Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
02-12-2024 07:18
General
-
Target
b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe
-
Size
396KB
-
MD5
b774e9f49d4aa8a2a009d06a6cdb6f8a
-
SHA1
5eaf1e24c495634ecbf7c81b640d10de8a3399d2
-
SHA256
d3aef7ccd94c55c75a19d3ac6e31ac4af1cfcdd64e77be9afc4e5c8de9301686
-
SHA512
b1cdb65dd44aefae7933944a824faac70b1fe68267e245a3a1181deda7b8cb9016e502550cd73974b3fd85756602193d4db8a23e9f3622d0ed5c59a780b1aecf
-
SSDEEP
6144:CT3WR0F1lDPR+bJnm/jtowhxZWVrfQwBcTMMG26uw6fyQ7Q:CT3MA+bJmy4ZKfQRMh6
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+actia.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/DC47193B5203DDE
http://kkd47eh4hdjshb5t.angortra.at/DC47193B5203DDE
http://ytrest84y5i456hghadefdsd.pontogrot.com/DC47193B5203DDE
http://xlowfznrg4wf7dli.ONION/DC47193B5203DDE
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Teslacrypt family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (390) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 6 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\ejstnsuicpyj.exeC:\Windows\ejstnsuicpyj.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\ejstnsuicpyj.exeC:\Windows\ejstnsuicpyj.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2636 CREDAT:275457 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\EJSTNS~1.EXE5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\B774E9~1.EXE3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Indicator Removal
2File Deletion
2Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5d5213b6476358732074d70825acf1cc0
SHA14f2b80fdaf1264bcabd6845d3a8a756e5a0813d6
SHA256a88e4defa3c3489803aa29aa3692776ae5ad5ae57ef154cceed2f9db4499a3c3
SHA5125ec47364e50f97fb26a1fcdcc7e302b65925cb88bf71de0427ff8c2664482f8dd2b5aec3766b16c973946fce49b599b88177ab1cd38d56b9520fbb7a711b9308
-
Filesize
63KB
MD504be19f037eb724428d0db5e0dbe49c6
SHA13b404e5f4f49e7c8b4131e9445d790cb101781c0
SHA25694bbfbd291ebe850f2d8657ea4e29143440d901080b0835f1f6378725421ca1a
SHA51235670d278bcfa3082549b9d7a3fd82a5aa3c610ccd1bbcb65e0a74279ee0e92ed0454f4001e3d026c5a2864d0fd56b4f799bf829db3c714c5cb262d55e9bd829
-
Filesize
1KB
MD5161d4a74e85a221ad163af596de28c30
SHA16f0c88a060545dbccc92eaca1d8b315e3c16c133
SHA25698c40a534d7901b2b1d6f32af628a641c998000ea32f74025966563a25026392
SHA51287ec9a2f9ddea59d7c4fea6584488337ba0f5346b2c88565bc9c626b79be46ed0230586690b4f63b1d4d2c3758b56cce802ddc5a3427160e848b16f641d9c121
-
Filesize
11KB
MD58dcd5d7f790adb57b11573a53e0c2c04
SHA1f5c6806ef30a9ae30e0f4050ba0623a23f30f1a7
SHA25646fea7529b79621519a7df246ac89f4576002c877e13904e957117ea1e576067
SHA51298fc18e97e2cf125069a2c299fc6499a6d7effa2ecab7ef1ed8c16d7f74834eddfa80c9c0f1dd526d75e3ec384f73ad5ad605f1a99b9c1b2de5772676987068e
-
Filesize
109KB
MD5e96468430b84020e82de4f42eedc2d25
SHA12cd93b50ad83735ed97f823afebbc788649df6b2
SHA256abd7f00dfd463bdca4326a1b97b3ca53a4c1dc6085a598fc89df7a73ad4fd4cc
SHA5123cb07da6956c42a6b6c3b2d99b07ec8ca44d815ecf83d4d4d960b429e86e4145f32d28eb94e84fd18913c3c574803ac49e6d15b373387b9d9e8779b484b18bd5
-
Filesize
173KB
MD53342df137f8280ac79a9c22371a5c948
SHA159b0c8f38649648a0e0b5aea00e31324eb45181d
SHA256b393153102a38d9da2ec30522422224426614178b2c1b1dd0b825dd1120a687a
