Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
15/04/2024, 14:28
Static task
static1
Behavioral task
behavioral1
Sample
f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe
-
Size
55KB
-
MD5
88389a265bd9b1e9c59fb7053cf45b07
-
SHA1
900b980b7ef5bbbc6a255cffd66900fb68802c25
-
SHA256
f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd
-
SHA512
da2ebf446db76590834e3b8e828e3895e0febdfa0ee34627b5c6c18cc10ccb85b83dd0410789845c980984eb1021a6c7050ebf1cbfd04e1ce904e0e40113e932
-
SSDEEP
1536:ENeRBl5PT/rx1mzwRMSTdLpJMGl5dPZjlkWBFj:EQRrmzwR5J1VPZiW
Malware Config
Extracted
C:\info.hta
http://www.w3.org/TR/html4/strict.dtd'>
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 1968 bcdedit.exe 2216 bcdedit.exe 2740 bcdedit.exe 3028 bcdedit.exe -
Renames multiple (314) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 2312 wbadmin.exe 1716 wbadmin.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 2648 netsh.exe 1672 netsh.exe -
Drops startup file 3 IoCs
description ioc Process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118 = "C:\\Users\\Admin\\AppData\\Local\\f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe" f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118 = "C:\\Users\\Admin\\AppData\\Local\\f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe" f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\BP3UABCB\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Public\Videos\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Public\Desktop\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Public\Libraries\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\Links\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\Videos\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\0U93YK0N\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CMDLW4SJ\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\Music\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\27PKR52P\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Public\Pictures\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JJ7YKCO8\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Public\Documents\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4XCMPANZ\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUB6INTL.DLL.IDX_DLL.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Mail\es-ES\WinMail.exe.mui f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files\7-Zip\Lang\ka.txt.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_fr.jar f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Glace_Bay.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\La_Paz.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_zh_4.4.0.v20140623020002.jar.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationProvider.resources.dll f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_cloudy.png f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Resources.dll f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02470U.BMP.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MAPIR.DLL f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_VelvetRose.gif f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\HEADER.GIF f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\settings.css f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PSRCHSRN.DAT.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\BriefcaseIconMask.bmp.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN092.XML f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00669_.WMF.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\MSTORE_F_COL.HXK.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\EXLIRM.XML.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.access.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME10.CSS f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel.dll f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Berlin f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\CGMIMP32.CFG f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0217698.WMF f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14997_.GIF.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME32.CSS.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\7.png f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Winnipeg f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vincennes.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_GreenTea.gif.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GreenTea.css f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7TSFrame.png.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE04050_.WMF f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.preferences_3.5.200.v20140224-1527.jar f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_zh_CN.jar.