Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
03-10-2024 01:00
General
-
Target
0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe
-
Size
368KB
-
MD5
0d3571a8ca8ef2fede9e3e11b8761582
-
SHA1
f2b0416e2afe93050816f62646ecae6080a9e559
-
SHA256
543144026b1a0c1bbfea07c5af4b9e5654c6eb3416f7ac70d676c6c8682bacbb
-
SHA512
1474d517cf92cd4dcec62bb656ae918f383fd4e146dd951c9613e7cb300870e32606c3607872bb17d84e2de5c13d23bf51bc16e8f2f576acd4bae9fe3e2b661c
-
SSDEEP
6144:lysifNvmGSKiUuyWvY1ZEYVG3I825tkB9GqlzXwOwNM5s8Fy:8BQUuy6kP5tU1lzXwBqbs
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECoVERY_+nxuux.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/ABFC79646CF63FA
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/ABFC79646CF63FA
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/ABFC79646CF63FA
http://xlowfznrg4wf7dli.ONION/ABFC79646CF63FA
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (418) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 6 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 52 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\anifelqhrjvo.exeC:\Windows\anifelqhrjvo.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\anifelqhrjvo.exeC:\Windows\anifelqhrjvo.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:275457 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\ANIFEL~1.EXE5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\0D3571~1.EXE3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5246608bbe081e7298e6bd0c5e38bd724
SHA19c910832dec5a512f52054165705927c92f2f312
SHA256bb58cc5e39b7df266307952dcee31f8fb4aa49df447fe5fb1d186ae6c2ab63ff
SHA512eed14199a9890312c0b47e6dda9547aee26ccab4974361cc6f57238bca53238ed5f831a3f22c7fd3efc99ad137720a3844753f3822c45e5a04eb53ab405d486d
-
Filesize
64KB
MD54ddd024672b47ba7a786c25cf1f910e4
SHA15033dc842b614a5c30f1fa0576dc8dd39603c9df
SHA25650841cca734502d02f34ce5b55626bd62ec7b97d128e580c33ecfd445f591ef0
SHA512840d85205e5a843f4369ab330eab9ab7f709bd4e5ab129e2791d5cdfc95f09161311bb3b4b4d0535369e1cb9f0538b44214601cb22051f3114ec75e1555bdacd
-
Filesize
1KB
MD5393ba608e4c427079cd079d7da67c314
SHA1c410549380620a4d5514dad617662de6ca277045
SHA256c0b9c75f07c90a96a4f66228d2f1f0403e32a3c658264c9aef3b76467b5e34ea
SHA5123c882d1ed5cada943b425a8e7d133a9160f0a08dedaef42fb73ef1ec65bea508d2e475f5c96586a490dec6ad5e02688a2b7a9c3d3845b8c31f52cf19524fb01a
-
Filesize
11KB
MD5fceef23f82218af6b3853f33b4a8f5e7
SHA1f5105fb983048128f244640a7e206e8872345de8
SHA256097f29c02f5d7b913e3e8a9d86e55ae1e5ef10a1d95894f82b4850f85b453e6e
SHA512e68dbde4d64454325ebbb1b25f88139c16cb9ab9e47157853ba3557005fb20f1b0986d1b00cf897eea9698b385dd266b40e9034ab9ca27ddbd3095af77aa6fbf
-
Filesize
109KB
MD5addfb8dc63cbc308688cb5555697f286
SHA178554221ced224a2edfb5b9f2e1f3998899779da
SHA256916a29afb246e365ec4a211e364063802029889c1bb2621dc55de225333e1dd7
SHA512018c2457a8d7dca771854f26c6d5f4544a17954d882468b0f8e38c2b74695d39634bb9ed45f594ed83cd781f9427a04aa8b69b2bf6d31141e557970354e5a1e2
-
Filesize
173KB
MD5c1d18f1331ca476105e90c817f7fa10e
SHA1609eb048dfee46b36563ba5d75bb53d90474b7b2
SHA2566fbf104583f746075a3ce7b02c8bb46b8453fc028e5b66f7b205e86960552de0
SHA51253d05b1e298877fdfe27133cdcb1b9ba0bbfc5ddb9db2a5adc5d70cbbde2e304731dcd196bf76448a831ca533e5b9dce8d0f88d2bfc0ba242afcfff2eba841c9
