553eb0cfb24c42ad0a8e1978fca7c488016e7ee23dc7516893ce2e4cf9901b73

Reason

Machine shutdown

General

Target

013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe
Size

364KB
MD5

013dfbda7c6d94dd8d729c3b15bc53d4
SHA1

0404eda74b1de75ceb85d3056f8169bd2a4607ea
SHA256

553eb0cfb24c42ad0a8e1978fca7c488016e7ee23dc7516893ce2e4cf9901b73
SHA512

c43b7542422a0b47505ee1f1777300926932f0d40f61264d020650c2bc6d30996f5566de81c0b80a94d1ff3d087f9a55b6a9c4eb2938cb4a38bacf26cbc49dac
SSDEEP

6144:hM3Ia4g7E/Rd1WjfqMsSW9ZgsQ6LEme81Ip8/V+9jeOLzZXcIwXHX:wIt4EELq7p9ZgeLDc8/VkphcI

Score

9^/10

evasion ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exe

pid process

3192 bcdedit.exe
1716 bcdedit.exe
2484 bcdedit.exe
5060 bcdedit.exe
3100 bcdedit.exe

pid	process
3192	bcdedit.exe
1716	bcdedit.exe
2484	bcdedit.exe
5060	bcdedit.exe
3100	bcdedit.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

ljnae-a.exeljnae-a.exe

pid process

3576 ljnae-a.exe
4572 ljnae-a.exe

pid	process
3576	ljnae-a.exe
4572	ljnae-a.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exeljnae-a.exe

description	pid	process	target process
PID 712 set thread context of 536	712	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe
PID 3576 set thread context of 4572	3576	ljnae-a.exe	ljnae-a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

3628 vssadmin.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ljnae-a.exe

pid process

4572 ljnae-a.exe
4572 ljnae-a.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exeljnae-a.exe

description pid process

Token: SeDebugPrivilege 536 013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe
Token: SeDebugPrivilege 4572 ljnae-a.exe

pid	process
3628	vssadmin.exe

pid	process
4572	ljnae-a.exe
4572	ljnae-a.exe

description	pid	process
Token: SeDebugPrivilege	536	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe
Token: SeDebugPrivilege	4572	ljnae-a.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exeljnae-a.exeljnae-a.exe

description	pid	process	target process
PID 712 wrote to memory of 536	712	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe
PID 712 wrote to memory of 536	712	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe
PID 712 wrote to memory of 536	712	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe
PID 712 wrote to memory of 536	712	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe
PID 712 wrote to memory of 536	712	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe
PID 712 wrote to memory of 536	712	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe
PID 712 wrote to memory of 536	712	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe
PID 712 wrote to memory of 536	712	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe
PID 712 wrote to memory of 536	712	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe
PID 712 wrote to memory of 536	712	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe
PID 536 wrote to memory of 3576	536	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe	ljnae-a.exe
PID 536 wrote to memory of 3576	536	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe	ljnae-a.exe
PID 536 wrote to memory of 3576	536	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe	ljnae-a.exe
PID 536 wrote to memory of 3312	536	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe	cmd.exe
PID 536 wrote to memory of 3312	536	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe	cmd.exe
PID 536 wrote to memory of 3312	536	013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe	cmd.exe
PID 3576 wrote to memory of 4572	3576	ljnae-a.exe	ljnae-a.exe
PID 3576 wrote to memory of 4572	3576	ljnae-a.exe	ljnae-a.exe
PID 3576 wrote to memory of 4572	3576	ljnae-a.exe	ljnae-a.exe
PID 3576 wrote to memory of 4572	3576	ljnae-a.exe	ljnae-a.exe
PID 3576 wrote to memory of 4572	3576	ljnae-a.exe	ljnae-a.exe
PID 3576 wrote to memory of 4572	3576	ljnae-a.exe	ljnae-a.exe
PID 3576 wrote to memory of 4572	3576	ljnae-a.exe	ljnae-a.exe
PID 3576 wrote to memory of 4572	3576	ljnae-a.exe	ljnae-a.exe
PID 3576 wrote to memory of 4572	3576	ljnae-a.exe	ljnae-a.exe
PID 3576 wrote to memory of 4572	3576	ljnae-a.exe	ljnae-a.exe
PID 4572 wrote to memory of 3192	4572	ljnae-a.exe	bcdedit.exe
PID 4572 wrote to memory of 3192	4572	ljnae-a.exe	bcdedit.exe
PID 4572 wrote to memory of 1716	4572	ljnae-a.exe	bcdedit.exe
PID 4572 wrote to memory of 1716	4572	ljnae-a.exe	bcdedit.exe
PID 4572 wrote to memory of 2484	4572	ljnae-a.exe	bcdedit.exe
PID 4572 wrote to memory of 2484	4572	ljnae-a.exe	bcdedit.exe
PID 4572 wrote to memory of 5060	4572	ljnae-a.exe	bcdedit.exe
PID 4572 wrote to memory of 5060	4572	ljnae-a.exe	bcdedit.exe
PID 4572 wrote to memory of 3100	4572	ljnae-a.exe	bcdedit.exe
PID 4572 wrote to memory of 3100	4572	ljnae-a.exe	bcdedit.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