SHA512913b6638a75ebeaab653af2f0f30d9a3593ad0652e1c910266b5f35c04d9ae363caa82e98233b50ccf78afbd92d2043816fb5976d43d19458b399d5113c8fbaa
-
Filesize
342B
MD59f9b5196bc6f06986037543fa9693ec4
SHA18087d88099d9d1cf0af108389bdea9affa0e6ccd
SHA256a05dc778d44f26e4c3a4a6c40962151a0f35fc18c9d8b8029f233c76d4351689
SHA5124c47bb3d9b1956f3b519a0ddb9247264cfc9a64bb52a0363d15d6973bc292661eacff3a5c0f3e8b9b4c05b55e6baf0b6ea681d8d383ec4d7f8eada6abd3bff29
-
Filesize
342B
MD5855278eb558cdcef0d5c4956b37cfe2d
SHA1b1d512bbf6b8d04acdfbd92a272fb8dab04db6d2
SHA25688dd5a2203435039939d7ee0d91a84b4e795e03a8e0fa8b0315a22cc1322654f
SHA512ad7044fb70aefa4cc700cc4cc09b6d36e5e1d5cbe0207ed63fe4d38209c02fbe093c562489f5a562297892cd9975e7719bc57e63ea88367bec04e1f1ff347df5
-
Filesize
342B
MD5e970843226750f806fadf9e79b7d2cd9
SHA14c0ca81355e07fd3d89fea40025133b91643d55e
SHA256f4aaaa0fac91a8d1314a7c380943a90fc9a1d114d75107000eb11232c7d64a36
SHA51207e563074169cebbdfe49b4de874c1413f11d1da70ae4ddcafe6a51061c2f7a132c69ee00668c51bf5848a1b1be47c5c6ed171a33ca370d75608ddc185649172
-
Filesize
342B
MD543388b95c4dfa9e2171cd38e1d2ec695
SHA1db3d0554fcde90d2f86d16657e7dafaea71ba99e
SHA2562bdd874130774ac3bc5764e0d2d1d6af4d40131a227538e3b9ffe2dec7caa3f6
SHA512685bb1c50b09a9bcd0415bad51074459fd6ef80fe94bd09ce061739f4ea7fce2f077755e35a9157b1d7f1e27f857806a627e9974017073a1c5d5dde5e0e3b255
-
Filesize
342B
MD58ca4e83da3bbf3e2e02976a8fd283e07
SHA11d73a4cfa3452f25658e56713825ce93394998be
SHA256a4a944d66e2448fa9ddad479935553bc749660ecb2cbc239552054abac4a8812
SHA512f1864f5f8530ded52592add7e1a777b7627e9936c2a08cad8e911a91c10ec8fcc931364d63f2ddc9461944b3c752545f3e87d862dd7771c43129bc2f60cd5bc6
-
Filesize
342B
MD597b6f20992c6bd6274c029ed6de8eed6
SHA1083399fcc4288b1e8d7525f907025adce1aa8a96
SHA256bdd7e3a25d2410086c1b6684494ee8df3da52436e1adffc1c45421973c9e7a69
SHA5129b8e861508bc05aad715a058322877f75a924718764fe57ad988731e0d8b36b26722f37f57bf091ee7dcb126f9b986d2bb7db29d2536ec91f46d4db2dc1f22c9
-
Filesize
342B
MD511e329b6e6a6bb5ef9dbaab78d72acb3
SHA11f646fcee765f0c341de052d5d79c458f53c6c31
SHA25602a1deb6266db113903dfea690fb4170138c220dd15a51512e53810ef6b5330d
SHA51275f8f8716db185436aa797b7292e8da8ee06357a54a6aa724deebeed2a782c0c206797eb1af2deb6ef8170d6df5e3a83b5bba8ea182dc9df3a5bd55d32deb068
-
Filesize
342B
MD563e2257493371d065f5483bbbf530d1c
SHA1e6eac0035db036de00b3d47b4d37b048967a3803
SHA256b9a812bf473271a52de180d9d61425013ed523ab24a4cd4cfbeae2dbf91c3aac
SHA5121add32e26bfd308a59733724bcd1ddd4a5affdce81c7757907bf07be0b8acbce81f943ae43607098c746a4ebb8006c97bd45b628728a7c5842672faa614ea04a
-
Filesize
342B
MD5729cf80e2468a8da85024b61975815dd
SHA13448f24b4d02d5e5d8a76de9b504f2339be08ea0
SHA256814d35e98a2d0302af6075e7c590d804aab4bdbd6eafb9205fec895aac797ebc
SHA51249caf8ecb3c7d69dc8e72de0ae7675f20856b539ea8acd29e9e409a593c8f278e7e2b10157f8c88d1119e01e95e3bbcd0636bc570365cde4fce8d8cb28ffe200
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
396KB
MD5b774e9f49d4aa8a2a009d06a6cdb6f8a
SHA15eaf1e24c495634ecbf7c81b640d10de8a3399d2
SHA256d3aef7ccd94c55c75a19d3ac6e31ac4af1cfcdd64e77be9afc4e5c8de9301686
SHA512b1cdb65dd44aefae7933944a824faac70b1fe68267e245a3a1181deda7b8cb9016e502550cd73974b3fd85756602193d4db8a23e9f3622d0ed5c59a780b1aecf
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
2.1MB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
