Analysis

  • max time kernel
    135s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-05-2024 06:21

General

  • Target

    0b40a2fff66d3c7f728b2d0e9ae861a6_JaffaCakes118.exe

  • Size

    654KB

  • MD5

    0b40a2fff66d3c7f728b2d0e9ae861a6

  • SHA1

    91f89d87f92ba4f96d16a96c35e56e039adf6979

  • SHA256

    117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2

  • SHA512

    dec02943bb4dfae04c0fcce7cb644aa60277f33cd4747270b4a2d3feb5ca53cf6a5d037eb618bc4c27e3ea266089a2fa8b0ae1fb68f9180fb9b4a15522834c5a

  • SSDEEP

    12288:yz9jX9Eh/41Vfbtp/nZOKwXui/07zrwIOxbvnFbhs68/NimxAOWD:yz9jX9EhifbtpPZ+5/0jwIOBnqFJHWD

Malware Config

Signatures

  • Locky (Lukitus variant)

    Variant of the Locky ransomware seen in the wild since late 2017.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies Control Panel 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b40a2fff66d3c7f728b2d0e9ae861a6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0b40a2fff66d3c7f728b2d0e9ae861a6_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    • Suspicious use of WriteProcessMemory
    PID:3128
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\lukitus.htm
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3948
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbaa3246f8,0x7ffbaa324708,0x7ffbaa324718
        3⤵
          PID:4388
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,18252288860114458579,11699030751076673421,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
          3⤵
            PID:4644
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,18252288860114458579,11699030751076673421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2004
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,18252288860114458579,11699030751076673421,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
            3⤵
              PID:3928
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18252288860114458579,11699030751076673421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
              3⤵
                PID:776
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18252288860114458579,11699030751076673421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
                3⤵
                  PID:2628
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,18252288860114458579,11699030751076673421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
                  3⤵
                    PID:1376
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,18252288860114458579,11699030751076673421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2200
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18252288860114458579,11699030751076673421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
                    3⤵
                      PID:1576
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18252288860114458579,11699030751076673421,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2580 /prefetch:1
                      3⤵
                        PID:2524
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18252288860114458579,11699030751076673421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
                        3⤵
                          PID:1220
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18252288860114458579,11699030751076673421,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
                          3⤵
                            PID:3020
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\0b40a2fff66d3c7f728b2d0e9ae861a6_JaffaCakes118.exe"
                          2⤵
                            PID:4400
                        • C:\Windows\system32\vssvc.exe
                          C:\Windows\system32\vssvc.exe
                          1⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3088
                        • C:\Windows\system32\vssadmin.exe
                          C:\Windows\system32\vssadmin.exe Delete Shadows /Quiet /All
                          1⤵
                          • Interacts with shadow copies
                          PID:3492
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:4128
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:3192

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              4dc6fc5e708279a3310fe55d9c44743d

                              SHA1

                              a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

                              SHA256

                              a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

                              SHA512

                              5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              c9c4c494f8fba32d95ba2125f00586a3

                              SHA1

                              8a600205528aef7953144f1cf6f7a5115e3611de

                              SHA256

                              a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

                              SHA512

                              9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              bc88b322b909699d72e30dede2362490

                              SHA1

                              f107c04d702955248e2b47c7469aaee1a2509446

                              SHA256

                              8e80725d561050291609f35de6fe484cec6302f287c8b42415be47831e765a69

                              SHA512

                              2cbff0232e765223eff08f87422e97df65cf33018b485ec5e710698da638b58dd0b02415c0ef6516ac2806d340155672fb8370dd0f5026330c3a71f0368e874f

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              00290d937fa9c887a68df5747d332314

                              SHA1

                              95e4d45c4e0183714e76317f4a85fd3713415274

                              SHA256

                              dc22ff944f8322bc78f1bec1d0fe8ab6c5026d764a1425829a0763cb7b96b630

                              SHA512

                              ee8d4360b3a45f1a4dd752f11dad4b8f5bbd01c46cd15b8292362fabd3ee4e3f10976b5d590af540e45515e9052e7bd290194488226b1d0d81507119b6ad111e

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              46295cac801e5d4857d09837238a6394

                              SHA1

                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                              SHA256

                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                              SHA512

                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              206702161f94c5cd39fadd03f4014d98

                              SHA1

                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                              SHA256

                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                              SHA512

                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              11KB

                              MD5

                              506527968b61ff509456917112b4daf7

                              SHA1

                              109690e565afcab4fb58af4f2ea8390953ed3b2a

                              SHA256

                              33451c69840db31f7ca8753be2f4fb11d0bdabe444ec35397e6ec561071cbe70

                              SHA512

                              2659279ecbf900c8e1dbb4529eb3241c1518f02c1e7aaf8151f61e1bd6074c465940cc45f179222eb2332e1f1e993bce3de40af32fd55fc953badd4db0f0554e

                            • C:\Users\Admin\Desktop\lukitus.htm

                              Filesize

                              8KB

                              MD5

                              c93715dd901a9baff11e8a5b0ce9a5f6

                              SHA1

                              219b2745bf3093a3d2154471981f2bb484542700

                              SHA256

                              6c6c8de691eae8b14de0f0c65b7a2a41a6a04a75d06e2587d4cefb2eefbda779

                              SHA512

                              c1c7f4ad0e9e6acd7e404c4355afb6700f174c7abe65fb9bea192ed04be837e6ff87709d7503bdf68a4df4dd87d2302a0a83ee620653fb251c9ebfc270b56d0b

                            • memory/3128-7-0x0000000000400000-0x00000000004A6000-memory.dmp

                              Filesize

                              664KB

                            • memory/3128-300-0x0000000000400000-0x00000000004A6000-memory.dmp

                              Filesize

                              664KB

                            • memory/3128-2-0x0000000000400000-0x00000000004A6000-memory.dmp

                              Filesize

                              664KB

                            • memory/3128-3-0x0000000000400000-0x00000000004A6000-memory.dmp

                              Filesize

                              664KB

                            • memory/3128-6-0x0000000000760000-0x0000000000761000-memory.dmp

                              Filesize

                              4KB

                            • memory/3128-0-0x000000005F000000-0x000000005F011000-memory.dmp

                              Filesize

                              68KB

                            • memory/3128-5-0x0000000000750000-0x0000000000751000-memory.dmp

                              Filesize

                              4KB