Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
10-12-2024 17:59
General
-
Target
de01a09f896441e9533913bb82278391_JaffaCakes118.exe
-
Size
376KB
-
MD5
de01a09f896441e9533913bb82278391
-
SHA1
d65824cc0c5b29864c7cac6b10f41fe516c0dd31
-
SHA256
811740b4ecfe0bde80e90ec6f60fb17db109ccf7490345bb897276354ed31256
-
SHA512
c8b0f54dc698a39e438ba7105d08632a05396ded5b2d2bb82e35d869e5595f9827d6246eb274657333411b80a9936cf291fd7e644f5b58a5450bdd228732b053
-
SSDEEP
6144:te3rNhMeYq4CGRTs4kadSoKVStcmTVn57CpSCwsUbg62oXd:tY5hMfqwTsTKcmTV5kINEx+d
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+crfav.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/2F416F755E5B53F9
http://kkd47eh4hdjshb5t.angortra.at/2F416F755E5B53F9
http://ytrest84y5i456hghadefdsd.pontogrot.com/2F416F755E5B53F9
http://xlowfznrg4wf7dli.ONION/2F416F755E5B53F9
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Teslacrypt family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (391) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 6 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\de01a09f896441e9533913bb82278391_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\de01a09f896441e9533913bb82278391_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\de01a09f896441e9533913bb82278391_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\de01a09f896441e9533913bb82278391_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\pafyndrdyeop.exeC:\Windows\pafyndrdyeop.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\pafyndrdyeop.exeC:\Windows\pafyndrdyeop.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:275457 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\PAFYND~1.EXE5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\DE01A0~1.EXE3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5c743ca00420717a1ecb9918fd0116e03
SHA1a364f87ac838c76c727cd5228eb903b68f5f40b7
SHA256131bab8151cab0a8a32b19279a4155542440ee46208b78b0231fd0818b787e89
SHA5123b2002a4764216cb85c42b910a321cc8868f5c35f2ae51f091448a8cde7b46e4be42acadc5c8edfd1968ab2dde5561032051c0cd767d57fd86129cd8b9ff2adb
-
Filesize
62KB
MD52aed16fa40e2f5fea0b5d2beaae12ba7
SHA1c04c0720d8876c041fb5a43054371d4bd98f57f0
SHA256d84e41cb9f549363546f47bac3634fa0bcaba7d51614a3500cbb1ee66e38e743
SHA5120e1c02977d3fbafbc57f81beca2e49330e84ae895749ab6a08656fdceb49075dec5ff51974c4596c43c824496f935d995a2da537d78285043d8db567ee57bc32
-
Filesize
1KB
MD5bd84dd8c0987cd30a8288da5ec8bd48e
SHA1bee95cd6ec00b2f1f222ed9474aaf13b8eb5371c
SHA2568b793343ceeee394623267d1a50e0e82bf3e0c1e84a3bfb2fdb93e412605637e
SHA51259db845315a41a0107102ef3849b7a6e7950fd67dcc7414dd972b2d169f14f7f181a0174512cf817d72b7e624955f221abf74e71a828caed8af7767d14585faa
-
Filesize
11KB
MD5d0b2d2e3e3ed2624430aaf52b335cd26
SHA108cbaa51eeeb0a9c825bcc2fc4e5810c145ef144
SHA25627c0920436dc1ab6b1a2b8aad5db04844e678f0bc9b7b70735116be24a072130
SHA51237942a59898029527f57c0ace148bb347e1d56d72abc619363f7c8f3bfd5ad698cd705d1713a585ec98f95893bb2c2c972f69ad9554345c903c5b5e56ff6e44a
-
Filesize
109KB
MD56e0645bf63300e8180fd1fa1a8bcdbd4
SHA1424b40f6e79030613c80f771108f2c0e3efac87e
SHA25659619d36d3ee65e9d9f1497f63a26d087c48566780c97015e6a160be26b091eb
SHA51262664013ea1c4adca3e1cee14dbfb0240fab7c1b0180d9a17d73a4b954627189cee5948619a86d413ce6274164c270e273da7abb34ef24eb2d2f10a967e88121
-
Filesize
173KB
MD578fdf7d67115be85deac213e5313ed6c
SHA15550a58affc529814ce186486fac23d40a7bcb31
SHA256ce9803832f89468a6707f14f4c84d933b3b678f9840cebe5d807ed0ac83fac0d
