Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26-11-2024 17:25
General
-
Target
a334ab3396ed6d7d152c86a41474210c_JaffaCakes118.exe
-
Size
376KB
-
MD5
a334ab3396ed6d7d152c86a41474210c
-
SHA1
d92a16044e1a34304d9c8f722dfc1a685eb67094
-
SHA256
cbbe450bc39c7c5f00140f416299c0302b890c516e80a51e2f4db40362c6aa8e
-
SHA512
ec455d4bef69ac8a11461b2efdcb4bb5370a85efc81a773157717ab6c8022cc9e36e55d6aab642c21c157f2e8301e8232550661502e01a25234c4121388496d0
-
SSDEEP
6144:Ze3rNhMeYq4CGRTs4kadSoKVStcmTVn57CpSCwsUbg62oXd:ZY5hMfqwTsTKcmTV5kINEx+d
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+igxwx.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/EF14B3F6C541604
http://kkd47eh4hdjshb5t.angortra.at/EF14B3F6C541604
http://ytrest84y5i456hghadefdsd.pontogrot.com/EF14B3F6C541604
http://xlowfznrg4wf7dli.ONION/EF14B3F6C541604
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Teslacrypt family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (417) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 6 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a334ab3396ed6d7d152c86a41474210c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a334ab3396ed6d7d152c86a41474210c_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a334ab3396ed6d7d152c86a41474210c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a334ab3396ed6d7d152c86a41474210c_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\ntrrshngkbht.exeC:\Windows\ntrrshngkbht.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\ntrrshngkbht.exeC:\Windows\ntrrshngkbht.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1832 CREDAT:275457 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\NTRRSH~1.EXE5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\A334AB~1.EXE3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5d65d276f8515eefd20fee9d79953cd03
SHA112baf9d4e8abeed21041d974bf33334efeb70904
SHA256a1a637d9a5c507f47622ce18c89b008e90e4ff51b4d3b9e8b1ef70bb37ab0dc3
SHA5126f4837f169918094300251c63f9657daf4c8223c9dd85f22805e09029bb8740cf91d014a516b640c25d04160e6fdf6cf2495c16e2bea3347b32a0663b9a29de1
-
Filesize
62KB
MD510ebeaf7663c4f47b64776d3c322a57f
SHA1b1ea5cfe6a370e50c39de06243870a20f77c21bc
SHA256320423d3a8b2f9c535dfe1c4b5d90225d19d5fd5047d5177bc2332c1e33fe956
SHA5126fc746210270f42ed2a54172629b092f3dab634d379ee51d005231a5765a5b4102c0e6d8c83f4f150562de6797ee38d881a5151c8bb6d00d80b618d209c3ce52
-
Filesize
1KB
MD566d68e914365d5d2bef4beeb4c6e21d8
SHA1b0be78af99454869637fad0d101efa8495de99a6
SHA256536d278cb6bfa163d55e6946b49d89a0b4670ec0d75034d61a25a7f54a8305a8
SHA512d2b492c91df29185b33e110c3bb682be968cf2640648d15a1ddd3ef4034239a703510de34e43912320b17732fba350665c03d955435b22aa01b4ff95a0bd769e
-
Filesize
11KB
MD5e0c5d68a452add75f5fad46deb0bf583
SHA12786ba94edd51a8fa6d0b597d028ac1606c061bc
SHA256ad815718e0d7a6370c522ab493978bd7de12ce2698af0388e8a91d37e28be942
SHA512112c7a566fbb68d7029b6e8ad5ee5fcde714b24946cce5f23c2e54f2df7228bd2a0a4c5741608ff470511a92f9bd550dfe9d5eb064eefd73dbfb7beadce0534d
-
Filesize
109KB
MD599776ad66fc8c57b81df0a60cb2d880b
SHA1556a0f95eb89b6e845522eff74a8ac9eb57dc3ae
SHA25609f8ceca2ee0090044949467557b9a7cebe18a2bb53fff67258c5f65993b4b77
SHA512d0fc711878ace4ee4ee710ded2f02a3e362e78a06deb8ee116cde82fae6c999dd919f91fb48bbac1fa539f2a73055acbee16dc8397632c4d183e0dd625b85324
-
Filesize
