Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
29-11-2024 10:21
General
-
Target
b09aca00a8dcded70eeac6ec2b497e60_JaffaCakes118.exe
-
Size
376KB
-
MD5
b09aca00a8dcded70eeac6ec2b497e60
-
SHA1
9247ba9335b88b4fc1d8febed66e92e4aad8317c
-
SHA256
b45ae8dabc0e3d299a47425c624d526ce6668728499307d77acb6266f4c4ae29
-
SHA512
f3c2a80cb592a721f454773f8aed5ba09b96641325effaa92821be9a3d80e99522100610c10ce9d4dd8ab97a60f182b9e9a3a7d1dd18505658858dcb30ccef02
-
SSDEEP
6144:J+lMnaN9yLmfyoZjcbxstF8cIxnTYI4LVmKJ7t2AQeRi:8TN9xyomFstF8conTCLVzTZRi
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+lfdil.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/57954348361F68D
http://tes543berda73i48fsdfsd.keratadze.at/57954348361F68D
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/57954348361F68D
http://xlowfznrg4wf7dli.ONION/57954348361F68D
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Teslacrypt family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (414) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 6 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b09aca00a8dcded70eeac6ec2b497e60_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09aca00a8dcded70eeac6ec2b497e60_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b09aca00a8dcded70eeac6ec2b497e60_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b09aca00a8dcded70eeac6ec2b497e60_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\uydyscpobgeo.exeC:\Windows\uydyscpobgeo.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\uydyscpobgeo.exeC:\Windows\uydyscpobgeo.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\UYDYSC~1.EXE5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\B09ACA~1.EXE3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Indicator Removal
2File Deletion
2Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5d64e5bc287114770603e30805c561d80
SHA1ca8d81d8cd270ebfb44bf903be141b22be4b4a4d
SHA2565bbe1926535141116b34e2baddd444b92d2640a5febc03b57bba285c883039b6
SHA5122bb31e6cee4ed20a618ea132b842fe1d479f7881c768b018294d352b864f41dfa63c76405297ba3768dce21ebf7adfa6ff965c2c80b54420c88890dab350987c
-
Filesize
63KB
MD5e8503dfd1ac8dde7391c5601eaa2473d
SHA1ce7a564e3eb882583934c14236bb10abef4737ac
SHA2564fde6a94f94bc6ba03cfc97be2858d6d06ed42b8f0c981a7bcee6003d351739b
SHA512fbdaa3336ab218e097a41d98393567f991cddef3a4d112f433d2c0e37e56d9d3b752fa9b4869776da29c9fa4e2c99c30316ea4b715f432ce27515ddbba38fa4a
-
Filesize
1KB
MD57b09ceda63a16e548431b994b82c7e44
SHA162d7cdd78e81228b9217e43c68ff5326bcd0ecde
SHA2568a447f0cd96a2d5037cf2c095e80f2798b1f67273f75ccb2b7a012509922144d
SHA512c4f0a416708c2be7713c9e57b38d57f6c975e8753ab8b1c624c789f031ee445c1eaabf5598149afa27834d7ad487265f4705504bad660483b91f8ac383178503
-
Filesize
11KB
MD596a6625721ed95649635ada0f75da28b
SHA10c543d9ca6d36a4fa4ffa0abc9bd7d67f2bae7d4
SHA25644439deaffb76eb1f0d340832bc73fa66509bc5dd72f0eba00f09c65d8becf15
SHA512858fab350c4609e1563da62704b6a9e8e5fd7ecf894c3c1f53d93779959990e0a1d0ded9180e48c4045358aa447854ace922ff1a204765564b51585977ad6fc5
-
Filesize
109KB
MD57de7adb4d11e1ff35a8cdb5cb27804e1
SHA1530d3a542b7edfe84787e754dd6b70aa8a1cace7
SHA256af9893b6b72b1e6e15486b371c4306cc0c4bc6eb864f68f4f2b37cb44620aa3b
SHA512d7de8289cb9201bc105487794abb6f7b65a0005fa1da70a025b607b7fa020f979f8806aff011ddf4f4740beae5b3ea3bd7d29b3aa18408beefbaf2edbd866fe0
-
Filesize
173KB
MD5620594d34429ad1c017f4306a461d175
SHA1fada4c321372e289ea0bbc4b986b52e1d5434994
SHA25663e1d4ce48052a0484cf093aa0bbedc89a715d2740371144b3973916d6a380e2
SHA51224bf0306184d8902c8518836b3c613618e6637b8359fd5ad73fc1b858ec5ef7b33ca6af6cb48e5042ada5583a0fc6b3839142a01671e67a76fabef119bee049c
-
Filesize
342B
MD51087c2a264e0b4fc9af8451eb420091f
SHA1de30f025f8d431038960f4d0997ccb8c1919febc
