Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
13-12-2024 07:00
General
-
Target
ea7642ffb5c98e7f798f29129a64992e_JaffaCakes118.exe
-
Size
396KB
-
MD5
ea7642ffb5c98e7f798f29129a64992e
-
SHA1
3349fbba067b988f38fe202702dedbfab0a41183
-
SHA256
7647f59703849df9663b9756a6f323ee3e59852463f21a7fc139828a3aa5802f
-
SHA512
2f7c79b373fa7fca06eb93adbedbc6885de80a674ad111c59706492b594fa5d0963e580568924d660188554b31de057c7b700423edb81dfd1895aa054ffd59ca
-
SSDEEP
12288:eVaauWatLv/kjWaesK3YSYJmlzFZ3IHmMr:e03DkjtLS5hVq
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+odeng.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/763F6AF98DD94D
http://kkd47eh4hdjshb5t.angortra.at/763F6AF98DD94D
http://ytrest84y5i456hghadefdsd.pontogrot.com/763F6AF98DD94D
http://xlowfznrg4wf7dli.ONION/763F6AF98DD94D
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Teslacrypt family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (427) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 6 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea7642ffb5c98e7f798f29129a64992e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea7642ffb5c98e7f798f29129a64992e_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ea7642ffb5c98e7f798f29129a64992e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea7642ffb5c98e7f798f29129a64992e_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\sqprcpdtjiiv.exeC:\Windows\sqprcpdtjiiv.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\sqprcpdtjiiv.exeC:\Windows\sqprcpdtjiiv.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\SQPRCP~1.EXE5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\EA7642~1.EXE3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Indicator Removal
2File Deletion
2Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD55472d8a0f781df1126c63d53f20d260d
SHA10facd5fd550da26f40b4594b7c424a0f505e00d8
SHA256ac5cde7ab5fb09ae1555aa4f74105a6b5e9b3abec628c87dbf2ecfc01560ccd3
SHA5120e66629e6b2f662d1cbdc589cf122acbc4e785248a2eb12259d8ac0c7689bc60140c6e5a0abd03e5635bfdd357624928dee11194afbbc31f5314b83eafe66a09
-
Filesize
62KB
MD54253fcd4b881633b5f142560c8cfa2ab
SHA1f1e36240b08f6765e048faccae2ebf3b328668af
SHA256f73304421ab0e039ed58e09abcd478b76ae9f90a5a08e86390e8f2092f9b18ae
SHA5129b9854654df225eec8b2c743c983a4d7f5c6ddb0edff59772c2b7ce9930d4dbe0898c9c67f11da8811d4db5e9505db0f29995eff18a55ce372cf7357ef6ee075
-
Filesize
1KB
MD5ad435fa67469c42b52bbbc56f4b73361
SHA1b21281f6ca486f30d66cee2dafe557430d9bac6c
SHA2567adeb96de8f954ba5866ff0a378a885f0dcb94a25abac66affefe77afd91d3f1
SHA512c2ec040d15468387f9da4478da741303d8c6bda528a898e824f08e0323349b60c687a451b9dde0d6643c63ce21c187a5944efc217d23a15c7f9f244cac514b5f
-
Filesize
11KB
MD5205b944c62cc480584901b33d21bd80f
SHA1741fed6bdaa70ec19c94f5d9b02a066dd446191b
SHA2565e2004580d59446ca82bd300079b08927a5ef717afb1513649f23186d0d75af5
SHA512482634d2f54ba15be18f8d17073f3dbe56938e87a479ed7da39497abbb206fef16d44f787e69ce3b5941c36691400bda1d999b9c0332dbac9470d070fa397820
-
Filesize
109KB
MD52fdc20b2111ada8f71dc2e44a5998029
SHA16d81b4778f61391afd5928c2a1067b057afa355f
SHA256c79dc2f53ce81efcd2c6c532f4ffaf3f6cf1c733639aaa9ae81d23491c2fa5be
SHA51206fbeaee3e7a93a2c089d6330c302f9fe32cbe00080d5e2c5ff3fc242696456b592b14488f84cedf67fd69b85249ebc8e2dcb40f2225f89a79da4bfb54c7d2cc
-
Filesize
173KB
MD5977d57df3ffed940bfa4ce1f42f25abd
SHA10d059c381ef04fb9e9787ac703b29ec79042935b