-
Filesize
342B
MD5e33b9673ecb6f520c401be7bbf466aa4
SHA1ebc57273e5ca44a903846637323185940605bd3a
SHA256c7c924146706b40a3af5f0c448a4acad09a583527a501c121152df7a417db7d8
SHA5127ac6f3c3211088442a186ea910e0f19fd28e7768711ebf696fb1a0634acbb558d5f527fdc091f96acbd071a55bb44651380a31052d30b17e54b9cedec21bbd36
-
Filesize
342B
MD52b816e55f59645c0d579865469206a62
SHA1dc18f3dcd849a0598dba87df037eeeb8f4b10eac
SHA256501ecd67a6dad1e3f2a659f9d37576e150022772d7481c40d8e3a45987927fce
SHA51271b9e7d643bcb8423dd47279fe500c5a95432dcdd1552fe0f12752b31ba904bb9aad991f37adab07ec2b5f411c258c21fa7654cc3040a70c18b1777770fd78b6
-
Filesize
342B
MD5a6dce6a471344c1408eb27ad77d1ad78
SHA1c34b638bc93972042763fc02bae9229632c35e1b
SHA2564d2143581406bf2edb8852c5a0753a23af38539959091fb121a515c875d59124
SHA51224f0137285af6258353f4d54fef09784df208666ecb29bf4ae4d768c5058ae73a7dc005b1f1cd2b4432af69d4800a636fcaf5e7a4f51e0311a381f783c92c486
-
Filesize
342B
MD5e1d5a5c2ce2f38e3abda3ffbc22578f6
SHA1d614d1102ef1a29d518f7bd5f75ed2b6a66b6c22
SHA256c718d53bcfe73aef6834b74f095fb1a1c7865095454de2fcbf25ea6cc4b7c3cc
SHA5120c5a4295f47b5201b5fe6b310151b35b7fb508fb8b6f743b7253ddfba0def4fd157ca428aab2dcdb3e72a5ea93111f23989af414c1cc4f6f73931440a28a21a4
-
Filesize
342B
MD501be5c9d1a4eca9e3564369f7abb6be1
SHA1d7ef1eef6783740d5a6763268f75e46dd72bdfa7
SHA256930ee14f524768925e295769c1b5350d03991a9c8614f36cd1632f29d79acb11
SHA5127b2da8563be8d718c3b513065e5b0793350e7049790edf5e4cd851a7bcf44f5982f009720889cb58b28b579527041c3d01593e6c353883115abcc73e64b3dff7
-
Filesize
342B
MD567e5dd3c4d887e21f88a67f4cb5eab0c
SHA1ba7a4456fd40d4ce55ca566a3f2f4ca0dc37585e
SHA25637f911731b58a170cd93cb37bf084ecb31632652f1620154fe10052420c488f6
SHA51240cad72761524e75ba122a4db5da9ae6854d6afe6f6c2f98165a14eb2b2cde6f7360e2df0759219361b5dab474c8f9d6dc8669aab9828d164443c454c78a6720
-
Filesize
342B
MD5b36a9e3c684fcaf95accec2f41a0d082
SHA15255ad413a662bc18da77a32dcd6e4f059826771
SHA25665ee273013f2ebbc803936ce7987beeb65a15222c694ddfc9e3fab6f518044eb
SHA512f7ba950faede33d3ed4ff9d4504d79a32dbae82f256926cee5cbd824eb94d2a7568cc16898eb25637d77be6cc28884460aca69bdff4bd47a071e753103687fab
-
Filesize
342B
MD58adcf5ac35bd51e74d4c34426f5db11f
SHA14c35085fc93cb5e9c01ab59e70fb639f8bf4bca1
SHA2560156a17a2881256fb13b6960344d1c9ab1647d0b5fc645a44e644472a8cfed1e
SHA512110ca946ef2b5282d0303426a87998d29f2cb378c4d11b09cf51cb75d6f759b97ca971c7b365d1727b939d03a0ca98b2dc045f6763dcdc8c2da906b1d275fc6e
-
Filesize
342B
MD54667791fc8a92b27f166c11bceb3dbba
SHA1719fa395784232be1ac364c6f87659141d181358
SHA256e90ceaf2ed253488806486fae5d4930662ef3d502ab1a06b3d82e0f10865edcf
SHA51200b314f63ad7a1fa0bf59eaf566f5293b63647c36b17fe58fdedd6d6e6e4a3665d1bfedab0facf2862c33a68061a06c18a08e1fe9917f08b0126ff36d36eff9d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
368KB
MD50d3571a8ca8ef2fede9e3e11b8761582
SHA1f2b0416e2afe93050816f62646ecae6080a9e559
SHA256543144026b1a0c1bbfea07c5af4b9e5654c6eb3416f7ac70d676c6c8682bacbb
SHA5121474d517cf92cd4dcec62bb656ae918f383fd4e146dd951c9613e7cb300870e32606c3607872bb17d84e2de5c13d23bf51bc16e8f2f576acd4bae9fe3e2b661c
-
Filesize
8KB
-
Filesize
4.3MB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
8KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
4KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
