teslacrypt | 8dee4f6bc8513c5e9b387ea11183bb2964c2e73f7dc7a430060aaa0d4ae9b99e

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

019aae6df470cddcd82534e57037341b_JaffaCakes118.exe
Size

328KB
MD5

019aae6df470cddcd82534e57037341b
SHA1

3dff4a6faad3325c7600834d1a7c2c362887865b
SHA256

8dee4f6bc8513c5e9b387ea11183bb2964c2e73f7dc7a430060aaa0d4ae9b99e
SHA512

09d5c811227228a059c5ef989486b0c30ff8f51f786db1330f8e950cdcd1e608f276ea17d055ef3ceaf44d22f3f28d025e6a0312306b83dc8211232af8378d5a
SSDEEP

6144:aCHhOk2vb0Lv1Azgm4mxTg4OT/zNBv8wxvYfLQplE6R471K:aCBONvb075m4aM4OT77VlYDQplE6ip

Score

10^/10

teslacrypt defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+auoei.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/54E925E43B7BEF5 2. http://tes543berda73i48fsdfsd.keratadze.at/54E925E43B7BEF5 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/54E925E43B7BEF5 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/54E925E43B7BEF5 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/54E925E43B7BEF5 http://tes543berda73i48fsdfsd.keratadze.at/54E925E43B7BEF5 http://tt54rfdjhb34rfbnknaerg.milerteddy.com/54E925E43B7BEF5 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/54E925E43B7BEF5

URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/54E925E43B7BEF5

http://tes543berda73i48fsdfsd.keratadze.at/54E925E43B7BEF5

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/54E925E43B7BEF5

http://xlowfznrg4wf7dli.ONION/54E925E43B7BEF5

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (421) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2548 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

wwixtlysiqxd.exewwixtlysiqxd.exe

pid process

2684 wwixtlysiqxd.exe
2340 wwixtlysiqxd.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

pid	process
2548	cmd.exe

pid	process
2684	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

wwixtlysiqxd.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\jlqpmfrmgifb = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\wwixtlysiqxd.exe\""	wwixtlysiqxd.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 2 IoCs

Processes:

019aae6df470cddcd82534e57037341b_JaffaCakes118.exewwixtlysiqxd.exe

description	pid	process	target process
PID 2108 set thread context of 2732	2108	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe
PID 2684 set thread context of 2340	2684	wwixtlysiqxd.exe	wwixtlysiqxd.exe

Drops file in Program Files directory 64 IoCs

Processes:

wwixtlysiqxd.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\_RECOVERY_+auoei.txt	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\corner.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_down.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\_RECOVERY_+auoei.html	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Google\_RECOVERY_+auoei.html	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Java\jre7\_RECOVERY_+auoei.txt	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg_sml.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\_RECOVERY_+auoei.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca\_RECOVERY_+auoei.txt	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_h.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\2.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Journal\Templates\_RECOVERY_+auoei.html	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_top_right.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\_RECOVERY_+auoei.html	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\_RECOVERY_+auoei.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\_RECOVERY_+auoei.html	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Journal\ja-JP\_RECOVERY_+auoei.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\de-DE\_RECOVERY_+auoei.txt	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\logo.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\_RECOVERY_+auoei.txt	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\6.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\_RECOVERY_+auoei.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\_RECOVERY_+auoei.html	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\_RECOVERY_+auoei.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mr\_RECOVERY_+auoei.txt	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\back_lrg.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\_RECOVERY_+auoei.txt	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\_RECOVERY_+auoei.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\fr-FR\_RECOVERY_+auoei.txt	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\es-ES\_RECOVERY_+auoei.txt	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\_RECOVERY_+auoei.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\localizedStrings.js	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\settings.js	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\_RECOVERY_+auoei.html	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\_RECOVERY_+auoei.html	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\_RECOVERY_+auoei.txt	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\8.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\_RECOVERY_+auoei.html	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\de-DE\_RECOVERY_+auoei.txt	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\highDpiImageSwap.js	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\localizedSettings.css	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\_RECOVERY_+auoei.txt	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\curl.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\_RECOVERY_+auoei.txt	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\_RECOVERY_+auoei.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\en-US\_RECOVERY_+auoei.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\_RECOVERY_+auoei.html	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\_RECOVERY_+auoei.html	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\brx\_RECOVERY_+auoei.txt	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\_RECOVERY_+auoei.txt	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\_RECOVERY_+auoei.html	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sw\_RECOVERY_+auoei.txt	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\_RECOVERY_+auoei.txt	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css	wwixtlysiqxd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\_RECOVERY_+auoei.html	wwixtlysiqxd.exe

