conti | 217d101b037020cbcdd9fb7e67b2dae7ed3e8467b0dad1ca1ac0a160dc39fb48

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 07:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
Size

2.0MB
MD5

1c37c947943a928e5378931ca23d3379
SHA1

570eead825c666609b7f7d94de4ff90a86cacb94
SHA256

217d101b037020cbcdd9fb7e67b2dae7ed3e8467b0dad1ca1ac0a160dc39fb48
SHA512

70b16ed622c6cbf75e1e20c08f6415e0ed055c1b1ac9528e98713079bc93eefde4c67a06b8ba20265eafeeb7eb25c21c20f6d74ad00896533638ef6759683ace
SSDEEP

49152:0/PdqNddtNfBTXtF7tcEXwNBn+fxl7LI4mfe7mEttebsA8EnqN2U:0/PQNdjjtF7rSn+7LCfLE/eJH

Score

10^/10

conti ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files (x86)\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.best YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- WIzXR2lGvuQk29m1PY7u4rlctcqqD9r7P8cxcChaQuFbVn9c3SEhznrejtQj3jBf ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.best

Signatures

Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
ransomware conti
Renames multiple (7102) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 31 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Public\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\readme.txt	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\readme.txt	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\Social	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\readme.txt	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\ui-strings.js	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pt-br\ui-strings.js	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ja-jp\ui-strings.js	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Banded Edge.eftx	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN082.XML	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Defender	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\main-selector.css	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\readme.txt	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellLayoutModel.bin	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\spectrum_spinner.svg	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\inline-error-2x.png	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-il\readme.txt	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-pl.xrm-ms	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ul-oob.xrm-ms	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\ui-strings.js	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.cat	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_joined.gif	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\MySite.ico	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\readme.txt	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-gb\readme.txt	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\readme.txt	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\ui-strings.js	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\sv-se\ui-strings.js	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sk-sk\ui-strings.js	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\readme.txt	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\it-it\ui-strings.js	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ppd.xrm-ms	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\lua\extensions\readme.txt	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOffNotificationInAcrobat.gif	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\readme.txt	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages.properties	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\readme.txt	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\readme.txt	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-sl\readme.txt	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ul-oob.xrm-ms	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\Content	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\main.css	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\variant.js	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\RHP_icons_2x.png	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\readme.txt	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nl-nl\readme.txt	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ppd.xrm-ms	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\readme.txt	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\readme.txt	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\tr-tr\readme.txt	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\readme.txt	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8es.dub	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe

Program crash 32 IoCs

pid	pid_target	Process	procid_target
2136	4872	WerFault.exe	85
4576	4872	WerFault.exe	85
2844	4872	WerFault.exe	85
872	4872	WerFault.exe	85
4744	4872	WerFault.exe	85
1744	4872	WerFault.exe	85
2748	4872	WerFault.exe	85
1944	4872	WerFault.exe	85
1204	4872	WerFault.exe	85
4500	4872	WerFault.exe	85
2408	4872	WerFault.exe	85
1524	4872	WerFault.exe	85
4092	4872	WerFault.exe	85
4104	4872	WerFault.exe	85
2968	4872	WerFault.exe	85
1584	4872	WerFault.exe	85
5020	4872	WerFault.exe	85
4416	4872	WerFault.exe	85
2800	4872	WerFault.exe	85
4744	4872	WerFault.exe	85
2756	4872	WerFault.exe	85
2480	4872	WerFault.exe	85
2848	4872	WerFault.exe	85
1852	4872	WerFault.exe	85
4116	4872	WerFault.exe	85
3644	4872	WerFault.exe	85
3216	4872	WerFault.exe	85
3316	4872	WerFault.exe	85
3328	4872	WerFault.exe	85
4976	4872	WerFault.exe	85
2392	4872	WerFault.exe	85
2932	4872	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeBackupPrivilege	3580	vssvc.exe
Token: SeRestorePrivilege	3580	vssvc.exe
Token: SeAuditPrivilege	3580	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3180	WMIC.exe
Token: SeSecurityPrivilege	3180	WMIC.exe
Token: SeTakeOwnershipPrivilege	3180	WMIC.exe
Token: SeLoadDriverPrivilege	3180	WMIC.exe
Token: SeSystemProfilePrivilege	3180	WMIC.exe
Token: SeSystemtimePrivilege	3180	WMIC.exe
Token: SeProfSingleProcessPrivilege	3180	WMIC.exe
Token: SeIncBasePriorityPrivilege	3180	WMIC.exe
Token: SeCreatePagefilePrivilege	3180	WMIC.exe
Token: SeBackupPrivilege	3180	WMIC.exe
Token: SeRestorePrivilege	3180	WMIC.exe
Token: SeShutdownPrivilege	3180	WMIC.exe
Token: SeDebugPrivilege	3180	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3180	WMIC.exe
Token: SeRemoteShutdownPrivilege	3180	WMIC.exe
Token: SeUndockPrivilege	3180	WMIC.exe
Token: SeManageVolumePrivilege	3180	WMIC.exe
Token: 33	3180	WMIC.exe
Token: 34	3180	WMIC.exe
Token: 35	3180	WMIC.exe
Token: 36	3180	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3180	WMIC.exe
Token: SeSecurityPrivilege	3180	WMIC.exe
Token: SeTakeOwnershipPrivilege	3180	WMIC.exe
Token: SeLoadDriverPrivilege	3180	WMIC.exe
Token: SeSystemProfilePrivilege	3180	WMIC.exe
Token: SeSystemtimePrivilege	3180	WMIC.exe
Token: SeProfSingleProcessPrivilege	3180	WMIC.exe
Token: SeIncBasePriorityPrivilege	3180	WMIC.exe
Token: SeCreatePagefilePrivilege	3180	WMIC.exe
Token: SeBackupPrivilege	3180	WMIC.exe
Token: SeRestorePrivilege	3180	WMIC.exe
Token: SeShutdownPrivilege	3180	WMIC.exe
Token: SeDebugPrivilege	3180	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3180	WMIC.exe
Token: SeRemoteShutdownPrivilege	3180	WMIC.exe
Token: SeUndockPrivilege	3180	WMIC.exe
Token: SeManageVolumePrivilege	3180	WMIC.exe
Token: 33	3180	WMIC.exe
Token: 34	3180	WMIC.exe
Token: 35	3180	WMIC.exe
Token: 36	3180	WMIC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 3280	4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe	138
PID 4872 wrote to memory of 3280	4872	1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe	138
PID 3280 wrote to memory of 3180	3280	cmd.exe	140
PID 3280 wrote to memory of 3180	3280	cmd.exe	140

