Analysis
-
max time kernel
124s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03-11-2024 15:19
General
-
Target
8c23e7c480280c24c6b34c9c9bafc05d_JaffaCakes118.exe
-
Size
396KB
-
MD5
8c23e7c480280c24c6b34c9c9bafc05d
-
SHA1
de75bf5f2115fb3399d2c94966218f91dd9c2362
-
SHA256
d898a79292edb0059156844e559cf65ab68819786b1d344dec42993851751740
-
SHA512
04a631fbd1a3aca23956e316716375a77328471025f8391971aa33315ad8245419231f3b9b95229b1999c24c240ae97436ba9fcc3216d1a5b63ff75de9e9edf5
-
SSDEEP
6144:4T3WR0F1lDPR+bJnm/jtowhxZWVrfQwBcTMMG26uw6fyQ7Q:4T3MA+bJmy4ZKfQRMh6
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+sqosa.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/CD15E914F9465C64
http://kkd47eh4hdjshb5t.angortra.at/CD15E914F9465C64
http://ytrest84y5i456hghadefdsd.pontogrot.com/CD15E914F9465C64
http://xlowfznrg4wf7dli.ONION/CD15E914F9465C64
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Teslacrypt family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (416) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 6 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c23e7c480280c24c6b34c9c9bafc05d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8c23e7c480280c24c6b34c9c9bafc05d_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8c23e7c480280c24c6b34c9c9bafc05d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8c23e7c480280c24c6b34c9c9bafc05d_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\aewytlotjaxa.exeC:\Windows\aewytlotjaxa.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\aewytlotjaxa.exeC:\Windows\aewytlotjaxa.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\AEWYTL~1.EXE5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\8C23E7~1.EXE3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Indicator Removal
2File Deletion
2Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5ca7e2a11e21542a07690ce8cdc82146f
SHA1436eb51152798f8311789f8e977f33ab362965b4
SHA256f5fd6b5200497ce5c976d33a66cc82d785103f1a4cd050f370f0c4380a83fb16
SHA512c2106f9eb346e13ae1c833d1d3a10da4954378aa793dcdffb39b4ebe3277f18735dc6fe95ef1950dff64f106704787a61a11e719241261562d361d44ef578971
-
Filesize
63KB
MD5b99c4cb4440be85bb4686f46ab0a4804
SHA143f84d2dac5a9b2dbd062c374eb2d2e60fb825f5
SHA256de4500af64e7bd0ec58f98e6d0310e786f1a3dcc25e8cfb7f0e15d011b503628
SHA5126187279d544be78552a97ef65240eea19e2e04f1a9b3fc9dce9f80cfd75a5a0ebe5cff565e5b8634f0315a1f7eb3278ccf4aa07cbe1a72366077a966431e3d68
-
Filesize
1KB
MD510c800fbbff541a84729207adb2268ac
SHA1e9565b1e4829cb2dce353fb5d6d39d693f43fdf5
SHA256d265f4fa78a435c3151864b4d342ac54268220094992430a3ec0476ebb7bbf69
SHA512f7c619365485ff05f26e1a2505fd6847fa3056ff8141731f06c1487476595013688e287183e90df1d975828c95853a5b836d2d0b2d2f3c795777275d4160f000
-
Filesize
11KB
MD5cc4c77e5b851ca67e0935a5d0df6d6ed