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\sRGB.pf f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\31.png f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\SAVE.GIF.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105338.WMF.id[E76C3766-3232].[[email protected]].eking f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2612 vssadmin.exe 2368 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe Token: SeBackupPrivilege 3032 vssvc.exe Token: SeRestorePrivilege 3032 vssvc.exe Token: SeAuditPrivilege 3032 vssvc.exe Token: SeIncreaseQuotaPrivilege 1716 WMIC.exe Token: SeSecurityPrivilege 1716 WMIC.exe Token: SeTakeOwnershipPrivilege 1716 WMIC.exe Token: SeLoadDriverPrivilege 1716 WMIC.exe Token: SeSystemProfilePrivilege 1716 WMIC.exe Token: SeSystemtimePrivilege 1716 WMIC.exe Token: SeProfSingleProcessPrivilege 1716 WMIC.exe Token: SeIncBasePriorityPrivilege 1716 WMIC.exe Token: SeCreatePagefilePrivilege 1716 WMIC.exe Token: SeBackupPrivilege 1716 WMIC.exe Token: SeRestorePrivilege 1716 WMIC.exe Token: SeShutdownPrivilege 1716 WMIC.exe Token: SeDebugPrivilege 1716 WMIC.exe Token: SeSystemEnvironmentPrivilege 1716 WMIC.exe Token: SeRemoteShutdownPrivilege 1716 WMIC.exe Token: SeUndockPrivilege 1716 WMIC.exe Token: SeManageVolumePrivilege 1716 WMIC.exe Token: 33 1716 WMIC.exe Token: 34 1716 WMIC.exe Token: 35 1716 WMIC.exe Token: SeIncreaseQuotaPrivilege 1716 WMIC.exe Token: SeSecurityPrivilege 1716 WMIC.exe Token: SeTakeOwnershipPrivilege 1716 WMIC.exe Token: SeLoadDriverPrivilege 1716 WMIC.exe Token: SeSystemProfilePrivilege 1716 WMIC.exe Token: SeSystemtimePrivilege 1716 WMIC.exe Token: SeProfSingleProcessPrivilege 1716 WMIC.exe Token: SeIncBasePriorityPrivilege 1716 WMIC.exe Token: SeCreatePagefilePrivilege 1716 WMIC.exe Token: SeBackupPrivilege 1716 WMIC.exe Token: SeRestorePrivilege 1716 WMIC.exe Token: SeShutdownPrivilege 1716 WMIC.exe Token: SeDebugPrivilege 1716 WMIC.exe Token: SeSystemEnvironmentPrivilege 1716 WMIC.exe Token: SeRemoteShutdownPrivilege 1716 WMIC.exe Token: SeUndockPrivilege 1716 WMIC.exe Token: SeManageVolumePrivilege 1716 WMIC.exe Token: 33 1716 WMIC.exe Token: 34 1716 WMIC.exe Token: 35 1716 WMIC.exe Token: SeBackupPrivilege 2396 wbengine.exe Token: SeRestorePrivilege 2396 wbengine.exe Token: SeSecurityPrivilege 2396 wbengine.exe Token: SeIncreaseQuotaPrivilege 1792 WMIC.exe Token: SeSecurityPrivilege 1792 WMIC.exe Token: SeTakeOwnershipPrivilege 1792 WMIC.exe Token: SeLoadDriverPrivilege 1792 WMIC.exe Token: SeSystemProfilePrivilege 1792 WMIC.exe Token: SeSystemtimePrivilege 1792 WMIC.exe Token: SeProfSingleProcessPrivilege 1792 WMIC.exe Token: SeIncBasePriorityPrivilege 1792 WMIC.exe Token: SeCreatePagefilePrivilege 1792 WMIC.exe Token: SeBackupPrivilege 1792 WMIC.exe Token: SeRestorePrivilege 1792 WMIC.exe Token: SeShutdownPrivilege 1792 WMIC.exe Token: SeDebugPrivilege 1792 WMIC.exe Token: SeSystemEnvironmentPrivilege 1792 WMIC.exe Token: SeRemoteShutdownPrivilege 1792 WMIC.exe Token: SeUndockPrivilege 1792 WMIC.exe Token: SeManageVolumePrivilege 1792 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2128 wrote to memory of 3052 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 29 PID 2128 wrote to memory of 3052 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 29 PID 2128 wrote to memory of 3052 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 29 PID 2128 wrote to memory of 3052 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 29 PID 2128 wrote to memory of 3000 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 30 PID 2128 wrote to memory of 3000 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 30 PID 2128 wrote to memory of 3000 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 30 PID 2128 wrote to memory of 3000 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 30 PID 3000 wrote to memory of 2648 3000 cmd.exe 33 PID 3000 wrote to memory of 2648 3000 cmd.exe 33 PID 3000 wrote to memory of 2648 3000 cmd.exe 33 PID 3052 wrote to memory of 2612 3052 cmd.exe 34 PID 3052 wrote to memory of 2612 3052 cmd.exe 34 PID 3052 wrote to memory of 2612 3052 cmd.exe 34 PID 3000 wrote to memory of 1672 3000 cmd.exe 36 PID 3000 wrote to memory of 1672 3000 cmd.exe 36 PID 3000 wrote to memory of 1672 3000 cmd.exe 36 PID 3052 wrote to memory of 1716 3052 cmd.exe 38 PID 3052 wrote to memory of 1716 3052 cmd.exe 38 PID 3052 wrote to memory of 1716 3052 cmd.exe 38 PID 3052 wrote to memory of 1968 3052 cmd.exe 40 PID 3052 wrote to memory of 1968 3052 cmd.exe 40 PID 3052 wrote to memory of 1968 3052 cmd.exe 40 PID 3052 wrote to memory of 2216 3052 cmd.exe 41 PID 3052 wrote to memory of 2216 3052 cmd.exe 41 PID 3052 wrote to memory of 