SHA51282c63e9a525a12178458b4cefcf44a619399551542eb4fd480f36973f0d18e27ce35b8fd05b2e3807353a165909da5eee7534da4a69ca97aca0343610f7e1078
-
Filesize
342B
MD511e6b45d0f13f0f1b750cfdf0dc6630c
SHA12a73ce7dad879770f54733f7a6e685ac3602875c
SHA2567c75b256e1a06d8741bd2465706b49843c9e57696df6909754b7bd52114a0a89
SHA512d63e3972ae4b9d9b761c247e166bfb0c6944835fabe602f3176e4b56d2b548181bbcb47588e39b42f7890900c1d7501b7ee1b8dee0829dd41d963ed765f69a5b
-
Filesize
342B
MD531266dd9086794748fe9bca7c9debc59
SHA113e2a590a02da960b6741c5259e0bbe4c8f8474d
SHA256d4eafa310f5a2ba4cd47236f3f8409d63c02e25eda094f98ce0eeeaea38fcee6
SHA5125aea2980b77f0ddb291d0004597b0290f7dd85a8a075e3e8908690f9fa6bcb05bf03847f5f2abe63f38cbdc99290ccfcda87e47d734e93ec9276281befcb6189
-
Filesize
342B
MD55c0ae31944437d03f30cba0014126633
SHA165c7d90cce8eb871dc6d7dbc52edd1e3f04f3918
SHA2565100d7874da3280be8fa2870f0b93e326cd40532fcdebeb5c888e3517d336f45
SHA5125df1e933981eae1a572ed0a781d37a26a5a6647caa8e26012d5a97b52230d51eb64b15ab4702cfb4f345df6524f74715ecd96eb23c5b67849d531974de1828aa
-
Filesize
342B
MD5e9cb74abe72d6d91ebfa059319291a7d
SHA15d761f171efe5ba1c43171e74d5a995095bb113d
SHA256555e19b04180b08d7dc6adf78a45ba22a5465fb5f14b87cf17122a4563e33c83
SHA5126ef3afcabd1c4ab7a6160d893d6b0781e03a6cf900f34f444d6f80b2125fbbfaf27a2409ae31f92f8e9cc5c7b1e8cc8291389d8b8bb62c96a491a07294e039b8
-
Filesize
342B
MD5af26058b5f3f77d9fa14e5356258f569
SHA13c3da689fdbb6d46b253e44001a64cd4ccb978aa
SHA256621fe8bf758b242450be98d41b2e7af4ddeca8902e717dd02d8e04dc682e56a0
SHA51211dadbdff7936c49ae618e00aefa12bdcaf1efac3bb6afac9c4f32cfc34a0176152953c9d9cec0dfd3fdf1ec1e1bec6ff7cfc7ead4b8f64a5efa4ab08930c3aa
-
Filesize
342B
MD563b4b66b625e48125fe86de52b09e1d5
SHA12c4416887450c892d1c6f42f29a5c12ac49a1474
SHA2566ff8573d7f25569513fa820df65ee1fca3c2ab82b6251daf0d2f2035007d56cc
SHA5126cfcc304b6e2bb9021163ec013e201e935306f4579ed3a4d47954c4f0873ee745363a11c558af37e709634913d53c94874bf3068938d5e04c82b3f70503a712e
-
Filesize
342B
MD539925cbceb3cdaf3e9bc76c2989acda0
SHA131f118abd1ddcbba06b07561623e1dcadc2608ce
SHA2561d44d56355c31b585e3e9936ec19eb3caf2266e5454d508de32d6a8da2138505
SHA512f07cab2c49de8a65d0eb446544f1b88f0544a270592add8f76cd95b0a12baf766cbe5c402a8589fa209f557798f8300ac40d32449913e6f669abfd60e2dc8424
-
Filesize
342B
MD571baed45752dcdd08be242e2132d0e43
SHA1e41db0668c5085723f45615c1a52a7044cd5c86e
SHA2569c474dfdca890fcf15967e0643bbbe9435aa9f5aea9fcb948a9d7b7598d6fe12
SHA512e49dc62d56426c86ae6d0e6ccb01dd2c6cccc3ee9131677aa6f2678e392eca44d0ec6c1e8f2111697fd2566a3516ca2d9b0c93bdc393983d6906622ca0eb899d
-
Filesize
342B
MD50f8e0333b84e096d7df6e1dbfd2af3b4
SHA18e7099ec4e0a5800250f0d29f99df6754db7a380
SHA256c9058c5cd09228cb3572bd05af874e2163606deb53d19cfad73b53b1defa2ca6
SHA512ce08ce9582668b2b7f11f69170e1da2b22629569310962fc8b0291768942d101cb2e5bbdcd31a73dae1f286d6b3975884beca5e439482ad4ddfdd3ae095b590f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
376KB
MD5de01a09f896441e9533913bb82278391
SHA1d65824cc0c5b29864c7cac6b10f41fe516c0dd31
SHA256811740b4ecfe0bde80e90ec6f60fb17db109ccf7490345bb897276354ed31256
SHA512c8b0f54dc698a39e438ba7105d08632a05396ded5b2d2bb82e35d869e5595f9827d6246eb274657333411b80a9936cf291fd7e644f5b58a5450bdd228732b053
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
8KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
8KB
-
Filesize
1.9MB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
4KB
-
Filesize
532KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
