e9a44a6ff70e5200eb7a5bb93168a7b1d4065d30761879b5119d3066d654f71b

General

Target

02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
Size

3.7MB
MD5

02a18d897c930d9c1f74325e525ce6fa
SHA1

d6ea4abc5d761e68c65dab6c43fc1bf87349d226
SHA256

e9a44a6ff70e5200eb7a5bb93168a7b1d4065d30761879b5119d3066d654f71b
SHA512

8da4be895d35fa219861c06f6f1bf9f71686e3a2c6fda46377ea1b9fd0916e8b999779e5229f46f4fd38ac1cac708fbb4a90b6b208898d4f6b478747b4019869
SSDEEP

49152:iEs1syBadPOgo7kMc72k61TidyZNSLx4qtamNzM1nEAadHiXe:iE2snzMcBMNSLie

Score

10^/10

persistence ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exeHelpMe.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops startup file 3 IoCs

Processes:

HelpMe.exe02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

HelpMe.exe

pid process

2440 HelpMe.exe
Loads dropped DLL 2 IoCs

Processes:

02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe

pid process

2068 02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
2068 02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe

pid	process
2440	HelpMe.exe

pid	process
2068	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
2068	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

HelpMe.exe02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\R:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\U:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\S:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\Y:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\Z:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\K:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\N:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\E:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\L:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\I:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\M:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\J:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\O:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\T:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\B:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\G:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\H:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\V:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\W:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\X:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\A:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\Q:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\P:	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened (read-only)	\??\P:	HelpMe.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exeHelpMe.exe

description	ioc	process
File opened for modification	F:\AUTORUN.INF	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened for modification	C:\AUTORUN.INF	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 4 IoCs

Processes:

02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exeHelpMe.exe

description	ioc	process
File created	C:\Windows\SysWOW64\HelpMe.exe	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File opened for modification	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\notepad.exe.exe	HelpMe.exe

Drops file in Program Files directory 1 IoCs

Processes:

HelpMe.exe

description ioc process

File created C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe HelpMe.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

HelpMe.exe

pid process

2440 HelpMe.exe

description	ioc	process
File created	C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe	HelpMe.exe

pid	process
2440	HelpMe.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe

description	pid	process	target process
PID 2068 wrote to memory of 2440	2068	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe	HelpMe.exe
PID 2068 wrote to memory of 2440	2068	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe	HelpMe.exe
PID 2068 wrote to memory of 2440	2068	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe	HelpMe.exe
PID 2068 wrote to memory of 2440	2068	02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe	HelpMe.exe

C:\Users\Admin\AppData\Local\Temp\02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02a18d897c930d9c1f74325e525ce6fa_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2068

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\system32\HelpMe.exe
2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2440

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.exe
Filesize
3.7MB

MD5
76787ae7065ae246d3f89591226c4ece

SHA1
f617b140610f7cd00ac62373020bfacb736f8982

SHA256
43aeed50e8966915d579cd927ab54281cb609ec7d4e789e90b09051e905eb388

SHA512
f448ad010291eb4ad4ff055c7992b6488933611e66d5a1565058c4afdd0337d0dab1ba0e993f22ad88c9fcc083e0f8ef6de7199af3d47fd78a39285bff705813

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
0de046f8e92f6b3c942bd227945977ff

SHA1
85d5af3858e6904e66616ccb019fb9df8e84ffb0

SHA256
8c3cb5f019baf9e9f5ba1f53ae5e53b46008aeeec1eab206497f025d80ce355d

SHA512
567b1d8cb432766393f2b173470b41ceb22244996cbae78a789cbd8f72d1d45f320081d64413eb15f481188c307ec23dd6bf54099d9227ef6a4c52fabcba02b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
950B

MD5
5a1edc298dd3a9385731d42b3e3c1e0c

SHA1
ae206e44cd77327d711c13d3532f8f2737435bb8

SHA256
8845cee4eea6aaa2048106ede4a1779e5f01e4b05b428476c7cbdb7c84fc639a

SHA512
3d0c4a3b504c293f69a79d17f5dc7980c5c5517b09a6b87e5eea743d1ab7e0c8707ece442479ca4f3f074c6d1758818f18ebb499d07ca768a35d29afd665f9c3

Download Submit
F:\AUTORUN.INF
Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
F:\AutoRun.exe
Filesize
3.7MB

MD5
02a18d897c930d9c1f74325e525ce6fa

SHA1
d6ea4abc5d761e68c65dab6c43fc1bf87349d226

SHA256
e9a44a6ff70e5200eb7a5bb93168a7b1d4065d30761879b5119d3066d654f71b

SHA512
8da4be895d35fa219861c06f6f1bf9f71686e3a2c6fda46377ea1b9fd0916e8b999779e5229f46f4fd38ac1cac708fbb4a90b6b208898d4f6b478747b4019869

Download Submit
\Windows\SysWOW64\HelpMe.exe
Filesize
740KB

MD5
7a6792e7b74caf1d7b2bc15de0d6efd6

SHA1
c5f8892c0eae77f937b61bdf4f4a7c0f74fe1392

SHA256
3f689b6bc94796f538b26107b9125f6a351eb4f57dc1b93c667f9a016fa888cd

SHA512
6a4938b65fef74ea98fd7ac13c7cf029d6556412bb8121527806fb8ff288db6cc13206da993bd5f3ca5f0e3627027e1b82fed76c7a289020cdb8f786bb9d97f3

Download Submit
memory/2068-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2068-240-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2440-9-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2440-241-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads