Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-10-2024 17:03
General
-
Target
3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe
-
Size
369KB
-
MD5
3b240ca653bd5467b19e195889c07c6e
-
SHA1
bfb732fd34099fb9f4467cfab185a4bf3bb28e95
-
SHA256
62aaa2a24236be5ae371e5851370f24e6261025cf4bf539b7c40bdefc6ad07e6
-
SHA512
32242830aaf7fee32d16e86da4d602640fd360f24ae309bc5391c130ca384b951ac97f9ecc1f596bd7c7b3933c589dbd87ee872b4dfd8cda62835143e04e0296
-
SSDEEP
6144:fo07Ev9jgh+J0J+l/moekR1MlvlMa0FIe03ncsCMYZx/FqDN6TETpspvQrMX1r9:ftQVG+JIe/mGzMNlMVFC3Xi/YwOi
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+nhtta.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/6D2ACC11884859A9
http://tes543berda73i48fsdfsd.keratadze.at/6D2ACC11884859A9
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/6D2ACC11884859A9
http://xlowfznrg4wf7dli.ONION/6D2ACC11884859A9
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (411) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 52 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\jxpgfuwensvp.exeC:\Windows\jxpgfuwensvp.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\jxpgfuwensvp.exeC:\Windows\jxpgfuwensvp.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:275457 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\JXPGFU~1.EXE5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\3B240C~1.EXE3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5ebb4ad159a57fae8b58c673b0d3474b5
SHA1ef2d6ef8fc6146379f34e20315cba16d3799bce4
SHA256708f8b590ae526590c52180234d1f127552301cc764e4aa470017d0ed3dd8b80
SHA51276bebb1e92e9514b7aac6b89f8cfe00a46df399dc633fc5684ba23c5325c5182278a02fc85ca39074c7234bc03d42d11bfe6b654fbb3e59fdbfb3b1c823c910a
-
Filesize
62KB
MD50e999b9b7d726e961908c7f7c42a26b7
SHA1e9d1a81766c844ec91b6afcb27460363d716fdb5
SHA256472f4e7381ea8cd86c3a9160aa69a79ba1a9109740c8474b9cf299ca6e53bbcd
SHA512f86b797946f37dc6223e5c1db61d8e3d3bdf3f6e4d189170db562090ab5159fce9b1648fc0090fac0a74687595105cbd87e123d31c96e4179b133dc5177aedd3
-
Filesize
1KB
MD581b9af20e4f683653638d3ea3127af16
SHA1c3150d5d0baeaf8573a1f797f4351052589572d0
SHA256e7e8b18516d031f53a8e4ce8b27fcda8779c714790593f299d235cec89e95b48
SHA51267a84a27bfecf1e9ad207664ae6dfafbccf1812fd071fa24d67e39cb3eff394d6a6a6d788aebcf3f71c000cded0a6b4273afc9a9aa8f70124ac14906074e7afb
-
Filesize
11KB
MD525512cd7ada5db45e5594b9db8c056d1
SHA19a19e57463562656c88bfe78faca20dae0758853
SHA2566a317b010540764569226d2c8627f805120451df46d8cc090bd271b8b955962d
SHA512d5273c2ffc1f67a34d69c700567c66a9dda0c9ddeabc37f0db401d91f2b90e700f91b89ecdcec7321c66d74f8647b8e1b6c4c2caa7d71fcae2983309af815c83
-
Filesize
109KB
MD560921347610e8b97abc05b8739c82adb
SHA1028766d3f340cdc0eca5779e2eec9c1431caf61a
SHA25696e5931d7a33633e7036e506b7d402bb0f43513d5fdc236556bec1972d1e146a
SHA512b2ec73bcfd50a88d43463197b553d8e6b570a921880d6424f3ad2f9b5bd0fe49203b429c2e72bb67ebcd3f024285ca487d31a191a911fdf6f245ba30ef58a539
-
Filesize
173KB
MD56312a06a06f4ad1315e9797753ec1e25
SHA1c381588ff922c5a0d3b67b916befca419a8735cc
SHA25695e3766c675551723811b870e40b575ce1d08855387a7b1cf100b7ea2665d8df
SHA512a00dc9011631b850d45d1d52509a0322f4914afb42171ff4ab958fe9220f6dcd25209ee3dcbda10a32fa9df687d25acc59d5113b50d30b7103a2b70f512f222f
-
Filesize
342B
MD588e0543fbe73a6df5b8f7172e196d67c
