Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
16-10-2024 19:04
General
-
Target
4e826024050255ddf739c2656f2d9a77_JaffaCakes118.exe
-
Size
368KB
-
MD5
4e826024050255ddf739c2656f2d9a77
-
SHA1
856eca0fb51d6994d9d472dfe5358b4c9b5293d7
-
SHA256
56cf195bd7fc140caef4a59132cca2d1499783d473633c0384d1b350606731ab
-
SHA512
fb25c55a9710133214b97bbd9492f39df0f2f43ea9e056cf05f6f4943d9f26031e7832d77df5dd2f69f49c97de92b3d9fbb2d3477215d9f405dcf178488ea8ff
-
SSDEEP
6144:r/VDu6UsyDUOxfDiyQhbw4tRN7eD7Lct/jG2kOREwMunfHAbxwcLNT:hDu6UsibiPbNt370Lcta9OSCnfPuNT
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+jqqir.txt
teslacrypt
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/90E4E054B438F773
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/90E4E054B438F773
http://yyre45dbvn2nhbefbmh.begumvelic.at/90E4E054B438F773
http://xlowfznrg4wf7dli.ONION/90E4E054B438F773
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (423) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 6 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e826024050255ddf739c2656f2d9a77_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4e826024050255ddf739c2656f2d9a77_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4e826024050255ddf739c2656f2d9a77_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4e826024050255ddf739c2656f2d9a77_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\mgpmnyqjddue.exeC:\Windows\mgpmnyqjddue.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\mgpmnyqjddue.exeC:\Windows\mgpmnyqjddue.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT5⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_ReCoVeRy_.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2864 CREDAT:275457 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\MGPMNY~1.EXE5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\4E8260~1.EXE3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5059a0056cdfb48d37d4c736a15e7dd22
SHA1b0ee41fce61ad1a897ee2244e7a8a7106abf2757
SHA256bb5181091dd125261f434ede8d3d2967a32fa3702dd8d5f476899540448d5667
SHA512f4742a6e5a1ba80edc485f75639904fbfbd1df13b78b06700cab1bcc1f3d74ee9014cc1b9ba40b3a40566a5ca37efda5bafa7e7fcf1d3e769bf903703f97f0ef
-
Filesize
64KB
MD513ec6d148d1a31ece17e614b4d88e2a7
SHA1065b3a4911b93a4961082c0f94c6004dcf042e41
SHA256e19a527d2d4b5e68caa4653ed25d8965fc6667edbc430dd948f21023cf42a14a
SHA512a60a2112d842ac2f73be5b23a979debd855a40025a15053e9b605c72dac27007e53e53fc690f3762677772d76269f8d75f676570a0fe10b92e77c0e5df5723b3
-
Filesize
1KB
MD52ba61fed34d423544c2ec8178ab13e19
SHA1a7fa280bfcb9c9f06ff488d3a5a352de99975016
SHA2562b29ffe0753b607f3491777c424eee34cbc878d91381a6f5f2867e6e9c46237e
SHA512b9cbc72efe7b844f1287f1bd1109e6015c432a533039fc5f913382f0202f73a4217037ebc4e02c7921c79947f22020b89ceb19ed971dd45468f9cce6e8a95f81
-
Filesize
11KB
MD554c2db19ad105fff5380870c2eab1105
SHA1daa94f1fa0c8a776990bafb6cf0e40138f6b2d6f
SHA2566fb41eb58fe002ec8eed261b6a9b0e3011028e25fb0042328aa6dbcbea0fc0a2
SHA512b9aef932b49772152aadce0a3ef5d96a9e703dc75d90c2efd6ed17f56a7ba3e41ea20c4adf2c6f60998727ae217343842ca99fd4c50606cf989a4ae69e2a093c
-
Filesize
109KB
MD5f3e0b2db5dbf5fb048472987a0b8c3cd
SHA178e64169a5185145c11a2ddd8db37d42c7995555
SHA256c4c53b6900027b4bf80c440bba4bd20297413fb1a6b2f296e159fce1da1724d8
SHA512cafcbb071d50a69a0cedc0b1eb18d421b203ac32913551c48a9b99c256eee7ce9a5f9b740d7f88cc7f0d549408054f4c4f842f574c3c42a512d45302a1950698
-
Filesize
173KB
MD50ef73673b12ae024593ca18766d2dd9a