173KB
MD5ba70f498263ba737f4588c15e9445f9b
SHA15987c83ed654ed76ef4f342ed7eb590087af89b2
SHA256d2b9198459b30a0093a6ab7b8081f7c0daa8bcae404e40d6a81471fb1169935a
SHA512ffb68c8a099e3e634aa43cc8d4470aa742b9c21d8c650732a11a7fb8086d8582842eb79994bb469e6782e949d3f5956099c9421d79414d97fc0b02016452304c
-
Filesize
342B
MD53bb297be754d1c303f2c833965a6e235
SHA17aefc189a15eb160fe14336911e1852961a4950c
SHA2560a7d995dc879867256abe20f0238a6a04bd1a093cc9ba439163929eb9252f5ae
SHA512a5cf18f2f6e3c3477b59b721cfe7195c5d453440d8ada32a999b9b0811dfadaa714cb9c2343dfc8ec0c8cb42144b27d4cae442afb78ff37507e71cc11d027125
-
Filesize
342B
MD5a62937bff64f33c59fa2fdc26edc59e1
SHA16deb99146bbf5f2421de5b87723d0f27f856470f
SHA256f666c68145871affabf99e04da7fb8f09bf95c0dc447f5c3e93a483c7a51913e
SHA512bdbde755bf512f5f0c7f7dc904b61f3e3e7832dd078943273c206a61564db8efb72c9c10103e6449d6eaf003fbc51daedeea9fbdc25f63ac8c6b1da52296c760
-
Filesize
342B
MD553ee0ba850fa153069bfb68ecb2ace78
SHA1cc8479a1ae68af4f4a01875edaaf6695bbeda17c
SHA2563ba89aa368eb00e3192dedafb390d61beaf4512ac582dd3113ba87924ba07a70
SHA512686312b3fd1c4eaf2ff53497461d7fc0bda27403569adf08189b313f9f15136cacd9163bcdc02ab8176e0c0d7fbeae14270130c3b6a030ef4d6252f980815fa4
-
Filesize
342B
MD56fdc45b9a25a13de452e3dce49b45a9d
SHA1e8196e41cdad0a5e5babb8cad11832d9176849ad
SHA2563d9ac3a047e27e318198454fdebdff9c25f5bf9e2c48154ae76b46fc0754b92d
SHA512a9e1dd6496438fa88459ecc63067974719fbf12faf06dbf7ba2b842ab4306d2179921c675eb643b9fba54eaf2aaa4fb2eb1055733146752ef6146e797de2b82a
-
Filesize
342B
MD5c14d0c3c3e989ce2c609df51fb70c438
SHA10ae6b0d004e5a8d18c768cecd861beee70b16200
SHA2561b48ccbbd6f5af76acbfcf257f42f30bc97524202f71560c3c99e0ff35e1041d
SHA51228c6a5ac3f2a007ce07ce0ace8002f0e28127ce0e788217d7fe39f019f1ed3953795aa8ae5e4cfa6db73df3fa7dca919d1a5ed5352ba5b3e8884899e1e8989fe
-
Filesize
342B
MD5c401207f1f5a588c91024554d467c281
SHA12d66ac3022485094bf8a1ea5930115148f4fe1c2
SHA256f8ac4886ae430719384986e75ee35848ec9785ce3c527dbd9ab27227f379ce1b
SHA512aa377bead1fda7e3c49cdd36384a1b938e23be6aa4e9b2533c1c30858bdc216718eb6c3359362ef20d48d0254518b9e494bd8c3ef2a0c95a50815de31f3fe9b9
-
Filesize
342B
MD584b91be2a70b4a81de02e6a7714dc472
SHA1bc1518da2862887ab90ee91ccd3657b937930102
SHA256cd8b51343ea00d56bc2f6f36877d548b79db04490439ed0e9dae521782cf5af2
SHA512d7f1744bfd93a734e5560ecaa0d853cf5ab0306498994e7a4f4e77ab35077ce35c80fe773c9f89fef86d247e84d253c5ff9f7e228f9d531ad201b7e2a3eb505a
-
Filesize
342B
MD581484cd4c40d7b434b48cb5ae0870b31
SHA11e89b82da2844577252bbcc7715d04300375ec6b
SHA25691d24ed5208fb5de1aecbdd9ce24ef584d4933b4c76732b9e6e1f68cfe7ca57d
SHA5121bfde152282994ad5ae81af0d55a82186086440d6bba7c0bf67df22ea79db74f52400c23edd7e9f9fa8c022a44768a4d51c13ac3cdb09a16a177fae520e03f47
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
376KB
MD5a334ab3396ed6d7d152c86a41474210c
SHA1d92a16044e1a34304d9c8f722dfc1a685eb67094
SHA256cbbe450bc39c7c5f00140f416299c0302b890c516e80a51e2f4db40362c6aa8e
SHA512ec455d4bef69ac8a11461b2efdcb4bb5370a85efc81a773157717ab6c8022cc9e36e55d6aab642c21c157f2e8301e8232550661502e01a25234c4121388496d0
-
Filesize
8KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
4KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
1.9MB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
8KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