Drops file in Windows directory 2 IoCs

Processes:

019aae6df470cddcd82534e57037341b_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\wwixtlysiqxd.exe	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe
File opened for modification	C:\Windows\wwixtlysiqxd.exe	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

019aae6df470cddcd82534e57037341b_JaffaCakes118.exe019aae6df470cddcd82534e57037341b_JaffaCakes118.exewwixtlysiqxd.execmd.exewwixtlysiqxd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wwixtlysiqxd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wwixtlysiqxd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

wwixtlysiqxd.exe

pid	process
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe
2340	wwixtlysiqxd.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

Processes:

019aae6df470cddcd82534e57037341b_JaffaCakes118.exewwixtlysiqxd.exeWMIC.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2732	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe
Token: SeDebugPrivilege	2340	wwixtlysiqxd.exe
Token: SeIncreaseQuotaPrivilege	2612	WMIC.exe
Token: SeSecurityPrivilege	2612	WMIC.exe
Token: SeTakeOwnershipPrivilege	2612	WMIC.exe
Token: SeLoadDriverPrivilege	2612	WMIC.exe
Token: SeSystemProfilePrivilege	2612	WMIC.exe
Token: SeSystemtimePrivilege	2612	WMIC.exe
Token: SeProfSingleProcessPrivilege	2612	WMIC.exe
Token: SeIncBasePriorityPrivilege	2612	WMIC.exe
Token: SeCreatePagefilePrivilege	2612	WMIC.exe
Token: SeBackupPrivilege	2612	WMIC.exe
Token: SeRestorePrivilege	2612	WMIC.exe
Token: SeShutdownPrivilege	2612	WMIC.exe
Token: SeDebugPrivilege	2612	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2612	WMIC.exe
Token: SeRemoteShutdownPrivilege	2612	WMIC.exe
Token: SeUndockPrivilege	2612	WMIC.exe
Token: SeManageVolumePrivilege	2612	WMIC.exe
Token: 33	2612	WMIC.exe
Token: 34	2612	WMIC.exe
Token: 35	2612	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2612	WMIC.exe
Token: SeSecurityPrivilege	2612	WMIC.exe
Token: SeTakeOwnershipPrivilege	2612	WMIC.exe
Token: SeLoadDriverPrivilege	2612	WMIC.exe
Token: SeSystemProfilePrivilege	2612	WMIC.exe
Token: SeSystemtimePrivilege	2612	WMIC.exe
Token: SeProfSingleProcessPrivilege	2612	WMIC.exe
Token: SeIncBasePriorityPrivilege	2612	WMIC.exe
Token: SeCreatePagefilePrivilege	2612	WMIC.exe
Token: SeBackupPrivilege	2612	WMIC.exe
Token: SeRestorePrivilege	2612	WMIC.exe
Token: SeShutdownPrivilege	2612	WMIC.exe
Token: SeDebugPrivilege	2612	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2612	WMIC.exe
Token: SeRemoteShutdownPrivilege	2612	WMIC.exe
Token: SeUndockPrivilege	2612	WMIC.exe
Token: SeManageVolumePrivilege	2612	WMIC.exe
Token: 33	2612	WMIC.exe
Token: 34	2612	WMIC.exe
Token: 35	2612	WMIC.exe
Token: SeBackupPrivilege	3056	vssvc.exe
Token: SeRestorePrivilege	3056	vssvc.exe
Token: SeAuditPrivilege	3056	vssvc.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

