Overview

overview

10

Static

static

3

97020660b6...18.exe

windows7-x64

10

97020660b6...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    24/11/2024, 20:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    97020660b63757de9c0e8ad51eed9acf_JaffaCakes118.exe

  • Size

    376KB

  • MD5

    97020660b63757de9c0e8ad51eed9acf

  • SHA1

    bc75b2b04ec8591829a69a7634698c2d7ff406b5

  • SHA256

    9c5feadf74c3a5ce0b40d5402f0f1ded6aea80b517c016a179b02f38a22aa489

  • SHA512

    a6cc6b7c7c8d16419b826affc813ea5cff9501133c5bc386217fa686c35906404a937630bdbcdee193273e5c22872f891e1a40d332393480c8d684ea8bec0f67

  • SSDEEP

    6144:ie3rNhMeYq4CGRTs4kadSoKVStcmTVn57CpSCwsUbg62oXd:iY5hMfqwTsTKcmTV5kINEx+d

Score
10/10
teslacryptdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+lkufq.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/8AE376AEAF8819AF 2. http://kkd47eh4hdjshb5t.angortra.at/8AE376AEAF8819AF 3. http://ytrest84y5i456hghadefdsd.pontogrot.com/8AE376AEAF8819AF If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/8AE376AEAF8819AF 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://tt54rfdjhb34rfbnknaerg.milerteddy.com/8AE376AEAF8819AF http://kkd47eh4hdjshb5t.angortra.at/8AE376AEAF8819AF http://ytrest84y5i456hghadefdsd.pontogrot.com/8AE376AEAF8819AF *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/8AE376AEAF8819AF
URLs

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/8AE376AEAF8819AF

http://kkd47eh4hdjshb5t.angortra.at/8AE376AEAF8819AF

http://ytrest84y5i456hghadefdsd.pontogrot.com/8AE376AEAF8819AF

http://xlowfznrg4wf7dli.ONION/8AE376AEAF8819AF

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • Teslacrypt family
    teslacrypt
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (376) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 6 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\97020660b63757de9c0e8ad51eed9acf_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\97020660b63757de9c0e8ad51eed9acf_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\Users\Admin\AppData\Local\Temp\97020660b63757de9c0e8ad51eed9acf_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\97020660b63757de9c0e8ad51eed9acf_JaffaCakes118.exe"
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Windows\qmmhrexicrfa.exe
        C:\Windows\qmmhrexicrfa.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2756
        • C:\Windows\qmmhrexicrfa.exe
          C:\Windows\qmmhrexicrfa.exe
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2580
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:520
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
            5⤵
            • System Location Discovery: System Language Discovery
            • Opens file in notepad (likely ransom note)
            PID:2792
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2500
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:3016
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1160
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\970206~1.EXE
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:1716
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

3
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+lkufq.html
    Filesize

    7KB

    MD5

    6dc89e3c0232db39b91d65ef7e532975

    SHA1

    2396cb673fb8b6e1c4f9645dc2b711d755e7706f

    SHA256

    8eb1573d8b82d58373055eefbf75cab91d981303391b308825f07b7b110e085d

    SHA512

    be18893ba0154ece3a79f1381fe113216c936343515fd8d09472178b742cbfb6d060ff4c4055eb27d9181273ee786430787e151cc6cd90bd4e4a2b068dd7f42d

    Download Submit

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+lkufq.png
    Filesize

    62KB

    MD5

    bb0e2d6a5f15fe1204e6f50aa36e7998

    SHA1

    09bdc94d1f69ca5a64ccd6de28e8c674f5bfbf04

    SHA256

    3e36e7feea99505ef32836e950ae267307c07480909fabb8d56d97331825a7a6

    SHA512

    40a6d0a5795111baa6c256c5eb7c981325eed4afd1f2e79e6e385c5e3c77906ed89b25a1fb21ad3120e205d3a79f996c6f269d6059ebaab8393c4869090d087f

    Download Submit

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+lkufq.txt
    Filesize

    1KB

    MD5

    5d1f2ea046005b65d9234993a6774c3b

    SHA1

    78fb553e9dfbe546ea4aa8fcaf5f3af392f4a122

    SHA256

    edb60010385fa8b21e1fec7a4abc1a24e519326050d2c41f0fe8c6b935528d7a

    SHA512

    91e8b8aa88d20fefdeaa7754ccb5345d8a726c8149d2c273b4850966df819ab631a4cef208a84b923458d03015747d10b112a92486de4c30c31c5072ddaec2c9

    Download Submit

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
    Filesize

    11KB

    MD5

    e981f95180129c56ec2febb7deb3a392

    SHA1

    c0dd59f7ccbbece54c11f9e21965bc4ec7df3241

    SHA256

    fe87b995c152e89efa9f38d2cc8f5c3097e40757738c5d6c87ee6226b836e6d1

    SHA512

    012c56885575284fb57e94bfa22af2dd22eb12df95e62ddee939732acc200b8479a38aaee452502e159846eb61b630c94023f190090785186d95b491fda9c7cc

    Download Submit

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
    Filesize

    109KB

    MD5

    7924574fe8e396b6fee492b51320ec29

    SHA1

    f2d65d5792d6b58ea4d8e6f8748841e493493740

    SHA256

    68846a92794fb0497c6fd74dac83c052b89c174f4a776e63a3870f1f99fef261

    SHA512

    748d696922b324a1b0f0e4c8253589b76d6964f02249b503a6963479fae60948b0a3a03899257963da9178e7db1d898058f2fa3ecd96b509bc15b70faa134b50

    Download Submit

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
    Filesize

    173KB

    MD5

    8a58869f52d4c415993fe65891f468aa

    SHA1

    5bee6acd572f342681d98a0b3dad0b2cfaf84fa3

    SHA256

    35a8b6f866b8412fbeb32bfd32803710bb6a24dd854c9c5a3bff7dcf0fc164d4

    SHA512

    4baed40ee009d887721036b7f6ddbb7f437f1cf11c959ad5db1eec02feb8a5ebbafa367fe4ca7aa47c467aa8c52300f29a82b77d7a9b566ccb8fada1fbf17845

    Download Submit

  • C:\Windows\qmmhrexicrfa.exe
    Filesize

    376KB

    MD5

    97020660b63757de9c0e8ad51eed9acf

    SHA1

    bc75b2b04ec8591829a69a7634698c2d7ff406b5

    SHA256

    9c5feadf74c3a5ce0b40d5402f0f1ded6aea80b517c016a179b02f38a22aa489

    SHA512

    a6cc6b7c7c8d16419b826affc813ea5cff9501133c5bc386217fa686c35906404a937630bdbcdee193273e5c22872f891e1a40d332393480c8d684ea8bec0f67

    Download Submit

  • memory/2332-1-0x00000000003C0000-0x00000000003C3000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2332-18-0x00000000003C0000-0x00000000003C3000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2332-0-0x00000000003C0000-0x00000000003C3000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2580-56-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2580-764-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2580-5935-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2580-5937-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2580-5932-0x0000000002830000-0x0000000002832000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2580-5926-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2580-50-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2580-51-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2580-52-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2580-54-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2580-5925-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2580-5129-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2580-4206-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2580-3339-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2580-763-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2580-2424-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2580-765-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2580-1248-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2700-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2700-12-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2700-10-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2700-4-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2700-20-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2700-16-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2700-19-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2700-8-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2700-31-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2700-6-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2700-2-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2756-28-0x0000000000400000-0x00000000005EB000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/3048-5933-0x00000000000B0000-0x00000000000B2000-memory.dmp

    Filesize

    8KB

    Download