SHA2563406b887e1f1c45b1c77923455a9168a51a44d2ca40a29faa006c45b97b56a3c
SHA51285f9f9a84024390e663178fcbfa71944c09ee9be9d2dcc63c08637367dbf0b4bfe83bf3b397ac5c9566d6669b1901bb9adfb686edb45bbebc622139492239d2e
-
Filesize
342B
MD5627b357e527200c6895bcde05d57beee
SHA11c7651bcb0b1f501906fb519a81994613225046b
SHA2567fd44538435efc9057d675fc4fb1c8fb8d38275d6017619cdfd0e563ba84fa46
SHA512f3d4c8b05e4a16170b2f022113596ec23d1276daf21c3b94fd8703e08ea4f398092abb0203b4f62d628588aca10feab926a1e06fd87f434828c55f85862d64b6
-
Filesize
342B
MD5ad7427133f5e2b7e5e9d93bb7dfb51c4
SHA1790311c8826e8fb5d294d88abd343c7f86a93bb0
SHA256badf69c006ef26b65fd3dd421570b530fc8e1cb69261eb62eba78aead324bbff
SHA5129112775d15c5ea197c2bb67fbd00b8c3ad6d9afb30636650a933cce5c10190d663876cb836f2aa09f6cd39cb6b8e1745ffe6f98a3f7932505002fb64076844b0
-
Filesize
342B
MD5a0350f0a0a74189228b4038e8aedb0b3
SHA1b3ad2fdd20f80d15af7a70c3eac93913d8e03e67
SHA256640b0fbb2cbeeba552e014e4dcdfb7f5ed98edcab1ad6a54eb0d50cfa5ba9589
SHA5129bdedf03ee05f4402ba963e98b3408cb3e9bad7983e02166236bb40b33076be80901625b9e3c9bd350ec74444bc14d6b83d394300082b85389855df6864de586
-
Filesize
342B
MD5bfc16add195089420f8fcae29b47d341
SHA10524046b8698e07e387770212c211cfb8b929ead
SHA256d3ca786aef0734712761c57d4b6a6209225e6be5295c766e90cc461b825ceec1
SHA5129146d96f44d4e98711e79ac03fc113be701759a4c8e8a37261824df60372b63d659e01d0b6f02981b2400544219039b902486551c2a7502ad98b7c4b2b5d9713
-
Filesize
342B
MD5a6d30e526a9c98693d5c158fa2786af3
SHA1cebd4c7da3cb895eedb7ebf36e2b1904383199aa
SHA256063c48937ab5e86132d06240a94f6e8b01363e4a1ea24b30144fe6ae662265a3
SHA5129ff881c25e0f894fa52353539beee334b00a11c4c4c326a47c92e27e0288c8f399f1145adad4c0d838faacf7c278ef45f3d9d5aa39fc7b1d7fc6c3ad90e19158
-
Filesize
342B
MD518af9f1ba59c1fb5a56c64f01cbf6e02
SHA1294939cc050ebab16d82e4f9d552b575b72b8e49
SHA2563dcb418c594b77f4e019e7918b05decabfe3e2e6472938a2a14f59cc8df24695
SHA5127ca9c88381ed9985b394be04d7d297c5cd8b07ff4893ed759e739e32345d07b8e89a19026ec96e5fe371dc6e1a77419db79c0fecabc8941c65354a7bc5599241
-
Filesize
342B
MD53a14feba41880c331a6701147f4a5ebb
SHA183ede752d50b80527ea1d462ce3a74e12ee3a62f
SHA2568713af489ce393ce67b4961c4ffd2e2e9b299240305eaa0b6cf183f1b20977b2
SHA512fd527b7dca4901709963283745ca41c9f7108bb9f16d96d7d9e7441cdec30001aaa6c5486f2c641b12a4c8d756d664ca30b5602618f4970db8b9b3ca06ddf622
-
Filesize
342B
MD582442b645f7bb64a52c9ee3ffd21af0c
SHA12eaf3ab5b40646b20ee37ca812ea0dfa7172679b
SHA256d69f67cb38035d9d3a58aabad439ec9213e80568453ae52861ec43990aa4420e
SHA512d1f18c170d458ff5d8fb7268a187f02625477a2207bab96facdff2c9a8ab262b2618e02c51c7082798bbf3c56a9165f6a46134c8f1b83b3ce1791486c4e1f3b7
-
Filesize
342B
MD5800f8fc48bd9e88080fb395c5c4599cf
SHA10822b4d42c49b6f30b625587a424322fb5ab6a35
SHA2560ed8b8aadf8cfc95aa8f81f1980f2d9b1aa8c29205b58f3f0c195d874d4c39bc
SHA5122f1eb2e8ea64cb15f71e7c2dae16040478fc79ac50bf7f20ee41e762f3dbe3da887bbd6263e71ce6b15a17da0d801dd6dbbb0ffc6ea4f2d07f2e6763cd19f08b
-
Filesize
342B
MD55caf29a16a3472fb4d89fcb6a33725f7
SHA1deac503605e630549808261b0dc5c6af185af634
SHA2567367e9ddf440d570c799806dae6d4a03b25fc7fd31c00b81af230390371cad3a
SHA512a4276326fe63b873451484eeef04e6fb4d385eabbe145d25f81e749f15cf794e14fbd77d2ace857db04d2c1e45e59eaa280f1cbec140173bf61754e1500f4259
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
376KB
MD5b09aca00a8dcded70eeac6ec2b497e60
SHA19247ba9335b88b4fc1d8febed66e92e4aad8317c
SHA256b45ae8dabc0e3d299a47425c624d526ce6668728499307d77acb6266f4c4ae29
SHA512f3c2a80cb592a721f454773f8aed5ba09b96641325effaa92821be9a3d80e99522100610c10ce9d4dd8ab97a60f182b9e9a3a7d1dd18505658858dcb30ccef02
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4.7MB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
