sodinokibi | dd7c40b211a54f1c860c85af0f488cf3aab9608041294f281261b636b59e494d

Resubmissions

01-05-2024 16:41

240501-t6493sdf43 10

01-05-2024 12:24

240501-pk4dfagh25 10

Analysis

max time kernel
1049s
max time network
1050s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
01-05-2024 16:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
Size

164KB
MD5

0bcaab2d6aae4221ae17527874cd1167
SHA1

682cef7ee433feb06c1db1d445f9618eeff5eb95
SHA256

dd7c40b211a54f1c860c85af0f488cf3aab9608041294f281261b636b59e494d
SHA512

72a089cf1294ef7fc6d2f0b3e706e46b99be97bbb9f018f45f5c954673006f3f8bda683f7b62f0de91202f5873ff0abe23befc8e2558ef3283c6d13e74a9e08e
SSDEEP

3072:70XoUeZ/DVS8L7flcMTeYWikGLvFfdL+qaXgOvGwZxC4:7eoUeZRlcYxWYTFflnaPvGe

Score

10^/10

sodinokibi persistence ransomware

Malware Config

Extracted

Path

C:\Recovery\mm660g-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion mm660g. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/65E07B142510055C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/65E07B142510055C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: i0GIFiIWojifpPaW9DdMHYrxGrDuK3WuFDEHJXQhklCChkvfV6Qo7thXxWlJx7T9 iQcCmOuNiajQ+iurVd3RwxIMGgNDC9q0u6pBbiwiDJ1F6qIJ782hG9Dc/YYHm7im Zcs5gUsxze+bEQ95jSbGiX/yoxC5Hh4nKmwoqRsORjEL0PJUXqDnS8OZN0lndWhF jyj3MrAIo9lTYw+RberwzXHBZPSexDPDkLJ+aABlygtOUBTmATiw/qOq0VMujQkX /K8bPWlyI5TWS+uIci/pameu0mIzIU7nVGRPvN7t3/YOQ2yONW6H5L8g3C+RS+LJ xZw7BKioqH2XGvgj5DNjm48ITO3j3LKDPoSQFB4hl2pqndpz0enJB4qcUxULmec9 h1SqpB6pI+VSeEdIFIiEHFis3pwCBlzI+AOBRtRGiE4618P8PXuJntMDU7d9IvEs W4lKZnPG97OpXPU+ua9J9KM9EznMIGeB7A54Bw+rsk/ESTyEHWMcMrRCEmEPHim2 XRbvDJjv9HGbdr+CN9wSJnONCTehLnuihmjDfEblUG5/fzlvGrq6wb4tEJnRH9mv ugsdBMBL4uh6zvzvUFYkZfns4cTS4MBsv3WHwIetsXnI/Ua/92i7jLlAOdfCP4xh 3fEXlmyE2tlKWavG6aAptf7O6PudUZ/9L4uhh363FoadifkZod6rYS3x58JH0UQx SMdzXY4u/HtkmGQeDOf3KGcg3qy0E8UAJ0H4nSM1HdaWsYbj9v0cb3KC2fjXESHi yqL4E5BaD16eQEW+Ni1Ru2R/B0kJ7Er507oFNyY/nEWlpCwkl9lWNfJ1YcEajH9W RTxntNLm7+EKQqDLv0iglT88mS5bdFM6WvCVwMkCz6xleS1Um6uaLXBbdfqQKvpu xOyq6ttLfrW0gLqtb1Y7i2fB7JtXdz0vx1x0XWD/NGEZ7GCuGA8vYv68JjDGRHon uXDB6v0xZQoTj4eOZBVyUBiDqzVvzW/uil58GaD2dpbdtLbtETyR4QVbXYeaaLc5 niPAvs1FtwTzf0oVi/I0bKrkHV+W2ZuHkXS6aY8MRPCsjoM+tpuop0ias+2+vLgq bwMK7SxGDyQs9kLfe4vVE8FtGQppAQlFY1zTDuSjZLdjLko12O2Jg6NJFNEyFbS3 nTllOzJNduWCXIYZW9Gfmw1adDjkYgk1/hepEJv2qRsDTWAewihDcqpAQCeJW5+i QoSTB0LdKTAeeckXon/OmVsN Extension name: mm660g ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/65E07B142510055C