019aae6df470cddcd82534e57037341b_JaffaCakes118.exe019aae6df470cddcd82534e57037341b_JaffaCakes118.exewwixtlysiqxd.exewwixtlysiqxd.exe

description	pid	process	target process
PID 2108 wrote to memory of 2732	2108	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe
PID 2108 wrote to memory of 2732	2108	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe
PID 2108 wrote to memory of 2732	2108	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe
PID 2108 wrote to memory of 2732	2108	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe
PID 2108 wrote to memory of 2732	2108	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe
PID 2108 wrote to memory of 2732	2108	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe
PID 2108 wrote to memory of 2732	2108	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe
PID 2108 wrote to memory of 2732	2108	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe
PID 2108 wrote to memory of 2732	2108	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe
PID 2108 wrote to memory of 2732	2108	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe
PID 2732 wrote to memory of 2684	2732	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe	wwixtlysiqxd.exe
PID 2732 wrote to memory of 2684	2732	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe	wwixtlysiqxd.exe
PID 2732 wrote to memory of 2684	2732	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe	wwixtlysiqxd.exe
PID 2732 wrote to memory of 2684	2732	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe	wwixtlysiqxd.exe
PID 2732 wrote to memory of 2548	2732	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe	cmd.exe
PID 2732 wrote to memory of 2548	2732	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe	cmd.exe
PID 2732 wrote to memory of 2548	2732	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe	cmd.exe
PID 2732 wrote to memory of 2548	2732	019aae6df470cddcd82534e57037341b_JaffaCakes118.exe	cmd.exe
PID 2684 wrote to memory of 2340	2684	wwixtlysiqxd.exe	wwixtlysiqxd.exe
PID 2684 wrote to memory of 2340	2684	wwixtlysiqxd.exe	wwixtlysiqxd.exe
PID 2684 wrote to memory of 2340	2684	wwixtlysiqxd.exe	wwixtlysiqxd.exe
PID 2684 wrote to memory of 2340	2684	wwixtlysiqxd.exe	wwixtlysiqxd.exe
PID 2684 wrote to memory of 2340	2684	wwixtlysiqxd.exe	wwixtlysiqxd.exe
PID 2684 wrote to memory of 2340	2684	wwixtlysiqxd.exe	wwixtlysiqxd.exe
PID 2684 wrote to memory of 2340	2684	wwixtlysiqxd.exe	wwixtlysiqxd.exe
PID 2684 wrote to memory of 2340	2684	wwixtlysiqxd.exe	wwixtlysiqxd.exe
PID 2684 wrote to memory of 2340	2684	wwixtlysiqxd.exe	wwixtlysiqxd.exe
PID 2684 wrote to memory of 2340	2684	wwixtlysiqxd.exe	wwixtlysiqxd.exe
PID 2340 wrote to memory of 2612	2340	wwixtlysiqxd.exe	WMIC.exe
PID 2340 wrote to memory of 2612	2340	wwixtlysiqxd.exe	WMIC.exe
PID 2340 wrote to memory of 2612	2340	wwixtlysiqxd.exe	WMIC.exe
PID 2340 wrote to memory of 2612	2340	wwixtlysiqxd.exe	WMIC.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

wwixtlysiqxd.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	wwixtlysiqxd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	wwixtlysiqxd.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\019aae6df470cddcd82534e57037341b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\019aae6df470cddcd82534e57037341b_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Users\Admin\AppData\Local\Temp\019aae6df470cddcd82534e57037341b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\019aae6df470cddcd82534e57037341b_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\wwixtlysiqxd.exe
    C:\Windows\wwixtlysiqxd.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Windows\wwixtlysiqxd.exe
      C:\Windows\wwixtlysiqxd.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2340
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2612
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\019AAE~1.EXE
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:2548

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+auoei.html

Filesize
11KB

MD5
836245b97c0ae1763d134268c96089f1

SHA1
b73ba278c4e558c50a8f8f7506daff619c93ed33

SHA256
773cf4b62a43b3516fe56248c0c759fa07d3962e286d692ab1aa1ce84ce0446a

SHA512
a6aa18c0037be129bdef2702edb7defe8cb1abd3dfb98a4f29eed78d2eb1d94ba9c59687fbef654b20194e3c7609f8b900db4c6e99cc8d4d5ca26ccb35f5fef4

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+auoei.png

Filesize
61KB

MD5
e37f41b8e01f9fcd0942e7418184644d

SHA1
df4093c080b52bfd17cdb8f75d7d0257355b532a

SHA256
587483f2209f0cdd2053f7213b171601694bdc2d4a4d9c36f59c7876b40e9699

SHA512
265c46ecadf467f798349f7f2799631bf1600310ee45d98aac77f491631ff01bdfef9af06ab3403d73e8bddd43dc9cd813c84dcb69a76a2f4533398b9bd673fa

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+auoei.txt

Filesize
1KB

MD5
d0ed060f8bf39c02081396263b0d2300

SHA1
9c645e7e917e68576be62ca3fa018eeb69ad2210

SHA256
6efe82412fbae7863b5cc93d8c52194b89fc7bcc3e8e199881a0a39de7f401a1

SHA512
9fd5c616474c97047cfd1d5ac7f43a445ca4b55dd0fbe0b47cca26699aa7ac8ea9513877f15464210dd9358427b5b8c5e54bd778085a2c005391acdd1135b9dd

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
6ef4f2f2c12a3e2583fd6922aab8c7da

SHA1
3dade6d7bdd0dc95ec7eb3eea13b648bd1af9a20

SHA256
59d12dff790713db8dfac3ea7a95b431160c5241d3c6035d35741c3128983834

SHA512
a62934551fc38f5e09ce35292bbcce06fd053fa76170c7dc614ff70e34c8c2006f987d5bb86729c7021485d1f1d086b85edb334fa62f83bfef429b31a0f1039a

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
bdf580a6573106d39497aaa905545eaa

SHA1
cbbd932bdddb8db60783220e50bd20c3624a46ee

SHA256
166d587409d59e778e5323e0ff0493c278f1cef3543898a30f3af5f1d49f88d1

SHA512
30b33fcd1a73cb9af75049ac9a160c250e7919c41fe38016b7f011a0f2def22c01b2f77109eb3f05634f3f4a759967a06def5589d9c630d42a54fff2eadca9c3

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
173KB

MD5
7cdbe6353b0c3a66a6777b07e2120efb

SHA1
95f47b6d306cf0bdc9ad46a5af1aa15428f118df

SHA256
9c7a6d2176abf305cbc5378dbca234a2ccea345deaa69d7705523e7064cf2353

SHA512
fedaee0645c784a23e824a3f37a1a3fb493ba806fb54db6399096a7577ec5d6e86b6533ccef3c152983b6d64bcfbfa1a865f34bf039933d419a3cc73b863d5d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\sources\license\es-es\eval\professional\license.rtf

Filesize
35KB

MD5
d20f3f6d69978a7df415940e08373c02

SHA1
8809bd1caaf2e4d39c87d036fb9aeab0efe75cc9

SHA256
ba3ef2d7c75eb9d593d5b53c01de602a95dc09d415532cd731cf7d42550baf03

SHA512
670f10f36689eecbaca98f243eaaf444688f932254d67c7026cda32aa3530d5af2971793c7d27026bc425cfe5eefff46378ed2ef3c8c03bdd7de463d42fbb47b

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\sources\license\es-es\eval\ultimatee\license.rtf

Filesize
28KB

MD5
0bd3c1695add8fa6975925b8eb7ff151

SHA1
ff79d6ebab6cbf451a28555cbb2ccfb47c062a54

SHA256
5d3c75938d3cd1def92c56853e65b3e14ad93e3e013ab200505e2a0511a36982

SHA512
d8bdb9c21858a9b483bfc8ff81870e4a6f0133c5f78eaeb469582036cb49891dbfdb5f35dd1db92e1f243c529e2f920322bdc140e3e1cd7a8a32c4cdba509ebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\sources\license\es-es\eval\ultimaten\license.rtf