SHA1f5dd9ad65d0db2367dca07786b9f9799fc8bbfc9
SHA2563cf03268a22064ed2b1da155993bf33eff48a825a9e2e24749282819171228df
SHA512a1bac28aba3837dc27f750dd972baee8641424012a739067fc4d08774099847d7a2e6bb476dad2720c3440e7f8e97b81a41b0fad4fdcc8a3fa07d93672168195
-
Filesize
342B
MD5f6c1156afcc973f6db1797a543cd5c20
SHA11592017e13e81f6468c7db1a0852c5558a95f681
SHA256a72d18d79fbac38ce617a5fa4d47a9a0888514125d03e8d2e5ccc98306509124
SHA512d1876dba84c7ab57d0aa7f9330b29773d5299e9dd6bbc037ffab9beed8bb4ca1270bf6ceb27be5b45cdfd886d0f16df45d427d6a8ee0e9e126a0721aaa8af927
-
Filesize
342B
MD55da4ad0d544a70b76b5e0d660b4eac00
SHA1e8515c5f68946a1f76e37fa0c1f8a62f932c329c
SHA256f0b8e3a18ace7fa6c955fd5370d2d01cd61f2d81f6a7e34ce8844153d3946e28
SHA5128963304e6278eae1789b1092ec635096eb237b0f60ea2835294f1e66f35e754afc348a01afc5f89ab29438c13bd7bd201c5846b86cf011ae5f8d5d6fc4b0570f
-
Filesize
342B
MD544af596dc787a4af32f11b7d12d16663
SHA192de6f892393fba3a2b48a5eac31d491fa673823
SHA256e27b9c9bd44837a8bda8c6148e226127a9a6a9ae57e4c2413af652d188127cb4
SHA51230183b935c4739804983d30648605dab9429948ae450ca2a8878cc39f4a8c37578001584aa11b3bdc5c4bc43479ad52f6130ed1aace1c37b81c8eeb1b0f91e97
-
Filesize
342B
MD5afb20038fdd0fe714e85d36cca73b218
SHA11f333ff6e98992969240bef655847a61222dcf78
SHA256347ce8ddeb6a0238d13fdfd09f7aafcfb479c0052b2ebd9a4fd47c6e8390cd50
SHA51289201e4db4c2adb320bc2545dcd58a9dfc7ca53445821a8e0cc9e1e7cdcc0587cbff19427bc3ade1b3a89ecb7ce37b798eab16cd72617f09bd27761a011a4418
-
Filesize
342B
MD582c2337564875d673e207fc8622d1b52
SHA1fc39af2357b4a6db8e24d6897f0de4afba933876
SHA256296141268ed69047eb36b04a77efb2ba634a143a32170acb0b6eb7ebd69bd240
SHA512f483d6554bc2dbb76f76bc99672ef5be4e7985ecdbc3c1a36478f64a82398fd51133cd84f7a8c6d773ea866c1672c0f9f3d39470c70fcf5d4a5937e506ea3a76
-
Filesize
342B
MD5697f08ae01dd9e7a0e1556c72c38db35
SHA16f6d36b0708fd0eced2f627d50a9230b831c04a3
SHA256768454cdf4b0837f36572a5504711875d96fef67095cd9547807fb5e444f1116
SHA512d8e9787fe3e52e687f004bb23c413d0ccda95c28e3e24218a7af461d4a84619615da094368a7b1e00f2b92078911e0f4ad5d0765d8e83b44cac85e5e8637d925
-
Filesize
342B
MD5df47f5474e2ce91c3de386ce7ca5268f
SHA16fca88027a8b1baaa3b412f32e6cfba686b1dcbf
SHA256342bf4707fe5ab0c6fd8fb62c904b7b2394b1af3a0a3148e71ac33649d2fa591
SHA512d855156ab4b5fad14b139423c47fcfc65d543b3228f3f0d80da273aac68dc6e20dd2f67aabd4effceb3e50648190c4b4e9aeb1ac009388af2d283dfdfbd92e27
-
Filesize
342B
MD5ad0cd5226433ca05353f8ceda505d14d
SHA140cad44151d14e2f0babcc8cc904415388e65b39
SHA2569954e46084966835a4805597882826de751cb1a15564f8e800f5fa22c307c3e9
SHA512505dcea0d592037c1698580f33b74558f73e2a75c961efb9c06323d5eb8457e6ae46d04c91ea8b5b735757d1aa504d6571c9b0213b4039e41533aba1c3375c64
-
Filesize
342B
MD5fe85061ef2aaf34b0add87830e2873ff
SHA17d00574f85983d4f3c5ce446cb2ee5333fa64fee
SHA25627127da75ae3d4aacbf44b5356d0cce7a25779517351d744be4505b42b9017c7
SHA5123a2594eed56c50b46f2733f193b9f241ed6aecbbde4eae2e97fb5d411f2b1560518d4ea3a6574deb4388ce4cd8e7f989069f20c8ced228ef283277f581df42ca
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
368KB
MD54e826024050255ddf739c2656f2d9a77
SHA1856eca0fb51d6994d9d472dfe5358b4c9b5293d7
SHA25656cf195bd7fc140caef4a59132cca2d1499783d473633c0384d1b350606731ab
SHA512fb25c55a9710133214b97bbd9492f39df0f2f43ea9e056cf05f6f4943d9f26031e7832d77df5dd2f69f49c97de92b3d9fbb2d3477215d9f405dcf178488ea8ff
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
904KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
20KB
