Analysis
-
max time kernel
121s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
30-11-2024 04:24
General
-
Target
b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe
-
Size
376KB
-
MD5
b4c370efce46e7abfec0b147f3118b6e
-
SHA1
d08babb7e379e05f24270b005efd42c57834d6f1
-
SHA256
ce70e4c500aa39d8d43b1fc93909894c87b68843420b359f4017bec77292fa7d
-
SHA512
61573d888601dec15e2eae0777df7a15a5205f3af28c44349aa76f29d712f32d287dedb1187ca1121262b1f7715244bb4c31cc3e878728d77a28619a9207b30f
-
SSDEEP
6144:ie3rNhMeYq4CGRTs4kadSoKVStcmTVn57CpSCwsUbg62oXd:iY5hMfqwTsTKcmTV5kINEx+d
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+ssbju.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/F017C87C33958B9
http://kkd47eh4hdjshb5t.angortra.at/F017C87C33958B9
http://ytrest84y5i456hghadefdsd.pontogrot.com/F017C87C33958B9
http://xlowfznrg4wf7dli.ONION/F017C87C33958B9
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Teslacrypt family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (434) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 6 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\xjiodgtqkcvb.exeC:\Windows\xjiodgtqkcvb.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\xjiodgtqkcvb.exeC:\Windows\xjiodgtqkcvb.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:275457 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\XJIODG~1.EXE5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\B4C370~1.EXE3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5ed2e706c630a7def3771e3cf8287a935
SHA13c54253ca0e6ee373a0edf540f5347bc7064a192
SHA256b9117813a66545eb2c20805deb913baf369e8fd6170058f379010c07bdd751a5
SHA512873fa6e6a8b4cec0dbd6ccb0b5aafd0215ca8d46e1ff87e43d50cf502a21f7ef311d443519b07dffa496f422a9ac8ef0074b806d6156fe853c9d110a3b55a9c0
-
Filesize
63KB
MD5797f8ca408086bd3ef05c55c2a887d6f
SHA1198fb11b556bc1654f1018aae2abe68b3919f0db
SHA2569fbceda23ec0008b52164ce419791668fe4dd216cb7b911eed85848402ca8e34
SHA5124d3b2f65152e508bf3e94b5005fcd1d35576fe4e63003551172f9f7149dc24b6478cfde7f0dc6fbb8af2e27644ab91c682a01faeb96e285a7cb0ae4f7db1b359
-
Filesize
1KB
MD581fd107f67d00ac05486ce7721da2a01
SHA10bd63cbbc0fa30c9337d0eae74cc341730d83cf8
SHA2564654bf2e250d46ac16df8eeb0e9f850e44a039786cfa3adb62513d6703886faa
SHA512b58a09cc34a777774c348a50920468a36f3352864c9a22181c06f79d35d4b911f623b094baf4fb0ed8a96252d18322a51733dfc805f47341f376901cb0300861
-
Filesize
11KB
MD5c581aa8dcf2fb39d34cf05b98f15b15f
SHA1a65320c964015234ff71792534f9aea5855ae752
SHA2566dfe98ac05a7395c52137737cc473d84ece27d21f317f7632b3d75bb1afc7467
SHA5125e7b108aef73249b7c4d76fb169571bb9784df1e8bbfc63232e8d69c577d3fcbaaf71a93fe8bc2645ed9236314ad3ae68c4968bdb444834827e1354918711111
-
Filesize
109KB
MD57fccd4e1f01d2c3b9ba0951a4a53f078
SHA141bd7f97e9dabff40ee6d6d6b5bec316fcf69870
SHA2569db5e64029a0f85bc014523e3900e93b4dca4a29f24e19f151959d2f4d67ee87
SHA512096405acfbfbc77a2db2abac4ea9e2c4276c3599ae1d40d1dfa36fa359ac0bf1224b519c6ba927d45e1b5e96c4c0a19163764b7d4b24a61fb653d1c8718a14dd
-
Filesize
173KB
MD5cac4c4908e5a10750932763d379fa516
SHA1398f7fb728e665149d80dde1ce7964f373b8a921
SHA256595329f9f1690f490f94a0fe696cbf7c17eb88a5e6ac925eba770a4c643f3995
SHA512e2a40874270eca0863e0b88afefc8a744692c95bbf104e32afe8be9da5720e3edd5052f37c1c38bdcedcc233c4248fac346e0a8ceb1d638c4e1165d2ce6f50cc