SHA1892018d28ac27ed57fe44042bc3f73db77147227
SHA25668800e727d3ed8a498f830f08f1ee39afad1578853995ea5c73826a0725d06e9
SHA5124eb96d2c2bc81501899b266add54ac78e31b7471984fe7ad0f1e6795abf175797e70f5f071c28afaefdde2a79dbd04c1c746d41b4b7252412141590cc26bf78c
-
Filesize
109KB
MD52289c961aafb713305706024a1b95433
SHA1fa0c8f4db3a020bc1aaa0fdd8fc2d6801d525196
SHA256f13dc64f470788e0f9f574c0b06407fee134e26f851b290e69f80bb4e3211e15
SHA51267abd3d356874aee0112a4a638571ae96a211acb8fe2a409969708a7497419db00006ca49feb0656970de044c0f7d6531257799e96b515897812fdd389c51aab
-
Filesize
173KB
MD581c5c8834ede1ace54de49756c877f79
SHA17926d6af828e74e082478fe439163a7a7425c2a9
SHA256226605bc17f1194a32090e83a790512d0e0f2d18139bdc497a011eab04e77ca6
SHA512c1ce0b664f79ec15839a56322c18385b65936acdc7c68b5d2b5f1c0edc5ab1ebe6341303717d5156a33cd35fd12098df838fb98958ceb85c1dfaa52907f2334e
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
Filesize
252B
MD50415725767744fe31f034ca9f8840abe
SHA1d7d816d4a237e2852f0b42f2e6cc24b19f087b02
SHA256073a32f25f518c486201d0e91a68f73e58c6e224c94392d72c8531ab3d2f9044
SHA51208b3a37cbd8740f575cde4e2a11c540e8c5045e5b01e9c90ca39b0597e7205afc075e60920fecfec8ce2378997f6d9e3c3f78b39753b40d13b0ef0ecea3cb9a3
-
Filesize
342B
MD5f053dc1f3a00bb50e4994d5ae4608d6d
SHA144f0a534f15213a8e24391cc5f613576ed265cee
SHA256c74495ddf1194092080d2fbdd05cbc74bd86833c66b085047606bb62e11c9bb9
SHA512df92193620467a765a3ebb99197b80e0e69ac73c1d29ea0111ca8a637ec55b13d8a7791c1030a01a8a0a46f17412c4fc112c96d1f345d7ef6f43fbbc021e866b
-
Filesize
342B
MD57a4418fc8cf66f2484fecf250ffd923b
SHA1815b38fab00833835a22d1f087e1ea3a5a9fbffc
SHA25691a0ce926980a058c6e59f1cf573e17c1ccbba5f2b45bc05304360b8a1ca5050
SHA5123c5e85e5b06d4833e1f50d9a1cb3a8da2c27d0a853f6f03d5f58c33963e9c057c3d4536f322be8c023b22fc66368e54926b6402a2ba49b33b0e73201e8604ada
-
Filesize
342B
MD585890cdb65340da0830dca56e68845eb
SHA1152d9a36d235346076b300d603074565329f5c35
SHA256bdf1e4050739d63a54ad2c6d4cc3f62795b103deb0bca2fd27b2634bc427ba0c
SHA51288a79a3e631384824e5efc95509e4c39dee0272adf48577c4ef5b72937c88675be41f98fbe8f23f27bce16852d0c7b5e522031da33e36a77f7e2da83b4b4ecb3
-
Filesize
342B
MD564d77440b3e95623b86960a2685867b8
SHA1336c573f0122ee6761f0a6c34e24d051e526eaa7
SHA256a382607a407efca32fe70766ac0cc806e49bee6dbc695de495816aa44e0aa3aa
SHA5123f14f6d819a5a9744c0243ed90cf1978bc7a3cc5acad1eb8b6cbb405b395fd85b0ed340906c3e1c60d9d05abb91bf3768f643b9d716403907eb148cfbed96ad6
-
Filesize
342B
MD5088072dc8d883c938d5cbbd802a97b57
SHA1e28b7ef264fce9177d0f7270a32165314b8131f1
SHA2561f7e370247a869f50309cab615b778c342a3088fbdbc833585bd71cf84e4585d
SHA51278a77791b36e32bb43f2e154357ca55ac038429d623baa2221e9a85255b8159cccc5028e184635da06a24d9cf96a573e2996cd7224d896da2e2451868b61e56b
-
Filesize
342B
MD5023e48d231e70701c813ed0b3791cacf
