Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-10-2024 13:32
General
-
Target
627ec4f42d9649bc8309d87f03d1c288_JaffaCakes118.exe
-
Size
368KB
-
MD5
627ec4f42d9649bc8309d87f03d1c288
-
SHA1
6cd845e8de2c2197cbab48f94eea823f88b0efd9
-
SHA256
3503e011b2844b6eb3f18b3a7c0965ff07171ac6af2488fcf03c0e69d95cd066
-
SHA512
62899ac229fbfff6cd6ace9610b6d6dc027cc32ffe5b7b2c08fb3445815e134caec32047e0a5129118675f22b32aed516fc877b33c90da98261eb44f119a74bd
-
SSDEEP
6144:e680E92oeOE4G63VEuFwm+DDrhd3wbYqaUq/JyKSmi97Msg4piwbBS9lkw86C:e68PIHt6DObD5dmYqarImi9jB4SBylkN
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+ctqgj.txt
teslacrypt
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/A4E65DAEC032E6
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/A4E65DAEC032E6
http://yyre45dbvn2nhbefbmh.begumvelic.at/A4E65DAEC032E6
http://xlowfznrg4wf7dli.ONION/A4E65DAEC032E6
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (425) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 6 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\627ec4f42d9649bc8309d87f03d1c288_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\627ec4f42d9649bc8309d87f03d1c288_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\627ec4f42d9649bc8309d87f03d1c288_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\627ec4f42d9649bc8309d87f03d1c288_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\ajehskmxcjvy.exeC:\Windows\ajehskmxcjvy.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\ajehskmxcjvy.exeC:\Windows\ajehskmxcjvy.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT5⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_ReCoVeRy_.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:275457 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\AJEHSK~1.EXE5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\627EC4~1.EXE3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD59fbb5f7889c46289e1cb2a8a64c8a903
SHA1fc35f9e7b52b8ae16bd79c51d0871fae7805dfa8
SHA2568343cb192d1e49c1a9f41646a23dda0b4d5599b99fd313972d4c5046c1f4a093
SHA512d43d8ee46277e2f8e4de7c9318708617e335eb005fc02c8dbbdc3500353398dde1e83e07fff4a6b77df4165c2e2be07d801c4cb37dd7651c42a5be78a24c5703
-
Filesize
64KB
MD50a18692ad52edb26532ea315fc7c32e7
SHA1273ae3289d2b62fcd5f32fe05562ae9afdefaa20
SHA256433a1aee0e57bbe29419ab5d76052a315374f6d000d7ddbee61567ad7f022d32
SHA512b087978aed41b376a4672115544758261328f01368b7a9b8adb54adbe9e75f7ca375cab66b85ec8188f8b82661f5e6d0e7b95cdcba938be22245916c8c6398e5
-
Filesize
1KB
MD5699cbb81cc85b10d922425e2bbff1810
SHA1803f2202b6f52d566760587e48c1b68bc97d1acd
SHA25698c198cfbfebae44dcbd943dc80e68f36d09f59f2ac067e6da0b75b73d92ce69
SHA512157f5893051c7443f94f8566dfca8c6640c2079b19249ce2d93e6050d9463461bc879ad2a5f5e7286e6e64c0669de3031719ab78a8f0b52eb2c13597b21c1779
-
Filesize
11KB
MD54465b6fd44e998ca9c7d57290d783ab4
SHA10f1c8556d846fbfb44e972285eb3e563dd0e49a0
SHA256e58164914232846b72d32ff5126903f5ab10c3570c7b1faa7359427609dc75cb
SHA51297a93b2d58e986ddd17a1b4fe5cb026437efcbf58e5255791cf0a02092316f199b9cf8be6cb98277591287dea320356b018b6e9fc9ab81fb9e9d48e81435d6e2
-
Filesize
109KB
MD599dac0aa9e1886a3b67653ab54543c5d
SHA171eba52114f5270f94c2d1fcacad402ca4fe7b51
SHA25661ec4336958c59c4c3a1894d8ac75eef3071903b50e9031380a2cd0d2df2f805
SHA512ed0fc09f3ec5adaa910f8aef66761ae4313fcdf710a25ebd2590ca2d011b466a0459ea59eb7ed35952047eb51c5b7150d40512aec0f774c221d63f0da9290b0d
-
Filesize
173KB
MD5fd063ce307a38fe865517181973e23fb
SHA1f8d0d5e68f56c76d257b0c5e4589ca89432c8c15
SHA25645bfc46c25931802667c52054f2301c5cac2cbc01ae97f9aa3af81690fef9d01