ljnae-a.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ljnae-a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	ljnae-a.exe

C:\Users\Admin\AppData\Local\Temp\013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:712

C:\Users\Admin\AppData\Local\Temp\013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\013dfbda7c6d94dd8d729c3b15bc53d4_JaffaCakes118.exe"
2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536

C:\Users\Admin\AppData\Roaming\ljnae-a.exe
C:\Users\Admin\AppData\Roaming\ljnae-a.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3576

C:\Users\Admin\AppData\Roaming\ljnae-a.exe
C:\Users\Admin\AppData\Roaming\ljnae-a.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4572

C:\Windows\SYSTEM32\bcdedit.exe
bcdedit.exe /set {current} bootems off
5⤵
- Modifies boot configuration data using bcdedit
PID:3192

C:\Windows\SYSTEM32\bcdedit.exe
bcdedit.exe /set {current} advancedoptions off
5⤵
- Modifies boot configuration data using bcdedit
PID:1716

C:\Windows\SYSTEM32\bcdedit.exe
bcdedit.exe /set {current} optionsedit off
5⤵
- Modifies boot configuration data using bcdedit
PID:2484

C:\Windows\SYSTEM32\bcdedit.exe
bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
5⤵
- Modifies boot configuration data using bcdedit
PID:5060

C:\Windows\SYSTEM32\bcdedit.exe
bcdedit.exe /set {current} recoveryenabled off
5⤵
- Modifies boot configuration data using bcdedit
PID:3100

C:\Windows\System32\vssadmin.exe
"C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
5⤵
- Interacts with shadow copies
PID:3628

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\013DFB~1.EXE
3⤵
PID:3312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

2

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

3

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ljnae-a.exe

Filesize
364KB

MD5
013dfbda7c6d94dd8d729c3b15bc53d4

SHA1
0404eda74b1de75ceb85d3056f8169bd2a4607ea

SHA256
553eb0cfb24c42ad0a8e1978fca7c488016e7ee23dc7516893ce2e4cf9901b73

SHA512
c43b7542422a0b47505ee1f1777300926932f0d40f61264d020650c2bc6d30996f5566de81c0b80a94d1ff3d087f9a55b6a9c4eb2938cb4a38bacf26cbc49dac

Download Submit
memory/536-1-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/536-3-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/536-10-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/536-2-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/536-5-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/712-4-0x0000000000920000-0x0000000000923000-memory.dmp

Filesize
12KB

Download
memory/712-0-0x0000000000920000-0x0000000000923000-memory.dmp

Filesize
12KB

Download
memory/4572-14-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4572-15-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4572-16-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4572-17-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4572-20-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4572-19-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4572-22-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads