Analysis
- max time kernel
139s - max time network
101s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
03/05/2024, 02:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
23 signatures
150 seconds
General
- Target 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe
- Size 560KB
- Sample240503-c5vwksfb97
- SHA256 05312d1c61a4c8ae14fa5a8649007a8e7e72d1e1c81e9d50bc955efac80a7ba9
- MD5 0f7c57b8647f802f7e37d0701dfd4b63
- SHA1 b92c05fdc3c7f2de9fe3e52469a33bbab565a916
- SHA512 1be6e95fdd75dc5f948d7a1052192fb509df0aa64ebcb0a535e77f6b02e4da2bae4c65c591cc5ec48601a06dd74cc6a65ef0fe66be3a7250e8b0ffc38e0e938d
- SSDEEP 12288:PwX2jAEPwoYZU2PRQWt2WOztDSu8tn1X8Nje1+esTCmi:PwXnEodjPRXTOzIu8TMNyw2mi
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Path
-
C:\Program Files\dotnet\Restore-My-Files.txt
-
lockbit
Ransom Note
- All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?A2232793F05765B5B0A1D32443FCEF79 | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?A2232793F05765B5B0A1D32443FCEF79 This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about
URLs
-
http://lockbit-decryptor.top/?A2232793F05765B5B0A1D32443FCEF79
-
http://lockbitks2tvnmwk.onion/?A2232793F05765B5B0A1D32443FCEF79
Extracted
Path
-
C:\Users\Admin\Desktop\LockBit-note.hta
Ransom Note
- Lock BIT Any attempts to restore your files with the thrid-party software will be fatal for your files! Restore you data posible only buying private key from us. There is only one way to get your files back: Through a standard browser Open link - http://lockbit-decryptor.top/?A2232793F05765B5B0A1D32443FCEF79 Follow the instructions on this page Through a recommended Download Tor Browser - https://www.torproject.org/ and install it. Open link in Tor Browser - http://lockbitks2tvnmwk.onion/?A2232793F05765B5B0A1D32443FCEF79 This link only works in Tor Browser! Follow the instructions on this page Lockbit-decryptor.com may be blocked. We recommend using a Tor browser to access the site Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our). Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. Tor Browser user manual https://tb-manual.torproject.org/about
URLs
-
http://lockbit-decryptor.top/?A2232793F05765B5B0A1D32443FCEF79
-
http://lockbitks2tvnmwk.onion/?A2232793F05765B5B0A1D32443FCEF79
Signatures
- Lockbit
Ransomware family with multiple variants released since late 2019.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2784 bcdedit.exe 2856 bcdedit.exe - Renames multiple (6396) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 3120 wbadmin.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XO1XADpO01 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe\"" 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\Users\\Admin\\Desktop\\LockBit-note.hta" 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\36DA.tmp.bmp" 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-256_contrast-white.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-256_altform-unplated.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\1.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.scale-125_contrast-black.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageStoreLogo.scale-200_contrast-black.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\osmux.x-none.msi.16.x-none.vreg.dat 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Light.scale-300.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\fr-FR.mail.config 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\ui-strings.js 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-125_contrast-high.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-16_contrast-white.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-400.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.winmd 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\SharedMemoryUWP.winmd 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.contrast-white_scale-200.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notetagsUI\index.html 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_9_Loud.m4a 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireWideTile.scale-125.jpg 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fi-fi\ui-strings.js 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hr-hr\Restore-My-Files.txt 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\SmallTile.scale-100_contrast-black.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square71x71\PaintSmallTile.scale-125.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Google.scale-300.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-64_altform-unplated.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_sk.json 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-80_altform-unplated_contrast-black.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsWideTile.contrast-black_scale-100.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-oob.xrm-ms 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\MedTile.scale-125.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-64.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sv-se\ui-strings.js 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\sv-se\ui-strings.js 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-press.svg 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sv-se\Restore-My-Files.txt 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\MedTile.scale-125.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreLargeTile.scale-100.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\StoreLogo.scale-100.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.vsto 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_altform-unplated_contrast-black.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-256_altform-unplated.