Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09-12-2024 11:25
General
-
Target
d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe
-
Size
368KB
-
MD5
d96103542ad88b7dd63633e1402d004d
-
SHA1
f139d0cdf959da734adb8218bb9ab1070589f0ba
-
SHA256
73da1b9b157a7d2ae3a21c90a114ca7251c32545511a38a3e92b777e59009c45
-
SHA512
c39095411c803ffe51d7adc67b5ac31897fad8914c3c09ea53fee4c3123ac3655dec98af425db093405b079a81aa97e2e5f6a2dc8061a5c812347d2a476753bb
-
SSDEEP
6144:oL9rKjvNvkH1sGf7L4JZ9oL+5b/OcGBJL8dxjHtgWECmCTPqsUPpII:5jo1sWUCL+5b/DGHL8bjHtgWL1TPqsiC
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+pvebs.txt
teslacrypt
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/2E65B6F81B88A8D
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/2E65B6F81B88A8D
http://yyre45dbvn2nhbefbmh.begumvelic.at/2E65B6F81B88A8D
http://xlowfznrg4wf7dli.ONION/2E65B6F81B88A8D
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Teslacrypt family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (424) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 6 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\ujyrjqiiptut.exeC:\Windows\ujyrjqiiptut.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\ujyrjqiiptut.exeC:\Windows\ujyrjqiiptut.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT5⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_ReCoVeRy_.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\UJYRJQ~1.EXE5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\D96103~1.EXE3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD57245ce7d92b664e968d1820f2d0a6bbe
SHA1f63c7bb42090c9c1cc97dbc6dc8093e53f8e91a5
SHA2569f36e776efb4805e1c7326bd3b351a1625a56b47decf61e5feed5ebfa2377c55
SHA5123d34cb7ddeb617ea5ebe0b36e8a722e8c8846b60a52fd9d18a90663fae2073de64d30020813adc3283ffff1c95f9a0122977fd379571a6040fc61f9920d0e8c5
-
Filesize
64KB
MD5ad1e54b498a2b1901bfb20d463d59394
SHA132165282c527f44f6e5cf93c32c45761b0d4372b
SHA256f5eff6ad20904d13f9353488c74cadbcf280010c6daeb145a138e13012025724
SHA51283389331aee70bb310e39e9a612bd31227740a7f818f74bfa1a998b56af969232dce7cebdbe3fce99989a6cb1dc5bb11b16f6dc3680552f4a80719bc12afb709
-
Filesize
1KB
MD59320e9ff5072070763885652f12b21cf
SHA125ed2b30fdc0f4a9e0266a82e87d8bd8f21fa5c0
SHA2569330cac6cc3e6cd094963f2c63ed2c9bfeaddeafe0e54263466af4d6fb691bd4
SHA5126ee4093369b513cf1994d254c62d95fe030ff25065455d679afe5eccef743ad88ab63adcce091d960d5c33dbf43a409327feb5d70d0b7aa53c02d36699cd2882
-
Filesize
11KB
MD5daf36139463a22d491b6c24edaf7f191
SHA175e51dafeda8b802c1248a65246e2abf051191e8
SHA256a9b23682da57a37fc4dd6396b18d079a31ce084d23dfcd85ecc24814c557a52c
SHA5126793b8c9fe3f7a93fa33cc9e1a0c40a14cb95f0e86481ca9b00b7e1223a4fbfafe5f2fc6e4464358912d8e2d4de71387c7ca5811428e3510e4096bc60513840a
-
Filesize
109KB
MD5582069d9bc143d2873ecb180cc84c39e
SHA104dc866c7775fb78928b52142ecfd1f0d5a3234c
SHA25697f497933d7deaaf897c511f93a9e2fc16c65eb83ecdddd8f871cd4945a4cde5
SHA512ce11e1845074dcd14cd957132e2e6ce1ffcd1d8c6f53179f88fe57e0f6704963c9d31f387cdc26a5341151b817297412862eb02f15dd7b0f064976c17c0a3a23
-
Filesize
173KB
MD52da2640848ac51370ae12b1a43c65e76
SHA150759d4a9469610c77a36746c3024644b1fed42b
SHA256ac88beba84ea6dcaf4e360701ddff9062b6661d1d19909de07618ae2bc3b85ab