SHA171c5e320a303a87e3c954b3106b8a74f4c2f5a01
SHA2566993f518dc1f4790248d2c50c7099d2b0f85dca13fdf89e9c39688e692477fa9
SHA512731c6804742486f7e696991604dc3829432b9e4f71ab5744cedea818d4a0b7abb4790e9b8be3adea491d309c087a870bcc8dae0235ea29b89e39cafab7fb2c27
-
Filesize
342B
MD5312df1ed391b6096f95429fe5a58d086
SHA1f083cd77225b4b97619d9ddbb491ddbe4031b84d
SHA256bc7782c04d7ff1ae78be580a8e0ea4608bf19caf6a6f7c692e70279efa9234c0
SHA5126cce242b1eaeedfcb765c92579d454047e98af4773c6bec5610a37a184a18c437242d115eb885bbc32394b0d6841808089cac65dcad3b2096f1077e2a02a108d
-
Filesize
342B
MD5ff4131aaa124b9eee972e94f74fe3845
SHA1720e9013e892b7d0e55a903f308d622131842d5e
SHA2567419cace1b15747e1a525090176ec9ab43dbc0298fe80ce8b99eecc6fd794449
SHA51293d14bd44f3d3e54f9b8956802ff296dee513d99a6d71e674d8529dda486804e6da0d80f0bb9ed2f6a215dd38f3ec9c8cac0afb023c01b18ebe586598a5e7581
-
Filesize
342B
MD593becb8fe745e0f4627bef9ce8eb6a64
SHA127052a49b64c4cd12018cb76b3de4b3b96599a43
SHA256d68000b623d2c7c3ff314316cf89c65640d28bda24a3c94978f37f474f3940ce
SHA5128b7e81a7080abe93da1b4aeb1eb24547cb6f857add30e863b01806edc9891304c31eaec6958b22a6f5a0ca7f15ce6e6b19cc7f14b077adce95a33b6971641e21
-
Filesize
342B
MD58ecf2c38881090976e10a82f2f3646bc
SHA1dafc6fb542c3ac839cefc3414081b16559a99c6a
SHA2566665bfbaa524614370474838d8e115139b7e188a01e9c13ef04e7c93f3691c1f
SHA512d50f6273419d210d47388e0971f13f92490204fde5aed1f1ae7b4a9b6ebd93df7034242167b9bc96235976ae79663c9ae2d558d4fc39668f89f00ede1f20eab6
-
Filesize
342B
MD5aef580f4b110a078139c3ea5563114d3
SHA18b3c92d913a6cd63ece0f597643733fea034c851
SHA25613a2bf74845962dbaca0d430bd2a8a82f90465743e60c7b062adf2ca1d80b270
SHA512f22c5583d65c93207f6c85246f0b7f4c2a6afaf141c0cad75b5aa85ccb59dd75337882cc810fd87aa6da4d60793e2ee98a8418ec6643c6756bc814a5b76876eb
-
Filesize
342B
MD5074b2a8826c3341adaf9318becdaedd4
SHA112bd4c92875602db737914a37ad500b9761f1bb7
SHA2566d7a37f37af5cf1d85563981a0bf1822143860519816361973a0944de25ceae0
SHA51285bc48eacee583057dca1ab622084127a295c31532c2ea2e4ec4f6001ddba10670c04f5f6af492745dd4672a4f1cf5d236ac51242d32bd06f22dafbaf7b7cf5b
-
Filesize
342B
MD52bba8c43a2bb1757f93e9f0887def866
SHA1de00bccf9d240c4d8709ce2516e2cf5764961fc1
SHA25672ba1a65d584bf027724cba25738260ac26388adfb547c6aa3657fd30b996573
SHA51246251984d597e21e96f2a067c1a3066e9f5c80bf8282577141c4bcf70e1022cbcb40daca08bdfbf1802874e194783da83f4abcbbc261dccf690eeb83cccbcb51
-
Filesize
342B
MD55ea2ca78f4961aa705cb49d9b1733c47
SHA135cea4a6f2dfdc2dd7bad8cb4daa09cc77295922
SHA256fbbe28cbf523bf11746f9509c6caf9ab30cd6e49c32a5efd590229cd5be248b6
SHA5123e4e051f9a29e07e4b1dc51a8a5bb340bafa71a1aa3ef06b06ffba64654130a77261d887a455dbc49f32bfd24867812202f205c92f3f029baf171d8daa40b583
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
369KB
MD53b240ca653bd5467b19e195889c07c6e
SHA1bfb732fd34099fb9f4467cfab185a4bf3bb28e95
SHA25662aaa2a24236be5ae371e5851370f24e6261025cf4bf539b7c40bdefc6ad07e6
SHA51232242830aaf7fee32d16e86da4d602640fd360f24ae309bc5391c130ca384b951ac97f9ecc1f596bd7c7b3933c589dbd87ee872b4dfd8cda62835143e04e0296
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
8KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
8KB
-
Filesize
1.3MB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
4KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