http://decryptor.top/65E07B142510055C

Extracted

Path

C:\Users\Public\Desktop\mm660g-readme.txt

Family

sodinokibi

Ransom Note

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/65E07B142510055C

http://decryptor.top/65E07B142510055C

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dWCJzZNzru = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe"	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\P:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\Z:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\G:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\J:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\D:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\X:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\B:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\E:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\N:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\R:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\Y:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\F:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\K:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\O:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\S:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\I:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\W:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\Q:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\T:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\U:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\V:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\A:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\H:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened (read-only)	\??\M:	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0a5li8132a7z.bmp"	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe

Drops file in Program Files directory 35 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\RedoRestore.ex_	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResumeWatch.3gp2	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\TestSelect.xls	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UninstallFormat.ini	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\FormatDismount.midi	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\OptimizeRepair.tiff	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ReceivePublish.i64	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SplitTest.xlsm	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnregisterSuspend.contact	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\BackupPop.csv	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\FormatEnter.contact	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResizeDeny.mpeg	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\GetUpdate.7z	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\GroupOptimize.mpp	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\DenyOut.snd	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\DenySend.mov	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\DisconnectRepair.pps	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SplitImport.inf	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File created	\??\c:\program files\mm660g-readme.txt	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RedoOpen.dotx	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResumeResize.html	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\PingCompress.dib	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ShowInvoke.3g2	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CompleteImport.wmf	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CompressRename.m4v	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\FormatSwitch.rar	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RedoNew.vbe	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RevokeStep.svg	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UndoWatch.mp4	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\OutStop.vssm	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ReceiveStop.css	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResumeMerge.mp3	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File created	\??\c:\program files (x86)\mm660g-readme.txt	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResumeRedo.ini	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SplitOut.pub	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings	OpenWith.exe

Modifies system certificate store 2 TTPs 13 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB\Blob = 03000000010000001400000033e4e80807204c2b6182a3a14b591acd25b5f0db1400000001000000140000008d8c5ec454ad8ae177e99bf99b05e1b8018d61e1040000000100000010000000adab5c4df031fb9299f71ada7e18f6130f00000001000000300000008b612b2190a95b28b866b9be5d0b95f368c17534ab1da61a42dfb32766f9ae2908fe6bfd1669be140eddaf0d33e95235190000000100000010000000fc741b3b78cfb31e075744fe5d0eeb965c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf20000000010000001706000030820613308203fba00302010202107d5b5126b476ba11db74160bbc530da7300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a30818f310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313730350603550403132e5365637469676f2052534120446f6d61696e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d67333d6d73c20d000d21745b8d63e07a23fc741ee3230c9b06cfdf49fcb12980f2d3f8d4d010c820f177f622ee9b84879fb16834eadd7322593b707bfb9503fa94cc3402ae939ffd981ca1f163241da8026b9237a87201ee3ff209a3c95446f8775069040b4329316091008233ed2dd870f6f5d51146a0a69c54f017269cfd3934c6d04a0a31b827eb19ab9edc59ec537789f9a0834fb562e58c4090e06645bbc37dcf19f2868a856b092a35c9fbb8898081b241dab3085aeafb02e9e7a9dc1c0421ce202f0eae04ad2ef900eb4c14016f06f85424a64f7a430a0febf2ea3275a8e8b58b8adc319178463ed6f56fd83cb6034c474bee69ddbe1e4e5ca0c5f150203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e041604148d8c5ec454ad8ae177e99bf99b05e1b8018d61e1300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c0500038202010032bf61bd0e48c34fc7ba474df89c781901dc131d806ffcc370b4529a31339a5752fb319e6ba4ef54aa898d401768f811107cd2cab1f15586c7eeb3369186f63951bf46bf0fa0bab4f77e49c42a36179ee468397aaf944e566fb27b3bbf0a86bdcdc5771c03b838b1a21f5f7edb8adc4648b6680acfb2b5b4e234e467a93866095ed2b8fc9d283a174027c2724e29fd213c7ccf13fb962cc53144fd13edd59ba96968777ceee1ffa4f93638085339a284349c19f3be0eacd52437eb23a878d0d3e7ef924764623922efc6f711be2285c6664424268e10328dc893ae079e833e2fd9f9f5468e63bec1e6b4dca6cd21a8860a95d92e85261afdfcb1b657426d95d133f6391406824138f58f58dc805ba4d57d9578fda79bfffdc5a869ab26e7a7a405875ba9b7b8a3200b97a94585ddb38be589378e290dfc0617f638400e42e41206fb7bf3c6116862dfe398f413d8154f8bb169d91060bc642aea31b7e4b5a33a149b26e30b7bfd028eb699c138975936f6a874a286b65eebc664eacfa0a3f96e9eba2d11b6869808582dc9ac2564f25e75b438c1ae7f5a4683ea51cab6f19911356ba56a7bc600b0e7f8be64b2adc8c2f1ace351eaa493e079c8e18140c90a5be1123cc1602ae397c08942ca94cf46981269bb98d0c2d30d724b476ee593c43228638743e4b0323e0ad34bbf239b1429412b9a041f932df1c739483cad5a127f	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Microsoft\SystemCertificates\CA\Certificates\247106A405B288A46E70A0262717162D0903E734\Blob = 030000000100000014000000247106a405b288a46e70a0262717162d0903e734140000000100000014000000b390a7d8c9af4ecd613c9f7cad5d7f41fd6930ea0400000001000000100000001a9a69a81f6da92d87f7694e16d8b8790f00000001000000300000009e9609372f45b5101548e8af9a20e0dbf5932dea9b9af86759c2029bc3b53e306e6491f6b15bf00b1e2dee3bb8d43d2219000000010000001000000043e6fa09a3b9d0de6fbe3aacd184c8fd5c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000ed050000308205e9308203d1a003020102021005e4dc3b9438ab3b8597cba6a19850e3300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3134303931323030303030305a170d3234303931313233353935395a305f310b3009060355040613024652310e300c060355040813055061726973310e300c060355040713055061726973310e300c060355040a130547616e64693120301e0603550403131747616e6469205374616e646172642053534c204341203230820122300d06092a864886f70d01010105000382010f003082010a028201010094042da6799574ffd5003cf5aed894b1297cc08f0b0b89b98283976e3728f5a21acfd2920b9ba8d387947384109fdc35cbc22d92ac21b9cb3bfc40c1c18321f0bff8f69cfa9c8210c0d08e4ee50d4cb0915c90b4a4405116dae484122d055ca11f17192451aa7aeae1071b868d0172f2e7d48323399ee0e14c1f6b22a3b41066b0ed8296d76e6ab4f23fb542fcdd8ab5abba2d1d3a759b31dc3e9dac5bd3410d6cb01bf53af579ea21a2f8f433524b242d1ea499b16d48bcb812fe72707cf7fb0275f48dded6dac0a0321a52df386b2e45383f3f049600fda1f4a2bbd517d6277c1b5859955e8a12fd9cab813e52284851856bf391b2863f29b56e0362eed6050203010001a382017530820171301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e04160414b390a7d8c9af4ecd613c9f7cad5d7f41fd6930ea300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b0601050507030230220603551d20041b3019300d060b2b06010401b2310102021a3008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c050003820201005867fd72b26ad77c6196197ed94346d1267dc853fa66b06b2da7d3aa56f73a88d03b72c950fdf759b2aa68f58c7303bb956517ce2f1cdd9813a291c9eea1406e3c98d65cf3b2223c2dee1ba4e1de202416f28c1173913af6face240287ca93ecb4b6c81617c572fc2740f613fe93a69d51ef3c2bd877579b8c653a352536b7b58a636f072793b1608d80db96d47a8f2dab1c88c96e7ed6651faf5dca163f2846dca035e5f9e9e5d596880c4fc6b77767488427b61fb068dbacbf77b090b8a2c91c325d02ba2543814247bbd8e18f0c0c465fee46336b031482d37ecd8faf90d68e247d4042b46a6a17c69597e1f238cda7edb4274093df72a9b8c666633738642230a23bf1b9c87bc8fb293aab1a72d206124ef682d4236f3ec393e5d8b6c0dedc2316d61330b7a09a0e2c5506007001cfea391d80db88f7a520b85bfd3126698f2d0a61833a47a613542c1ee3ed44cabc6a1f280e51d9de0e9f75cd0e0395caf9c5a92a2dfe41a4a147ae0dc2f93966334a5be18428596c7d941776e44582ad7020fdd26f63a8d7faa033fa37cbf7b2659eda506f3fe4a7f38e5d58329770232ee7fdc4159b9c278f32ed17ad58813129111a9bd4fc6c9528c74e0507a6fd1dbc19e2e8b7b9118a2d701252858d8c334a0ffc9992e06370daa594476307e758c7315f053d3655fe83b2e8a6add7e9e6027488745cda34db90d26d510a23d623	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 5c0000000100000004000000000800001900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d040000000100000010000000410352dc0ff7501b16f0028eba6f45c520000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Microsoft\SystemCertificates\CA\Certificates\247106A405B288A46E70A0262717162D0903E734	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f95c0000000100000004000000000800001800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1364	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
1364	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
5112	powershell.exe
5112	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1364	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
Token: SeDebugPrivilege	5112	powershell.exe
Token: SeBackupPrivilege	692	vssvc.exe
Token: SeRestorePrivilege	692	vssvc.exe
Token: SeAuditPrivilege	692	vssvc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
560	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 5112	1364	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe	83
PID 1364 wrote to memory of 5112	1364	0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe	83

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0bcaab2d6aae4221ae17527874cd1167_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5112

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3876

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:692

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\mm660g-readme.txt
1⤵
PID:1756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1688

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\mm660g-readme.txt

Filesize
6KB

MD5
4f04a561f5ea58bd1525270219e20a5c

SHA1
32b1a2b9c048416ac4eb1ff170f969d7ac7b4792

SHA256
5ba4f2a8b87eaf9de042472710fcbee2290ca96394fa16d64e2972993db0d84c

SHA512
997e19fbef5b456cb7c42557b6f8727567bb19d6c5d8829679f054ae39643ccfd43bc2fb88ca04d3304767649a0fc284d7b987bf21888e3c641ce04d8dbcd3c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xr1awhnp.ppu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\AddSkip.xltm.mm660g

Filesize
348KB

MD5
758767306a59b9b8eef04bb6e917d071

SHA1
58bae640adb8a7c2572494b2d95646497fb882dc

SHA256
24bb2724f2d31531754c85984d13e951b2f53581bdfc74135067196d598dc0ea

SHA512
deda7870d9d90a578d0afb56e61885118ba00bb1118059b87d82f14123cf818e274a180c7e0478a515efad39aed4ff10678db13fd2877eb5af7c0108c1def515

Download Submit
C:\Users\Admin\Desktop\CheckpointRepair.aif.mm660g

Filesize
528KB

MD5
097523b5226dd21697a1d453c0f966a1

SHA1
76694040b5adb5d3b12472f45eb6cc54da5409ff

SHA256
4f6b40afebc9ede6aa2780558966de1ac45eb9116f5fc820c68caff872371aeb

SHA512
4198f8287ac1331f71222ff46c725253c762335d3fcc5eaec8a637d8b6901064b220975e1530c53de72a4381a7df17861ca77b29975b5f61ce6c9c3847f57f61

Download Submit
C:\Users\Admin\Desktop\ConvertConvertFrom.3gp.mm660g

Filesize
573KB

MD5
aebd0b47b7864a5511d3d98a9d42b262

SHA1
d0770d3fa31a5f78455528f43897101703f52c84

SHA256
6e98224de2fb4b2e59c4efcc3ae0d7c4f5a9621195b1cffff102f0f09b3ac932

SHA512
32acc878b575321ca21df4b748157134da2aaec51959aff680637e20b5f1af408e1b9ac831b376071e8079ee319f9330aaaa08bf500d1dbc54391c876ff641e7

Download Submit
C:\Users\Admin\Desktop\DebugRevoke.xps.mm660g

Filesize
820KB

MD5
87444498a20a6c80b3481bccc501321a

SHA1
6e702a78aa09ddf73750c0ce5004cd544ea9d6a6

SHA256
5b574c5d261f54c098c7714d53e4b08d1920e7598d428d2ac2b2af215aba59d5

SHA512
78d5929f132a245bb815c33e887dc6492a76c4f45f5d2fa3bba6ae98c88404f4e030277bd5fdd0b4a50b2f1ccc8d6c18ff26d1888585adb7332359303963ea01

Download Submit
C:\Users\Admin\Desktop\EnableInitialize.cfg.mm660g

Filesize
753KB

MD5
a5c048f00c6d46453e1bba116337327b

SHA1
4382d35237645baf0f617a5d0eb7c744df728774

SHA256
e98f5f6150cdcd446928769d37ca9c4ce9ac3367de71100f79df376203ab6472

SHA512
8ed38959f1b7b9b93f80aadb20c2288c67c2c6aef797c620450c80e51de234cbeb7ab28c0f5133e425726fb2713fa55505fa0dcd1df14f7fd700d6080fdefdd2

Download Submit
C:\Users\Admin\Desktop\ExpandFormat.rtf.mm660g

Filesize
1.2MB

MD5
b6194ab396abc7fc750a675469b328ba

SHA1
5aec51232d78023f302896d73e8f00e546c3df39

SHA256
109f85d861e75d21717428d77e9a7167be33867eae357c4113b9dac6380613d5

SHA512
42720a4f96f6ffa41fda405ccb62372d1b5c96c96156ad8466d6d27c29709984a452dd91f631018eebe4e7ffd854fe60d0bdf17db2cbaa1254e0a30b795d6511

Download Submit
C:\Users\Admin\Desktop\ExportCompare.wmv.mm660g

Filesize
663KB

MD5
a3e78eba6982625f7f7a71c0158bd3cf

SHA1
8e6ae74b9ad62e3b6fb3cfa2446af453a51f6489

SHA256
fdbee5d6a9a503ed4a3d80473995179bebbecae4123ec8326019a0d63f537428

SHA512
b56839896b04d55c63401fd3f7cd55262a8a5051b3260cf5232d1fa97ccd19d7b6272967782800fcf4702aa51b8f74215803bb5bdf536cbf2e22b59f0fe7d180

Download Submit
C:\Users\Admin\Desktop\GroupDeny.docx.mm660g

Filesize
708KB

MD5
bb4e97dc9402d4f5de3c7b6137197dc5

SHA1
6c53cca5677f66d0da8e641af5850b4bc6910fb9

SHA256
69f8213fc7f6b3b07698d9d053bceedfa42a03b59cf7d5b526a861dcd6b99840

SHA512
b3071179fccc96460d3358c7e4c2e7c1290d3966be6b0638ca31395c0c880f53b47ccebbbaf61b6fef7e772a2e376068b468d230374061052c596da9add2cc45

Download Submit
C:\Users\Admin\Desktop\HideDisable.gif.mm660g

Filesize
618KB

MD5
993a8e0691c3ca48204e08147d455484

SHA1
9537944e6fa523c23f1c11f79e454409616ea1df

SHA256
bed91c412af0ca2c12edd2fc564efffe4c2bdf9c65b0bd4328020e15113569f6

SHA512
09ebe39f670330d16bbe110ed9f10698130049a5457778d5b8122d55f744aed8bd52a1218a130899fca2b44b44ccbfdf428422c351fb1f9a96ca45a9534ce070

Download Submit
C:\Users\Admin\Desktop\InstallConvertTo.wvx.mm660g

Filesize
303KB

MD5
fb22b58ca52b4d10e97035af489e07e0

SHA1
4e94903cccc03e15bd3f95d6501bafa0e174bb70

SHA256
29288c45167635cf8a23096deb0d8ea00637724b72694db0c27d3cf0459bb509

SHA512
d94e4c320aab925d85144fff2529558fd7c799d65ae0fad7e72ea5082a2acf07783ce33253bb570dd7bd340dd633ec86146eca29b9602eee58e104b4fba01142

Download Submit
C:\Users\Admin\Desktop\InvokeOut.ppsx.mm660g

Filesize
483KB

MD5
d25a514819220e9b11ae957f91bb8881

SHA1
90efb22233e206038386f9522dfe356203097782

SHA256
38e0c3ae4bbcf0716a3bf721beec744afe77b56a30f52759c37df020f2820558

SHA512
3da0759392d161a7a8648a982b0e188f28d7f7e568f02609fb4df472607762bd73468ed2327bb669a72db8230074ed16fbce0c8b8981947d9f471e63267fe043

Download Submit
C:\Users\Admin\Desktop\MergePop.exe

Filesize
505KB

MD5
8f807f189a121a998ed408015656f03f

SHA1
6609d98ac263befe31523b76d0af7ce1100da4e6

SHA256
716a47abac3b7b3a1b98e99c2a01992603f36dd5c75205e3dbf4ee4c4cc1153f

SHA512
eb8353376e12a6076d99de87ee1b1c22493fd02b59d94ac62945b6acb01b6ea5baa919fe55fd74b77531c3d2dcdf3e6cecaf0453ea2ae329d61490c3a03fae7c

Download Submit
C:\Users\Admin\Desktop\MergeRename.odt.mm660g

Filesize
438KB

MD5
798c68f1c2d7accde5dfb9b648109d7b

SHA1
62deea54c33691eed41769a699b7f03d5f14fa50

SHA256
5c2cfb9f041d9a0fd578ca9f57244a2058b8a0e8d3b3575ed8a81e933d2e0733

SHA512
f8c962709bf4bad594ad3cda360dce983479c3d13a564f0f69aaa4d2d4d2f0b711018e5349c33d448cc8a26ecb42e271acfee5aa6c8428f1109af17b7b1954b8

Download Submit
C:\Users\Admin\Desktop\MergeReset.csv.mm660g

Filesize
685KB

MD5
52cef770d58c3a171f740d55aac7fa3a

SHA1
38be38411feaa41b73f9ab5147d1eaa0f23e35c1

SHA256
a4c9715ba321f1f7bc0285ddfbff33b56179945b2d75f25517edf62e40e63e11

SHA512
d157abe1369f02c0627d1483c039812441fe30992e6d0e69f906cf4ad054d9b95c76a4ec989e70f6962d0409c5bf5d499d302f66195234802937d0e6318795f5

Download Submit
C:\Users\Admin\Desktop\PopConvert.ADT.mm660g

Filesize
460KB

MD5
6f59da905afe3b9401fda8b7920ae850

SHA1
b9c5bf4389d9fa4eb8a46711fa300917cbb9d1bc

SHA256
072da01a3356d3d12324775aa6c0f225b4746db9567ffebe092751d745e9cc3e

SHA512
f80277313be6a74c27788338454c47bc7aac828803c3ac551d064c50ca143dd9aebd5323aeae6de4ae1ec94275b3b4b78808aa44ac0bf25599d26d886249f81d

Download Submit
C:\Users\Admin\Desktop\ProtectRevoke.zip.mm660g

Filesize
371KB

MD5
c1ad15b4876ea944be700c321a60f932

SHA1
c68b0b45bc15dc9ca09ea178e8d8e3c0a341578f

SHA256
b7938c10e8463928e12e6d645db6c8caefd9d2d1d3a6b22717a28ac81bd5bc9e

SHA512
8589560a341676045189894c362b03bfcddac36fa42929a89badfc3da0d61e13cbb935c84dc9792f8c0e397c9da73fcbbcf11ea6cdbb3dc0dfbaf667f36920f5

Download Submit
C:\Users\Admin\Desktop\ResizeRestore.rmi.mm660g

Filesize
640KB

MD5
cb2be0446bc72b378c86c8ed81300fc6

SHA1
9a2c3bdf378a89b7d8903e5e816cee30a2359cce

SHA256
c254ddf40b6999e5772b2b3dbcbd63333b8a7cafda178c686aeff66553a7fb76

SHA512
7dc13b9802f60b47e04cfe00c928af1f97e167034f2dbd264192985ee1daa5b69831be8fb1fa567ade1ff79bc80b0b9943868bafb5cd35acfea454c19a2f4bc5

Download Submit
C:\Users\Admin\Desktop\RestartUnregister.aif.mm660g

Filesize
843KB

MD5
4bb4da60c489c89ffd5574b50d58c4a5

SHA1
6808d3c6e3f906bc7cf5d7665105fdc4c2c4300c

SHA256
f5e947912729ac2c370b82e626233f6199448f9d2c4f76fedf627684562aece9

SHA512
5b0fd4068d7b6e140d18618bb7fed38ed21e6143cfe0d97b97f98e2202a4015c1b52e592af8bebc33c1a3283a687548f0afb0ba90a4a6e238f6b3f9d92a335a9

Download Submit
C:\Users\Admin\Desktop\SearchTest.mp4v.mm660g

Filesize
730KB

MD5
9cb1aaf3c4ca25c5ecc32c1eb4a430f0

SHA1
881e5ff8e7fb2f49343ac8a18ea8b88a15d7e284

SHA256
f46e8db1235f923442d51ede43feb31bcc1193ba7284e0da660ee02d870ead89

SHA512
9cf567bb9dc55a29b38a11ad48e1b09218021f69835b2431799c2cb495a1472d4e9189441ad114bb225082dda4d8212b6f170478cc1d6b4c37a168e56f7a6855

Download Submit
C:\Users\Admin\Desktop\SkipBackup.php.mm660g

Filesize
775KB

MD5
2b05f6f91c644a96c30364538efde4c5

SHA1
bfd87b19be0fb4a054894d10dcd038463acde653

SHA256
7295cbcc82a54319ec8f64b14719308a73dc2d1a581001cffc411d2b85cfd7cb

SHA512
3fb6f9aa95af79591f478f93b51cb4178a70d5fca757db669ab39b0766f793b9264876bf2a878af33293feb9fd75cb385031aa8760c8b072e609eaeeb546692f

Download Submit
C:\Users\Admin\Desktop\SwitchEnable.wmv.mm660g

Filesize
798KB

MD5
abf91013b3a2891d035013833f757f6b

SHA1
d8285f1e2d98d3539f5de81dbe51e3603594518d

SHA256
8e93d0265e69ee9b3ceb9b15286fecd2babab9d54680767c24354106eb18c493

SHA512
ccdeb3099d4b28165beecd6f75d16fef839cb5adff74e162544c1870fea3e4224bdd864d11539c19a976f5f3c147311cebf28161b1d148a55b9c29c8166f1f8b

Download Submit
C:\Users\Admin\Desktop\TraceSuspend.mov.mm660g

Filesize
550KB

MD5
2567b62168b866ccc95f9bfde8bf7b1e

SHA1
a706093251d56cc88b4ba5c4dc7122758ceac0fc

SHA256
3eb58d8e3ab49a87ab5991cc8c97123eba4e32edeadeec5de6aa4fdfff82a8fd

SHA512
2818495157326232b6e0df68c36ec97ffe140ae4d53eff7f6a96a012fbf4cde263536f686ee939b18522462e196b9e88f433b404b6590b17e19b7c8ca189b18e

Download Submit
C:\Users\Admin\Desktop\UninstallExport.aif.mm660g

Filesize
416KB

MD5
b4e662ccd4ef78a354985870b1709efe

SHA1
bb17fe3ac7ef0ad826f7e885c41b4fc67102c5fc

SHA256
9e604ae94bc2b0aea4c27d867450fb8207a1d7e98813464e421e4bb00fb57a55

SHA512
a67136ea23b1e37ef198647931a69673cfb6d76bcad3a5db61ad9637bee07bd2614cdd683b319f9d1ce9cf2c446615550173229dc06403f3032e748c4238b066