SHA256bf50f0f7abf462efe8dbd2130e97c92255ced2602ab5b02ea59667228051fbc9
SHA51259d841ef61cf3f1e1c24a882c2938b03725d6bd6759a4a36de66e21a04729c74a84ab9f08fd9158642070977746a7af0574b5c4103f9e2df8440a5b5156f6522
-
Filesize
342B
MD5cae4449a9c92ee5b842a15ed95b3c4bd
SHA1fb125247d0406b0cebf77d597ac31eaed0cb81d7
SHA256023b6a82f5a42d3caff97c502882a0694366a4bf0cf67ce41ae3a10d34649bcb
SHA512ed4e63e09e157235c086f22c3bcaf0c7153929c830b6adb5474e8d7e7e2db4ad757fed8bd31438f28374bbb620da49662358d2fb842c203e7c4b71c3f71e4de2
-
Filesize
342B
MD5faaaaa43ce665abe9e49ce36b16cfb1b
SHA1d93ef9964a75550220acdf2776f647b37480128b
SHA25697b9c4e956d4ae540a62af2095d792c248525837d16de5ee0cab51ab3434d9f9
SHA512bef86d6bef1affae92178f0853ad6a85613dac0e538af12df9e40f59e5278ffe1e4c8c4aa41ff7c4a26850f4f91dc79e62e7c51590eae13fc500cf7c28a8a97e
-
Filesize
342B
MD5ecf50f09381d0824319285375d0a0660
SHA13d78a63675ad3a224f3fda0603dc4b765a007288
SHA25613f14d79de85f45afb969ba2d290cf3341e0bd4dea0be560281c0bf00e4f8740
SHA512b78e54984f498f3d4ff184109c0b53fc8211ddc7b6e1e8e67b478c95a791b787e90395556f081916822b6564c19deb2ace8241811fb06eafbd47179d72c31b85
-
Filesize
342B
MD55effb1178f92b51ae831f5a0d78c0bfa
SHA11c2cbbce635862d274d235c028d168a350b7b5bd
SHA256110cfee2c76d228e33b232b4a76692d8e35ac49636d778fca38a8c5459fc640a
SHA512071be3530194c8f9b9ca074f45228cae8ea5f9d96c6f1ceee34a23630b2f500c5ce29c8f20be798d8d24f1a027608a7a668ed0e8664a1cdb43ac451ffbadf821
-
Filesize
342B
MD5cb6898722d1a0a1812af844ca3486ab1
SHA1e2ee29d5599da79bdaf6c0a32ba304642345dbcc
SHA2568a146194c49d98c8b6cb0d0c552481eff08c258349ebddbd2d1f6c62c65de81e
SHA5127dac69bf185892d9cd14fbbbc535878230924791875ed92194888a6bc4d1ea7aa553e16a29d7d93ac4fb752c318cf7da62e3bb84b1fac81219a25d117003e784
-
Filesize
342B
MD5ea7b7f6b38437a21961f0e83679a1456
SHA15c2b7f957d2fd1b162cd1c845411e3221af2c73f
SHA256aff56b905bf112dcdfe7c6cdd8213d5c76eb7880676061df353fc8cd99ad966c
SHA51237d7ae2b6f38fb28694672f76c6a3a0c83a3a417b7a7b02ad4543d631df1017129bf15af24175c42dc190c36760e34961f43190adec66e1bc4a60227f2028f40
-
Filesize
342B
MD5f93ea72cb9672d4a69e41a9b6a3ba388
SHA18f31992964c70c7a578138903fc644eee686d555
SHA256f6ffdf7656e0e4a73dc6365f421456d953ce7e81d07c4f244429da1266330c7d
SHA5128c4bcf30d0172d2aea4f8728667eede3e03b4acaa6340eea272b5550e08a01e9ce613ec4e9df49b6c5e2698abdd392e924ddc7eb0ec1a85511b192c49353668c
-
Filesize
342B
MD5d2358b7b3a8bdf99469591b2fa5fe94e
SHA103d0e2cf1fde41c46de6c5dd8e9afc634dbd1337
SHA25697ebca245f1e43b6216ef71f730300ef7e44979bb09c7bd114d4dc273f9a96cf
SHA51250b668c34cf8cce27da1289bb60c59ab3d5f2ec85fc4bf8dc4c27274946df917eef66d718f5c937f653970d1aaa00af7e6e43080c49b4355c4370cb9a7494b4e
-
Filesize
342B
MD5ea9e8eeead88023e8fcfb74a73506f60
SHA19ac731d116bae332c48370591a3d0160006e9998
SHA256032858cff830b55beec6dc99e11739719b7c691c231f457b68a169974921bdec
SHA5126f84c6bf2d91b1ffeeee385117cc8d02bb51654932f913f70557ebc79f0b212c0ec9b37e4fccaede70798086ac4c5f3fdea67e239c8834a9ba3a2a548071fe24
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
396KB
MD5ea7642ffb5c98e7f798f29129a64992e
SHA13349fbba067b988f38fe202702dedbfab0a41183
SHA2567647f59703849df9663b9756a6f323ee3e59852463f21a7fc139828a3aa5802f
SHA5122f7c79b373fa7fca06eb93adbedbc6885de80a674ad111c59706492b594fa5d0963e580568924d660188554b31de057c7b700423edb81dfd1895aa054ffd59ca
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
3.0MB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
