Overview

overview

10

Static

static

3

9fb86c5050...18.exe

windows7-x64

10

9fb86c5050...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    26-11-2024 04:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe

  • Size

    376KB

  • MD5

    9fb86c5050cc496dcdc3f53ee2c59069

  • SHA1

    ee358c3adca4413b6c30b146a8b33b70a230b3c7

  • SHA256

    a5643944606ce1fc7025ba988e0186ab8d37a44af5efd077a8934e36a41d8624

  • SHA512

    ecc5f28fe85343e1574112323e2f35853b49290100d450e5a4ca708c16f07018b5ae82be70bb5408d0e92183344c12d3612a9198fa7c641f61f8a5f6c536f21d

  • SSDEEP

    6144:Ee3rNhMeYq4CGRTs4kadSoKVStcmTVn57CpSCwsUbg62oXd:EY5hMfqwTsTKcmTV5kINEx+d

Score
10/10
teslacryptdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+tsbmu.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/2F5261AE59F53530 2. http://kkd47eh4hdjshb5t.angortra.at/2F5261AE59F53530 3. http://ytrest84y5i456hghadefdsd.pontogrot.com/2F5261AE59F53530 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/2F5261AE59F53530 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://tt54rfdjhb34rfbnknaerg.milerteddy.com/2F5261AE59F53530 http://kkd47eh4hdjshb5t.angortra.at/2F5261AE59F53530 http://ytrest84y5i456hghadefdsd.pontogrot.com/2F5261AE59F53530 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/2F5261AE59F53530
URLs

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/2F5261AE59F53530

http://kkd47eh4hdjshb5t.angortra.at/2F5261AE59F53530

http://ytrest84y5i456hghadefdsd.pontogrot.com/2F5261AE59F53530

http://xlowfznrg4wf7dli.ONION/2F5261AE59F53530

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • Teslacrypt family
    teslacrypt
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (387) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 6 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2484
    • C:\Users\Admin\AppData\Local\Temp\9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe"
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Windows\kewjbrwyumnu.exe
        C:\Windows\kewjbrwyumnu.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2624
        • C:\Windows\kewjbrwyumnu.exe
          C:\Windows\kewjbrwyumnu.exe
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2148
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2708
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
            5⤵
            • System Location Discovery: System Language Discovery
            • Opens file in notepad (likely ransom note)
            PID:1544
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2216
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2216 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:3056
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:912
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\9FB86C~1.EXE
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:1936
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

3
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+tsbmu.html
    Filesize

    7KB

    MD5

    e87cb1ae99fa5589b436b8214e4faa5b

    SHA1

    7e2e226802851c9acc7ae72c51f22500507795ac

    SHA256

    39956b0256cc387e29df6c738c66f83c9266d4c9da18f65094992b7ef21d2496

    SHA512

    43098fffb110e8edcbf7e21d32dbc9097ea47ac6e3cd54787e8c08d0b059d952e37fe478c8d2e67b83a397b17fb2ca5f22309dd76a13c036c113edb909f594b2

    Download Submit

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+tsbmu.png
    Filesize

    62KB

    MD5

    841f99f7fc17b2eba76c48c03f3a4095

    SHA1

    d33757068f75303a4fde5b83cb8d27e581991323

    SHA256

    28e09be0fc9e8fa1640642e1c989ff4328cc594caa1ae2d4b3ce8b310d90144c

    SHA512

    32f5e637a18bfef8ee9706f919accf8e943c0ad3b7f1555c8b7da00e0ab054fbca6391bf26d8baf14cdb14686d7133c0899e14b4e2b08101248124391fcd07c4

    Download Submit

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+tsbmu.txt
    Filesize

    1KB

    MD5

    1572858c48fa584a89c05bda2b83042d

    SHA1

    e3c3409323d39f59ec661b55846d95224fc4ce8b

    SHA256

    f448803ff1b490d2e4b604dc1c28cda913727fbc752a63314a13ac84621574ce

    SHA512

    e1ff8bce3780e9a2e68cdf0773729e551b43bf3848d0fe8c798b6d8ce7ea794a1781ad43e1d0aeccda8984380cc2a6fb88a9ec3f77c99c010f6425fc11247780

    Download Submit

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
    Filesize

    11KB

    MD5

    b68d0b86ae6c9693eaeff75fc9da3e2f

    SHA1

    5b312c58e842147c4858b0e96399794de39601c5

    SHA256

    2f10a0ba02916265b1cb71dee60070e225d2c61ed19b055a2f4bf77be220b391

    SHA512

    3e142c4747f0917b59778382a7d149ee43e0d2f06672863b2fcb5d092859685ff8c87f8f6121387cb04b0da9af9359edf504564e7a738041ccd5b2aa93b86b7f

    Download Submit

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
    Filesize

    109KB

    MD5

    40d04c95a693595aab381dc14e006bcc

    SHA1

    59bf93414d3b3d67dc23fbeb7d9310b49557f19e

    SHA256

    fdab46d57f9adf188e7ebc2c1565a5252eb770b07c2fe97ee5eb5edd369c68a3

    SHA512

    8c0f26ccee306795db15e87d34d90e034bf0060c86a37b8a60a0b3fe522862925ab8961bed32ba0c7cbca474733b51e44a7ac030e23fccc099cd77e56baa0172

    Download Submit

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
    Filesize

    173KB

    MD5

    a383e31e4312e53251a267829e58c501

    SHA1

    9ecaccd3ce3b4c9a835943b309cbb13f6c4f4d72

    SHA256

    b117715419063fdefa07a11984bdcad42b0ddfd6d8c9ffd949441db55e9b79e1

    SHA512

    f9a3964a6f128adaada44635f0c6d41531f330a1136baee79cf0b1e6b75cfd66e9b24ca962ad0001d0951ce6e3964e61e3508770ea8d004755f6c6da90a2864d

    Download Submit

  • C:\Windows\kewjbrwyumnu.exe
    Filesize

    376KB

    MD5

    9fb86c5050cc496dcdc3f53ee2c59069

    SHA1

    ee358c3adca4413b6c30b146a8b33b70a230b3c7

    SHA256

    a5643944606ce1fc7025ba988e0186ab8d37a44af5efd077a8934e36a41d8624

    SHA512

    ecc5f28fe85343e1574112323e2f35853b49290100d450e5a4ca708c16f07018b5ae82be70bb5408d0e92183344c12d3612a9198fa7c641f61f8a5f6c536f21d

    Download Submit

  • memory/2148-2553-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2148-658-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2148-5964-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2148-5962-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2148-5959-0x00000000027D0000-0x00000000027D2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2148-5953-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2148-5952-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2148-5327-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2148-4511-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2148-50-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2148-51-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2148-52-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2148-54-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2148-56-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2148-3639-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2148-1616-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2148-763-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2484-1-0x0000000000240000-0x0000000000243000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2484-0-0x0000000000240000-0x0000000000243000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2484-17-0x0000000000240000-0x0000000000243000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2624-31-0x0000000000400000-0x00000000005EB000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2736-10-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2736-12-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2736-19-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2736-16-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2736-20-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2736-30-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2736-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2736-3-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2736-4-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2736-6-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2736-8-0x0000000000400000-0x0000000000485000-memory.dmp

    Filesize

    532KB

    Download

  • memory/2916-5960-0x0000000000160000-0x0000000000162000-memory.dmp

    Filesize

    8KB

    Download