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c37c947943a928e5378931ca23d3379_JaffaCakes118.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 696
  2⤵
  - Program crash
  PID:2136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 760
  2⤵
  - Program crash
  PID:4576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 764
  2⤵
  - Program crash
  PID:2844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 868
  2⤵
  - Program crash
  PID:872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 860
  2⤵
  - Program crash
  PID:4744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 924
  2⤵
  - Program crash
  PID:1744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 848
  2⤵
  - Program crash
  PID:2748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 852
  2⤵
  - Program crash
  PID:1944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 928
  2⤵
  - Program crash
  PID:1204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 876
  2⤵
  - Program crash
  PID:4500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 952
  2⤵
  - Program crash
  PID:2408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 880
  2⤵
  - Program crash
  PID:1524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 948
  2⤵
  - Program crash
  PID:4092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 836
  2⤵
  - Program crash
  PID:4104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 876
  2⤵
  - Program crash
  PID:2968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 940
  2⤵
  - Program crash
  PID:1584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 860
  2⤵
  - Program crash
  PID:5020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 948
  2⤵
  - Program crash
  PID:4416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 972
  2⤵
  - Program crash
  PID:2800
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E1E556A4-64A2-49F2-9F43-131343388228}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E1E556A4-64A2-49F2-9F43-131343388228}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1112
  2⤵
  - Program crash
  PID:4744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1132
  2⤵
  - Program crash
  PID:2756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 2272
  2⤵
  - Program crash
  PID:2480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1144
  2⤵
  - Program crash
  PID:2848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 2100
  2⤵
  - Program crash
  PID:1852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1076
  2⤵
  - Program crash
  PID:4116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 928
  2⤵
  - Program crash
  PID:3644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 924
  2⤵
  - Program crash
  PID:3216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 888
  2⤵
  - Program crash
  PID:3316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 908
  2⤵
  - Program crash
  PID:3328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 720
  2⤵
  - Program crash
  PID:4976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1080
  2⤵
  - Program crash
  PID:2392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 836
  2⤵
  - Program crash
  PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4872 -ip 4872
1⤵
PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4872 -ip 4872
1⤵
PID:824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4872 -ip 4872
1⤵
PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4872 -ip 4872
1⤵
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4872 -ip 4872
1⤵
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4872 -ip 4872
1⤵
PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4872 -ip 4872
1⤵
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4872 -ip 4872
1⤵
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4872 -ip 4872
1⤵
PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4872 -ip 4872
1⤵
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4872 -ip 4872
1⤵
PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4872 -ip 4872
1⤵
PID:960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4872 -ip 4872
1⤵
PID:492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4872 -ip 4872
1⤵
PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4872 -ip 4872
1⤵
PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4872 -ip 4872
1⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4872 -ip 4872
1⤵
PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4872 -ip 4872
1⤵
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4872 -ip 4872
1⤵
PID:1536

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4872 -ip 4872
1⤵
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4872 -ip 4872
1⤵
PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4872 -ip 4872
1⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4872 -ip 4872
1⤵
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4872 -ip 4872
1⤵
PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4872 -ip 4872
1⤵
PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4872 -ip 4872
1⤵
PID:1212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4872 -ip 4872
1⤵
PID:2588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4872 -ip 4872
1⤵
PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4872 -ip 4872
1⤵
PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4872 -ip 4872
1⤵
PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4872 -ip 4872
1⤵
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4872 -ip 4872
1⤵
PID:3860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\readme.txt

Filesize
1KB

MD5
8f6296784a2d2a437c579768503f8737

SHA1
937b7bab4c20d01d8c9d324c830a14f73cb534a8

SHA256
946ca299d775712a93ca6d5daf44b96c986385a584001bf40730eebe86df9071

SHA512
f798844b0b44ee8baeba06caf9ac994bc8ad454a9923894567f04154eeeaccd5a171262bf8d0f69356cbed40356f194bf0d7d069ab3c7ba6741642d1e0b0673d

Download Submit
memory/4872-0-0x00000000028F0000-0x0000000002AEB000-memory.dmp

Filesize
2.0MB

Download
memory/4872-1-0x0000000000400000-0x0000000000605000-memory.dmp

Filesize
2.0MB

Download
memory/4872-2-0x0000000000400000-0x0000000000605000-memory.dmp

Filesize
2.0MB

Download
memory/4872-1230-0x00000000028F0000-0x0000000002AEB000-memory.dmp

Filesize
2.0MB

Download
memory/4872-1232-0x0000000000400000-0x0000000000605000-memory.dmp

Filesize
2.0MB

Download
memory/4872-4731-0x0000000000400000-0x0000000000605000-memory.dmp

Filesize
2.0MB

Download
memory/4872-5698-0x0000000000400000-0x0000000000605000-memory.dmp

Filesize
2.0MB

Download
memory/4872-7568-0x0000000000400000-0x0000000000605000-memory.dmp

Filesize
2.0MB

Download
memory/4872-8995-0x0000000000400000-0x0000000000605000-memory.dmp

Filesize
2.0MB

Download