-
Filesize
342B
MD5c61e241d3cc7015ed12cd12672b82a20
SHA15113c1e87d430b706999d50b89665f391f4e7505
SHA256d7f141832e6741f1d26c9027d17a247f10f2a5762bbb94e696df8be5cd875113
SHA51281cd47d74140e4bc6996d240096eaa164eb0808f4a055d54588fb32a85a12affeb07ecc74e3d900c0099701d504bb9850336386e8ca4e4fcd5cc615822938b6e
-
Filesize
342B
MD5b1bdcd5c9114e2fa90327960dd5e348b
SHA19c6c96cd07808386d56cdb00552d3150901780d1
SHA2564a56b03caa1f8a2b2a25db341ffe726edb2748914d10298c88fabe3d54240746
SHA512cc445184a2a7324dbe502abfc2e7bb1d584eb5d17c51bae8029614f48584870919ee523c3cf969e353bb8efc831c2f35a492ff966bc163f58f6b61cb182ce5a8
-
Filesize
342B
MD57a6dffdde9b17f4a917255d136ce4af8
SHA1691db58ce2ac61c7018d6903d98e9e14987cc038
SHA2565b6a34de17dc7b68c6d446a4d3b395dc4851c8a4da7c6f3ab507cb50ea47ce90
SHA512219e2fa9b3e010a92ba126fb80705a9dfe811468cbb19ee99996abd868fab2a3b8ff2946918a68b60dbd0f924e272812e5a3e4808069a24e6b31b8cac987544d
-
Filesize
342B
MD58f6cdb58321e5b1f090d3dea87f05a17
SHA19970ffd51c9e143473c022b96befc299dc9a043e
SHA2562bfc49665eeef1a9b93b20b8510d12e2bc443a3061d94b0470b70e61e2f45839
SHA512a995c377ab08016769236ae65fe87c9f7819001b7d8cfbe618d38014e64808e3cf6cd2fe7e09dd4119bd1beac78880eef41c0db141a0496d44b41af38a474c6a
-
Filesize
342B
MD55d0794e5f5a7037aa31a8c84bcad48dc
SHA18809808880bfc28c0eec0cd08157b73296dcfbd9
SHA256629ec60e6e3ddb3c606fc23df6c9c0d2efb34fe6fa87432dabea3f1cdd1695cb
SHA512a999857021ee0310651066ba5562f2b6855b80ec86efa86b104e2bf4ba0a8851db06ed4267bb9d5b59ccd570af670d4c7cc1126011d82e1ec9d6b0961e7c7b38
-
Filesize
342B
MD548ff4a2d2616825d2918ec2ee200260e
SHA1b63dc12a0090935beb2c2629ce28e9d14b0f1935
SHA2568ada96f3ff32b35bf8e5c2e841960b3a35340427c3598e1ead5b794daed62c50
SHA5129af7d2d3d869cf814d8a30054981d5152e87141c937696ea447a7fd9164fb463faafb725698c1a17602a5ede88960b07e05f133c16fb51d67207ea4bd5d23d94
-
Filesize
342B
MD51c130ee12243c1aa7262041a5fe39752
SHA168d752c52203e55968a7e36906eea429a631ed5b
SHA2568f44e367b71a8820706e626a53e81c2c479484acc30f7bda92f49f09d631c682
SHA5122045abf0f48a7eaba1ed0700e0b6ad9e47b513b4c8b50408e674e383c005b8970eb5224dd90be8c5de54e648c8d5958e4e4393640be2f063a05df730ef921c6a
-
Filesize
342B
MD51173a1ee58e3c63d5ae7c9f7c50adaf2
SHA10e1335b3081f9d4b446a38c9a94519eff31f1353
SHA256e2f2952c965470cf39e695fa14c3275dd65dc19ff52a388c5d8cddd9f91a4ac1
SHA512f4f54d0e04e9850fd1dd14ccfd20defe11dc970654e08c416115134cb639f9fabf974f80b9aae0f7d20290debd15e1d7fefa2cd37f39edc0979216a3ab258fa1
-
Filesize
342B
MD58c2572ccff36da96b3920aa35518d518
SHA16428bdda9bcc605d01028e9137943c49e75aa8ac
SHA256b2518bc51138d508736345735ce618e805941e9f7a2b790c5b658ad9cad5993a
SHA5121c3f5c91e6efa29b461e1af07fca50c9995a5002a246753715924be4e33b3767a6a7c81a3ea8b423c01a00777ccc8408ec83355f9dd6fe3272f6df66f7844354
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
376KB
MD5b4c370efce46e7abfec0b147f3118b6e
SHA1d08babb7e379e05f24270b005efd42c57834d6f1
SHA256ce70e4c500aa39d8d43b1fc93909894c87b68843420b359f4017bec77292fa7d
SHA51261573d888601dec15e2eae0777df7a15a5205f3af28c44349aa76f29d712f32d287dedb1187ca1121262b1f7715244bb4c31cc3e878728d77a28619a9207b30f
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
8KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
8KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
