d74d1bdcf895feb90a2c0c181b409009c5d911ca8
SHA512d1c858dbcd510f37694d15df7bcf6dba3f2ffa109b7701146ca475d500c974b15ffc21d81ca941713d0ad160f31b952713bc805d004bcc5159fb6578dda9bcf7
-
Filesize
1KB
MD52fb93473defa08b63832e2faab84ddca
SHA1062cf165d2626b03bdeb6d2c370ed9bec5e10caf
SHA256daba76ebfd414a391f5d54ef432c607656ab3af92673c01018036d53a6466b61
SHA512d64ae44b052394f92e776c1e2b178be216cd8637473ebb55a1a487381e2ad9481c71eb63e776b04f0d5ee64f0a5e9fff0205fd87d8e97c518efbf7be2f077329
-
Filesize
11KB
MD5d23b44e4edf6319edeb957e66882cec1
SHA137aa6172d232d19f658e7b7c0e268571bf9fa841
SHA2561fc00300c8a5d32dd69fcfc98fd140c64b1d4622b5502ff2d16bb40f08bffbb5
SHA51235a36f42b13401c9bb98d8ad8d0e0e2d1f25c14c0e2dea0391823903e4fd54bce47b326869ab187df3ed8adb682f64bb84bfc3766e67e44115f317fcf75f1ed3
-
Filesize
109KB
MD563f51ee4229b9476d73a24122f068668
SHA157162ea481d5323b3552fc1641e65f5b0a767f81
SHA2560c08081553f23636739d9e27018fc00f21df356ba19d3b52c83022a826fb0b3e
SHA512761ab7432c520ecb71c0a829382382e0305274cbc7afdd28f30dd932426851f2e4df81fd6320055c77867f8ed56d1116aa9779ac95ab1ac42f0011b61e9ecc9b
-
Filesize
173KB
MD589e2b63afd6a6f5cd3d8c7861f22a7c9
SHA122b10bc6570b821b2b1428f525293406eee1decf
SHA256770e6fbc54251fd7015a1723e8869cfc07278a6b25498dc3f7ba2fdbaa08a390
SHA51292a57718ca1a69210ef572e750b073673b32e5ba1a5af77f16f836885dbb1aa0762b3c957b02143606d8cbce90ae931b0297e458dae0adb184905ef19be0724a
-
Filesize
384KB
MD5adef96848ae6e61ed0d3782f6711239b
SHA1581aaca2d5fafadef12a0ad1556d7e149a71da50
SHA25636f910cf4a63afa86b711c14d4aecca3f4887232ba341d7581a0e5baa0fd916c
SHA5124860fe56a5dc55087a8e152d5b4d87f00941721d2ae2787e6e3bc6b79db5df228537d66d2750f95aab6d0ab685c28a51e223141bb3256bc91fc89abb2e4a7d94
-
Filesize
3.3MB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