Download Submit
C:\Users\Admin\Desktop\UnlockRevoke.asp.mm660g

Filesize
595KB

MD5
775059c92713cbc2b0415036d25d915c

SHA1
998bcfcea92e16e4624f955054429e439b13fa93

SHA256
10268355597af2e3388c7cc9975dbd42089535b5ae7dd486ca6326bc04fbcbfb

SHA512
0e29a0a240af66c415f24375cddd1b02355e3e2ab46fa977d2387678b4faed913d27125c8cb6f337f07f3a9e9c75ace7358ff76c7a3e765456d98dc9a90d8e9e

Download Submit
C:\Users\Admin\Desktop\UnregisterSet.tmp.mm660g

Filesize
865KB

MD5
aa8207fa81339ff0c540edc8e48e10be

SHA1
9586b448ae8c2ff500691b78c70537093703330d

SHA256
9a8dc268142a703e89a7d3f2f1be89e257e2eb5c7e13caed7fa3ef541ca0cb7a

SHA512
d148567d249ca558dd71016e2a956027a8082708923da84c73a30744c32425d9c845e0d89164ce4b2e99714734fe7dbb3c5b48ea5a86a18ac52200597eede7ef

Download Submit
C:\Users\Admin\Desktop\UpdateExit.crw.mm660g

Filesize
393KB

MD5
27f185230e6bc0da666c52d80d476814

SHA1
b83ef6bd9483b46ef2c00c14366c1dffdc247492

SHA256
83a95dcebf879d85e6b78b360db7ca7553613f5e0c339d2432945afdbccb1f67

SHA512
4020f154f71bf0dda69ee392bd384fbc3e16b14ab44db7c5eeb37e0b123cce6233d083db61a291a45c392ec11490960be5dde69873966c3b55e9fb0410538ac6

Download Submit
C:\Users\Admin\Desktop\UseSync.gif.mm660g

Filesize
326KB

MD5
67b83a265cccc17e6018c9d6bd3aef95

SHA1
675531b9468c46e0e50b163659e070020b2ab07b

SHA256
9bb5a48a22eaecfb6f422cd49a11f14358b6b9531b5691bc5e745afbed653abc

SHA512
f0b4d1014ff98264ff735ea718d36e65c928aef8000611a35be1b0a2d653604ea90cccd8650723b241a72eeef2b8e163dace4694f0c4e43a16dbc5eef0487b70

Download Submit
C:\Users\Public\Desktop\mm660g-readme.txt

Filesize
6KB

MD5
a39f021abd13972613b14b8f0011c8e6

SHA1
85c5f4c79ce4a496b8d1d6bbc8f37738bb586a4c

SHA256
fe7efa1d7a316b90a71362662ae6275d16310b25c577423acd12bc254f0cbaf7

SHA512
9a76c685cdf8bb7bb92b2256d6514a464283ec8732da61eb4f92945bfa4ad358e87a5590bf87c07d71d52e86236b9cb1e62a5c73501499849cb5b51cde4a9ce2

Download Submit
memory/5112-0-0x00007FFCB8293000-0x00007FFCB8295000-memory.dmp

Filesize
8KB

Download
memory/5112-15-0x00007FFCB8290000-0x00007FFCB8D52000-memory.dmp

Filesize
10.8MB

Download
memory/5112-12-0x00007FFCB8290000-0x00007FFCB8D52000-memory.dmp

Filesize
10.8MB

Download
memory/5112-11-0x00007FFCB8290000-0x00007FFCB8D52000-memory.dmp

Filesize
10.8MB

Download
memory/5112-10-0x00007FFCB8290000-0x00007FFCB8D52000-memory.dmp

Filesize
10.8MB

Download
memory/5112-1-0x000002551C7B0000-0x000002551C7D2000-memory.dmp

Filesize
136KB

Download