2216 3052 cmd.exe 41 PID 3052 wrote to memory of 2312 3052 cmd.exe 42 PID 3052 wrote to memory of 2312 3052 cmd.exe 42 PID 3052 wrote to memory of 2312 3052 cmd.exe 42 PID 2128 wrote to memory of 1180 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 47 PID 2128 wrote to memory of 1180 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 47 PID 2128 wrote to memory of 1180 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 47 PID 2128 wrote to memory of 1180 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 47 PID 2128 wrote to memory of 2944 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 48 PID 2128 wrote to memory of 2944 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 48 PID 2128 wrote to memory of 2944 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 48 PID 2128 wrote to memory of 2944 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 48 PID 2128 wrote to memory of 2720 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 49 PID 2128 wrote to memory of 2720 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 49 PID 2128 wrote to memory of 2720 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 49 PID 2128 wrote to memory of 2720 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 49 PID 2128 wrote to memory of 2492 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 50 PID 2128 wrote to memory of 2492 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 50 PID 2128 wrote to memory of 2492 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 50 PID 2128 wrote to memory of 2492 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 50 PID 2128 wrote to memory of 2724 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 51 PID 2128 wrote to memory of 2724 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 51 PID 2128 wrote to memory of 2724 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 51 PID 2128 wrote to memory of 2724 2128 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe 51 PID 2724 wrote to memory of 2368 2724 cmd.exe 53 PID 2724 wrote to memory of 2368 2724 cmd.exe 53 PID 2724 wrote to memory of 2368 2724 cmd.exe 53 PID 2724 wrote to memory of 1792 2724 cmd.exe 55 PID 2724 wrote to memory of 1792 2724 cmd.exe 55 PID 2724 wrote to memory of 1792 2724 cmd.exe 55 PID 2724 wrote to memory of 2740 2724 cmd.exe 56 PID 2724 wrote to memory of 2740 2724 cmd.exe 56 PID 2724 wrote to memory of 2740 2724 cmd.exe 56 PID 2724 wrote to memory of 3028 2724 cmd.exe 57 PID 2724 wrote to memory of 3028 2724 cmd.exe 57 PID 2724 wrote to memory of 3028 2724 cmd.exe 57 PID 2724 wrote to memory of 1716 2724 cmd.exe 58 PID 2724 wrote to memory of 1716 2724 cmd.exe 58 PID 2724 wrote to memory of 1716 2724 cmd.exe 58 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd_JaffaCakes118.exe"2⤵PID:2988
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2612
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1968
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2216
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:2312
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
PID:2648
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
PID:1672
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"2⤵
- Modifies Internet Explorer settings
PID:1180
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"2⤵
- Modifies Internet Explorer settings
PID:2944
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"2⤵
- Modifies Internet Explorer settings
PID:2720
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"2⤵
- Modifies Internet Explorer settings
PID:2492
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2368
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1792
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2740
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:3028
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1716
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2396
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2528
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:2328
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[E76C3766-3232].[[email protected]].eking
Filesize143.1MB
MD54b57f7b5255eda263e6ac94d9ea7a2c0
SHA1f6c2dda9fbaed343883b6c49518b557ed2c05dca
SHA256d9743ad606078287946f1856bf37c45da9349b31c266ef3cabed2d8b917dd619
SHA512d3580d14bee1ed65cef1f40be51d355691988b769d50d05d84fad61c801a907aeda3bc63c74fee65cfabc77a770920bc9490083bde76a6b3fd67b8833f8a1e00
-
Filesize
5KB
MD59308563701ed6d3a69aab7a902a7d912
SHA176a58fd3e0b88a5ba85118892baefd8340d293a0
SHA256a66a6a5b3c9154042f3ee839b121ee923d4536d881492c1ea38b639c0265d853
SHA5123d5a1a6330e445ab4f7c3bbba74a1e357fea0625bd56f9520df2a0d28ed63c0dd267a846ede67f75a5a4b92e46b496b2d39084b5e3d19ae55ed4912dfdcdd2a6