SHA512cf9c9ba5fd9ed5a95c744fbe52a8c6b3da5294dfb6d66e510886f2fb1d64fd35c8b0314460bc750217d10b2f289548e88142dda52852a1278a865efcd3a40498
-
Filesize
342B
MD58bac662f9ffbcdec3ba9a6b895c4330a
SHA1b19d3f32fd5bb55f4a7fdf4598a5ae0954659d31
SHA25695abc9f89525d9d26a54a40d7dcbf8acd928cc2694ae9d369d391608c431a6bb
SHA51291ea7a1e7f24caeb10cd24926cc817824d8fa3599761ef97267040720504f82fd69bfb779171c6dcaca2de4648a167bd4c8662a86cdd93e6e68a16f8bc46aae8
-
Filesize
342B
MD58c9b772f5246fb78d1483099ae4b135f
SHA1c7acf1bf16ef13b1b79fb0b8a1bddf2644a7125d
SHA2564ee6505f6361445258744c2302eeb47090df655075ce65bc00a2f3a718b8d71f
SHA5120ad59be771ae9fdb155b816f30f5c77c908ab97bc2a00df044511850ac111c43d3ac7ff76de18187726137af5613c5e9e04582d87c07322b7dde06d9b40c7861
-
Filesize
342B
MD5322f4677ccb1ac37280fc94854d83e09
SHA1009a16641028747578d7e84ea3462d5ab09cabde
SHA256c236f9fef10d64c1b958f480e651afbf5c94f8730e7903cda92d6babef73406a
SHA5122b0906908686aab8b8564684d511e3f4ff9137a36b554bdba0472235aede4e4355c0e3a17aafd778afb4bff002758039c2b2a37194078a58a9b76f76ec31383a
-
Filesize
342B
MD57210f1691a1259c89dc964d3ad4cf7d8
SHA1022df1af188f2dbc91d3f6e5a852904ea123e47e
SHA25632d1244b7bbc6262a70f6a57917388f07b00551c36056439f921ff49eee79639
SHA512fbbe8bcf5caf35ddad5fddf87b6eb223ff503968c0eb0764f7807c56408d27faaf85405fd1fdaaf1e5f226335fc3a44937d377adf6e2cd681d6e28cfaa4bb85a
-
Filesize
342B
MD593e748e651318ee1a9b3b3096177734a
SHA1d4f53201ef5ea5b45a3422406d7b6db89c4ca0ae
SHA25639a45d50bbd36d2de3ebfe92e9e12ef78100b45cc2d1410184cc90169b1aa301
SHA51292ad962f543789cedc4c822323a61790ee301da968f2ff3815914614c910dda7cc883acb8a057c0f94b3ff04c9a9cb3c3213be8a2e76479765b344bea4b7d719
-
Filesize
342B
MD5a5a0b485d176f20e2e0406eb531aa7ab
SHA1a338b64347998869bebb40e392d11e32d2374643
SHA256202cee1f04eb2c9471c95f73c33fc5d87624984e999dcb9a4b86d2b35445aa6d
SHA512511f0d43561b34907f986856bb09fdc6034eded4f4a05b4cf8dd15d2e5c71b2ccbce4f7a250c7be262bbe9dee9191bbf015438d248e3839b72486ef962f06e19
-
Filesize
342B
MD5f2b5b903d3d79e7425f66253716fc74a
SHA11d78d01161f3b19dd28771dd12f302773885d236
SHA256e6914893b28d086d3759956325b7be1fd5925f0af2624e0463ada413e3c1186d
SHA5121459c6ee4cf0e62c05eaf3e2cd346871a5a10ff4d923fedfbb8440c69d5fdfcf7322ce294b2b39ff89d94886b08bf5216bafd7126ccebe9aff8a81ffd0e40196
-
Filesize
342B
MD525e06029cfbbf0287df71fc1be2cfec2
SHA12c619a653fe20282c83278d14886ad40bb9ef1f8
SHA256bf6e780c26cadadad688ee6699d14a008c9733d6e060b2d6f7037d2aa7c6198a
SHA512cf1fc4b0b2e5406dd5b868f1fabcbd4f914bfc9d9b059fedaeaa8c1f04c837f0a50a4414d46b7d210fe68edc4716568dd6b81e0db6031c1d41cc9843cbc56089
-
Filesize
342B
MD5da5b1cc6968f763e680d031f5ed2e9a8
SHA16533ac9d9d3d2b6f73a842825a17696308a899b6
SHA2560537e1fdb639e3131d17d7564ff2fed3fc0de373d00598ee57c635e58e8bb9cb
SHA5121179ca49e357c24bd97178c36aa63dc0ddb53cf139393a7537912ee1cfa9d7f142e7bd618f7cf83ef6da4ec365a32439e2e624ff20e7cfea984f45d25404e2fb
-
Filesize
342B
MD5d5f89c04e522e826e4f74ce6feaa4946
SHA10b248b29b5ca809119b6d3631bee10409ffeccd6
SHA256c214525517b028ce81bedea721dc4a40425c895780ada6628f4219a833457f6f
SHA512f996f329bc5934333c96dbdcf6a1200f0dcc8cc7fd5af5b922014e6b8f9ac3918c942a4cb00075f2736daaace5dbb0aaccd80a568ba766f793e6386f067d2862
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
368KB
MD5627ec4f42d9649bc8309d87f03d1c288
SHA16cd845e8de2c2197cbab48f94eea823f88b0efd9
SHA2563503e011b2844b6eb3f18b3a7c0965ff07171ac6af2488fcf03c0e69d95cd066
SHA51262899ac229fbfff6cd6ace9610b6d6dc027cc32ffe5b7b2c08fb3445815e134caec32047e0a5129118675f22b32aed516fc877b33c90da98261eb44f119a74bd
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
904KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
20KB