SHA198b2afc6470036821571cdaf338c4026500f0704
SHA2563dab9d821347bd931665f8168ced66b19311f8e49514a53c398218cfb53e0fe4
SHA5121672fccfd3570fc6f918dcf4401d9b5adc820c3a0c41860b48523709bb73e4618ed611c55ad9e71ab90489400fa37f11bb05d618dbd3204db9009514194fa195
-
Filesize
342B
MD59487344a3cee16033b3c89232436a3d5
SHA1342ef894edc8824d249e468034a0cc267845ea91
SHA256fd67478487c53daff1b00dcac74715d9736bdc35a4574b4c8e9a8aad0ffdd03d
SHA5122919c989a547b23407cbf65d9352097f88ccddf3dd38946544b3809b1e702dc7c6cf29351402cc18bf00376ac8915122d1fae1d48bebc3734d016a542c988bf7
-
Filesize
342B
MD556cc363288e382f8f53d591d94c4a82a
SHA13e3361bdfef0985c7ebad78e45384a7174437a4a
SHA2563be9e68c34a0b795649e83c2f5a992c6b90e0c5f7dd00092744657ebe3eacd6a
SHA512f58d0599844c5e71257074ca4e3df0e4a7f7ceb377b3b5b457359676ecd6ec6d5bbe08d5c6769d7c5a8ed264550b7cc7a7a35477b4b16982fbb82b688967fb2e
-
Filesize
342B
MD59aeaf35b13754e4709172b17c4abb66f
SHA126b2fc78d2effff8b63d20fa02d2b29d0951cf93
SHA256908ac61a811df11753d8123589745f687794440dde886c3f05a31e9d65f7ef90
SHA512c00c4422c6bb33cc2ba958879b24165776b4d2ff02e4f46961ea60b88ec8b757e399627d38be03042527c7b1cd2a2d0c0d459658b6e950122084886f537bc377
-
Filesize
342B
MD5de9c2a037e379c1a0325b7a0a369b44b
SHA1b15c345353b4cbcc1d04facb45f52275214189d6
SHA25638d2a54f1f16b368d4dcd834fff858451ef414a01cf108baca02f49cf2d2f722
SHA512466ccd65e775f9b6990fe23ae7183772577070a4e9385c42ee566a53dea799294489af7589df0af5be634d4821e3219cf5b280311e41b5d9f3b7182c30e06281
-
Filesize
342B
MD5a97db9477726f1489e11cb1dbf522a7e
SHA1b550a4018d937fecd2cbd45b7328b999dfbfaa91
SHA256373de0aa95967491ed17c6a0bf0354236a6bd85ae551a454b996c10d0afd8465
SHA512e30b8d0bc8d49e44173d994429c566340984588aba604910a2ab6ab4d5f8f88803776900c14f1778b1e473c4d298060646704679fb548b1ac72bc9dc292016c5
-
Filesize
342B
MD57b90159ee04fa22666a8df719533f1e3
SHA18f05288756580641abf4f0bd10619f3c902885cd
SHA256468bb8072f683f5ab7655bf2cea832689b351b41cbdbe022f2552d7596a69bf6
SHA5123721e12cfbc40c64f598e2bfe6dfcd0593ccccfbccc36c1a6776e94cf2370542d74782025c526bf659ce158d272f0b5d0d384906c913115609a60f6b2cd56fc5
-
Filesize
242B
MD52cb5c617a496ec67802fac394ca5b94a
SHA143c0108e0086a84770e1b328757df9d5dd8fe79b
SHA256c6160dda7810450a6aa353ec626fd04f234e7d7ccb3dfdb674ec69a070b61fa5
SHA5128328110e84e036b0d79a3904688697c7c583128d805dee63dbe037c1948e33e92ce3111faab4db204338749c45871547d1264c2cc4c2581a83044c1637a10087
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
396KB
MD58c23e7c480280c24c6b34c9c9bafc05d
SHA1de75bf5f2115fb3399d2c94966218f91dd9c2362
SHA256d898a79292edb0059156844e559cf65ab68819786b1d344dec42993851751740
SHA51204a631fbd1a3aca23956e316716375a77328471025f8391971aa33315ad8245419231f3b9b95229b1999c24c240ae97436ba9fcc3216d1a5b63ff75de9e9edf5
-
Filesize
2.1MB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
536KB