SHA512bb56d241bfb1735dfaffc3ea30a9e85e90d604184b8d065787b72ed3d53904ee6cb377fe2ca4aa3eda85fe8466362df155d02060ff254f8479f1999b9bdd340e
-
Filesize
342B
MD5a881f67192ed3aaafd1a7fd99335e2a5
SHA194ca39ec00d30b95194e32264d322d51ae60c7fc
SHA256dd7abfc4f7c253d0def1a1de423b49814753815815d43e6235eab852838bfdad
SHA512d551fd6878f2b26b67e1f6355074d2d827c6efff4806adffa012b34c3b47b645961a3f2a053bbdd37332724b851872377c5b4396e9ccac2030788cb78d86ddfd
-
Filesize
342B
MD5e8acba80cad471d9e107eb8aa945a186
SHA19a7f82828d38988f37b5295860f09c0318c52a24
SHA256ecfb1c3505207e433e9dbedafb88fdbb012d793a6d63891b3997638882688a0f
SHA5125bd93d0207adf568d1000ab07d5cf960c1d717825552cc9821edbfe5528d5691b457678cc6638322d1b3d87f32feb9a8ae06fed86dc7719836787442f1412f6b
-
Filesize
342B
MD51563bda1fda720fadc717c7c0bb19186
SHA106692bebbecf522bb761588ca8a1890cabb1dd77
SHA256f840d83bebb95178d6a3e08f25e7d3977ec1ba43c014418fe6300fcf2d1b6e2c
SHA512f564a4ec0db4cead865e1ed16d107f649c8e7f14095292f14a6ed349c88aeac67e01e67fefe86f900d631313b230c0786ed75163ed51820198975250def33ec0
-
Filesize
342B
MD52047f69206fda3772b2ce0382a989752
SHA1b7b4f73351c946250cb2b1d4f02aca3153a4efc8
SHA2569849535cc77bac5ea244c945f097ffa736819e84bceddf7c3f4224d3e6eb508a
SHA51205a29c9fa84b4f06bd9e1d217511b32506441ee1bb99eb666075cc919347f96b17d0dbd35a31c6d4edf8d0da44f7b72b64f989cd4f42d5ae05978c95b88b221c
-
Filesize
342B
MD54a4e5fed21946f4b1573827176aae150
SHA11a2457112106b905df42ee1ec33068f1483fe200
SHA256f77361e08e5593ed1fd2a8526abcf8a3104c9634d48952e0d4bd554f3b5dd7ed
SHA512036be07be3ee9d94fd029814adb486ab852d27b744561159e1eca054e6df0c6afa06c3f0fe7b931da4d481e1fbb6afc203c5c5c2a60f17d3737e93aeeea4fb59
-
Filesize
342B
MD53084a3601e6b305c257a57840bf0c5cd
SHA1b9f6c9ea613fb57786817d5fc89455aacf5802ea
SHA2567c4613dda47c5971427cd3deea7414d2860a755468b68a6df230587d9972e012
SHA512bc80e67ce1bbad4d9f729c53615ad1f065f65774a93b5d6b8cdb8514e44ba52d1a5a1e6825049f3519f0bb67a8f85a28a814e5c4bb9405328c5e6c26feb30f4d
-
Filesize
342B
MD5ef80bc1ccc8aca3c63e45125515a37b2
SHA118deca2cd36fd2ac0c811a7c324f4addc55d368c
SHA256b4d9c656e45b6cf8b945594839395b21b46f221c5fa8838941e4c426ca7b9812
SHA51283e311728b4d34e0134492bc3ab740ccb5ab8d001d66e74e6dee03394d369ebac9d5fd395c24fc23167d3f04875023a2d568b54d27e1886c459123629a7a8668
-
Filesize
342B
MD525e4d62ea9e87ffb9887a113d794a432
SHA18a36b3941c47741d92e8650354de9129e0b11086
SHA25631a17e3efe992fb4536628a7c1ef6b0f35d45e5bb3ad3460b5ef53382fa84eb7
SHA51269b7a7809f6b6c9c95ed881bc90a19b068945282c2c392b26a953a82c5bbd19f871aca9c237b41f3446818d138dd6811092e04c9f11a93cd315f99dc8ecb2503
-
Filesize
342B
MD57805473c6a09a0dae835dbb4617a65c1
SHA181cd41dfea65db89a2aad29e608f85f09d06a452
SHA25630da2d95fa7081e90324d417a10a53ca578b7d53bc41c91b438b1959600d41a3
SHA512a075a8fe8353eb8a6f8b14b55318b5532d59a139be518cbe0d159c2fb7d2beacbf584e86f37cfc8521f1aebe1b6e2e1e5cd57b21d57201fc9144e26d64daad84
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
368KB
MD5d96103542ad88b7dd63633e1402d004d
SHA1f139d0cdf959da734adb8218bb9ab1070589f0ba
SHA25673da1b9b157a7d2ae3a21c90a114ca7251c32545511a38a3e92b777e59009c45
SHA512c39095411c803ffe51d7adc67b5ac31897fad8914c3c09ea53fee4c3123ac3655dec98af425db093405b079a81aa97e2e5f6a2dc8061a5c812347d2a476753bb
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
904KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