Filesize
35KB

MD5
f4d84eea9d76e619c570a77a4e4d43dc

SHA1
40dcc7f29fec5c7f750f678a4cc1e526cf53d26c

SHA256
7a8f734a904946a4506821797a539d4c5a2c1cea4e20b11187c9db17f35383ef

SHA512
fe094ba68374716d4cd631e7666f9cc10b9dce2be0282406092743b8870e6fad9067fe107f7d8df80fb604168724823d9410071b6929495bb8b52f02e7d3f7ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\sources\license\es-es\oem\homebasice\license.rtf

Filesize
28KB

MD5
5783798dcf4968f1f62d8ea20829a787

SHA1
8e3dbae66861d51b72c6eacdd7e9474430b282f5

SHA256
993acea9cf0642ebad49f7c48f6a952a24a4d3fd523150682c9d54d1516176b4

SHA512
708a38ac0b54ea48e3eff91cef6eba67e5716d39b124fe94da9ab7550e99a3b7504a904a305a988210adf881431d3d47e27622339277accb8ce6be5c9b1ecc37

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\sp1\sources\license\es-es\_default\homepremiume\license.rtf

Filesize
28KB

MD5
b0b8a50df915709bdad1904f61c2e4cf

SHA1
b10745d7a8cd9fe01a5720f1eed2f01458d85675

SHA256
b81bfe07d541187f431c275c9524807f633537546b91d21620d7e09c433f7dac

SHA512
b657938ca3050b5baba37f0b594a8449d46bcb3211516a65967031bcd5d4e8c616a553406e143da65260ee7b22872b949f516527ffe80b6e33a88b77b31a37c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\sp1\sources\license\es-es\eval\homebasic\license.rtf

Filesize
35KB

MD5
04af07603a1a47a65bbf537b6a55bf55

SHA1
02dd7060f53b80e74ecbd8cc4b994d7bbfdab7aa

SHA256
a82468bce11023c324f25f036a46d2b43b6fd244c4ab2a07116fcf0af4da4c09

SHA512
6666535b7d228ef6d3eca4abf9418a98c9a4a1038147b0565f1ebb4e03b07439201e9c1636556e374b9570a5d6ca8c1fcad50d9e2e5dee6b5fc76aae5fb99224

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\sp1\sources\license\es-es\oem\startere\license.rtf

Filesize
41KB

MD5
4d0ee6db90c432bf1f7bdad481f0f7fa

SHA1
c4f865efd1bfc7f23d045b43d218507699b588ff

SHA256
bf3d782ed5575d54fce643197f765ec0489f07e896430ea0ad3654f425b49c04

SHA512
cea7cd0c933b9c1e45d5727a93103a088f80c80bd74b3d92fa34cc58daf76306eb6d69a1e1f1c1f2f1c308f41aa78f2e4ac68506e85b5952c9703aaf9bc5b5ad

Download Submit
C:\Windows\wwixtlysiqxd.exe

Filesize
328KB

MD5
019aae6df470cddcd82534e57037341b

SHA1
3dff4a6faad3325c7600834d1a7c2c362887865b

SHA256
8dee4f6bc8513c5e9b387ea11183bb2964c2e73f7dc7a430060aaa0d4ae9b99e

SHA512
09d5c811227228a059c5ef989486b0c30ff8f51f786db1330f8e950cdcd1e608f276ea17d055ef3ceaf44d22f3f28d025e6a0312306b83dc8211232af8378d5a

Download Submit
memory/2108-0-0x00000000002D0000-0x00000000002D3000-memory.dmp

Filesize
12KB

Download
memory/2108-14-0x00000000002D0000-0x00000000002D3000-memory.dmp

Filesize
12KB

Download
memory/2340-4435-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2340-8027-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2340-51-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2340-47-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2340-46-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2340-45-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2340-564-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2340-574-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2340-879-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2340-49-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2340-5562-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2340-3248-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2340-2054-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2684-28-0x0000000000400000-0x00000000006A8000-memory.dmp

Filesize
2.7MB

Download
memory/2732-3-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2732-5-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2732-27-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2732-7-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2732-9-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2732-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2732-13-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2732-17-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2732-16-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2732-1-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download