Malware Analysis Report

2024-09-11 02:36

Sample ID 240421-mvq5rahe6y
Target ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118
SHA256 a25c0227728878c386ab6dba139976cb10e853dd3cd1eb3623f236ee8e1df212
Tags
medusalocker evasion ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a25c0227728878c386ab6dba139976cb10e853dd3cd1eb3623f236ee8e1df212

Threat Level: Known bad

The file ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

medusalocker evasion ransomware spyware stealer trojan

Medusalocker family

MedusaLocker payload

UAC bypass

MedusaLocker

Deletes shadow copies

Renames multiple (193) files with added filename extension

Renames multiple (164) files with added filename extension

Executes dropped EXE

Reads user/profile data of web browsers

Drops desktop.ini file(s)

Enumerates connected drives

Checks whether UAC is enabled

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Interacts with shadow copies

Uses Volume Shadow Copy service COM API

Suspicious use of WriteProcessMemory

System policy modification

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Defense Evasion
TA0005
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Modify Registry
T1112
Indicator Removal
T1070
File Deletion
T1070.004
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-04-21 10:47

Signatures

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A

Medusalocker family

medusalocker

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-21 10:47

Reported

2024-04-21 10:50

Platform

win7-20240220-en

Max time kernel

126s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe"

Signatures

MedusaLocker

ransomware medusalocker

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A

Deletes shadow copies

ransomware

Renames multiple (193) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2008 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2400 wrote to memory of 2720 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 2400 wrote to memory of 2720 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 2400 wrote to memory of 2720 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 2400 wrote to memory of 2720 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svhost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe"

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\taskeng.exe

taskeng.exe {76E035D6-13CE-48F7-A7D8-551558E1126A} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\svhost.exe

C:\Users\Admin\AppData\Roaming\svhost.exe

Network

N/A

Files

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Recovery_Instructions.html

MD5 feff41707714c52c1c5bdc50112db358
SHA1 5875ea43a5b23e15f5f0e350979833fa7bf1c6ec
SHA256 ee89987085528c90b7946e0fd19f8300c57c14add98bb378922fc2713d7a687c
SHA512 e387e9d1c7a0b476df1f2e3445e55b1269667ef9f7e65b848ca51861e273507aa4209e2edc5723cf10155d44fe0a9a5d7522a0b47155b76a7dfc7980fceae338

C:\Users\Default\NTUSER.DAT.LOG2

MD5 2491064d29fbe2ebfa4cbe2a4ac65362
SHA1 4e4c1ec30b6121f8bdc3d952049a275c8b0b2dbc
SHA256 2614accde4359d0567f2a728ba7ba99083cce9c85d0aa171bd11fc3641aaa7e3
SHA512 fe57ea6bcc7602be78f7af5de4f4d809d7f5cc52bc18e7196537048709870e9c47ad9f6493a247a9235126997e29435c54591ca9698e054c19d950f02e68ae61

C:\Users\Admin\AppData\Roaming\svhost.exe

MD5 ff1b2e9d3e7af50b302b090a15d15c76
SHA1 3bae4caa7c4ecca659aec342472fe49b3c0b2131
SHA256 a25c0227728878c386ab6dba139976cb10e853dd3cd1eb3623f236ee8e1df212
SHA512 d3527aa4e7d4a8fbd0565ea8c0d26dc7e9ff0f294efa5260b9e964e5943782eb697b964cb684ad9008a717b93cfd120ec1337acb0ecbefef0931313f7b88e881

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-21 10:47

Reported

2024-04-21 10:50

Platform

win10v2004-20240412-en

Max time kernel

148s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe"

Signatures

MedusaLocker

ransomware medusalocker

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A

Renames multiple (164) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-2288054676-1871194608-3559553667-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5088 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 5088 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 5088 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 5088 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 5088 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 5088 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 5088 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 5088 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 5088 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe C:\Windows\SysWOW64\Wbem\wmic.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe"

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Users\Admin\AppData\Roaming\svhost.exe

C:\Users\Admin\AppData\Roaming\svhost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
NL 23.62.61.122:443 www.bing.com tcp
US 8.8.8.8:53 122.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 17.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 14.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 122.10.44.20.in-addr.arpa udp

Files

\Device\HarddiskVolume1\Recovery_Instructions.html

MD5 46cf944f117639380152758e44538b78
SHA1 30dbaa2f02a1924ac037dcb02a22fe7a173411e2
SHA256 b958124547104fa5b0708aa39beba002be41ca0d88c7831ed891129cee0f46d5
SHA512 b0a206edabb9c12666911235e78dcf5fc797c26fbc273de669d3690626d54ed44f3798128876aea0a64a1274bc1df00b4ca194a517ced3e607c8cfe8b0835e0b

C:\Users\Default\ntuser.dat.LOG2

MD5 0be8b43a51c6659937b1eb93ca092a21
SHA1 8f6c87abb9a718db4a38f94e9aa9b4410aea90fe
SHA256 1b5113d69b7555ccc1c60eb2ff4aeaa5868d470eed34c2f74fc7acb40a512be5
SHA512 85a94293acb44f1d8a13b145874e5651f91b92d32e5e37bd29bc0e91e6b482246632b026f2e4cd21dc31f59237f6d292f69b2fa8eaa526491fe459a91fbd9263

C:\Users\Admin\AppData\Roaming\svhost.exe

MD5 ff1b2e9d3e7af50b302b090a15d15c76
SHA1 3bae4caa7c4ecca659aec342472fe49b3c0b2131
SHA256 a25c0227728878c386ab6dba139976cb10e853dd3cd1eb3623f236ee8e1df212
SHA512 d3527aa4e7d4a8fbd0565ea8c0d26dc7e9ff0f294efa5260b9e964e5943782eb697b964cb684ad9008a717b93cfd120ec1337acb0ecbefef0931313f7b88e881