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\reactxp-experimental-navigation\NavigationExperimental\assets\[email protected] 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-150_contrast-black.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48_altform-lightunplated.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\ui-strings.js 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-16_contrast-white.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-ma\Restore-My-Files.txt 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\css\main.css 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\SignInControl.xaml 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-200.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ja-jp\ui-strings.js 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-il\ui-strings.js 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\adc_logo.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-36_altform-lightunplated.png 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 5280 4312 WerFault.exe 121 - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe - Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2272 vssadmin.exe - Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\Desktop\WallpaperStyle = "2" 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\Desktop\TileWallpaper = "0" 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 5440 PING.EXE - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe - Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe Token: SeDebugPrivilege 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe Token: SeBackupPrivilege 5028 vssvc.exe Token: SeRestorePrivilege 5028 vssvc.exe Token: SeAuditPrivilege 5028 vssvc.exe Token: SeIncreaseQuotaPrivilege 3276 WMIC.exe Token: SeSecurityPrivilege 3276 WMIC.exe Token: SeTakeOwnershipPrivilege 3276 WMIC.exe Token: SeLoadDriverPrivilege 3276 WMIC.exe Token: SeSystemProfilePrivilege 3276 WMIC.exe Token: SeSystemtimePrivilege 3276 WMIC.exe Token: SeProfSingleProcessPrivilege 3276 WMIC.exe Token: SeIncBasePriorityPrivilege 3276 WMIC.exe Token: SeCreatePagefilePrivilege 3276 WMIC.exe Token: SeBackupPrivilege 3276 WMIC.exe Token: SeRestorePrivilege 3276 WMIC.exe Token: SeShutdownPrivilege 3276 WMIC.exe Token: SeDebugPrivilege 3276 WMIC.exe Token: SeSystemEnvironmentPrivilege 3276 WMIC.exe Token: SeRemoteShutdownPrivilege 3276 WMIC.exe Token: SeUndockPrivilege 3276 WMIC.exe Token: SeManageVolumePrivilege 3276 WMIC.exe Token: 33 3276 WMIC.exe Token: 34 3276 WMIC.exe Token: 35 3276 WMIC.exe Token: 36 3276 WMIC.exe Token: SeIncreaseQuotaPrivilege 3276 WMIC.exe Token: SeSecurityPrivilege 3276 WMIC.exe Token: SeTakeOwnershipPrivilege 3276 WMIC.exe Token: SeLoadDriverPrivilege 3276 WMIC.exe Token: SeSystemProfilePrivilege 3276 WMIC.exe Token: SeSystemtimePrivilege 3276 WMIC.exe Token: SeProfSingleProcessPrivilege 3276 WMIC.exe Token: SeIncBasePriorityPrivilege 3276 WMIC.exe Token: SeCreatePagefilePrivilege 3276 WMIC.exe Token: SeBackupPrivilege 3276 WMIC.exe Token: SeRestorePrivilege 3276 WMIC.exe Token: SeShutdownPrivilege 3276 WMIC.exe Token: SeDebugPrivilege 3276 WMIC.exe Token: SeSystemEnvironmentPrivilege 3276 WMIC.exe Token: SeRemoteShutdownPrivilege 3276 WMIC.exe Token: SeUndockPrivilege 3276 WMIC.exe Token: SeManageVolumePrivilege 3276 WMIC.exe Token: 33 3276 WMIC.exe Token: 34 3276 WMIC.exe Token: 35 3276 WMIC.exe Token: 36 3276 WMIC.exe Token: SeBackupPrivilege 4300 wbengine.exe Token: SeRestorePrivilege 4300 wbengine.exe Token: SeSecurityPrivilege 4300 wbengine.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4692 wrote to memory of 1976 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 94 PID 4692 wrote to memory of 1976 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 94 PID 1976 wrote to memory of 2272 1976 cmd.exe 96 PID 1976 wrote to memory of 2272 1976 cmd.exe 96 PID 1976 wrote to memory of 3276 1976 cmd.exe 99 PID 1976 wrote to memory of 3276 1976 cmd.exe 99 PID 1976 wrote to memory of 2784 1976 cmd.exe 102 PID 1976 wrote to memory of 2784 1976 cmd.exe 102 PID 1976 wrote to memory of 2856 1976 cmd.exe 104 PID 1976 wrote to memory of 2856 1976 cmd.exe 104 PID 1976 wrote to memory of 3120 1976 cmd.exe 105 PID 1976 wrote to memory of 3120 1976 cmd.exe 105 PID 4692 wrote to memory of 4312 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 121 PID 4692 wrote to memory of 4312 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 121 PID 4692 wrote to memory of 4312 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 121 PID 4692 wrote to memory of 652 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 123 PID 4692 wrote to memory of 652 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 123 PID 4692 wrote to memory of 652 4692 0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe 123 PID 652 wrote to memory of 5440 652 cmd.exe 126 PID 652 wrote to memory of 5440 652 cmd.exe 126 PID 652 wrote to memory of 5440 652 cmd.exe 126 PID 652 wrote to memory of 6008 652 cmd.exe 133 PID 652 wrote to memory of 6008 652 cmd.exe 133 PID 652 wrote to memory of 6008 652 cmd.exe 133 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2272
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3276
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2784
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2856
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:3120
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\LockBit-note.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:4312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 17843⤵
- Program crash
PID:5280
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe" & Del /f /q "C:\Users\Admin\AppData\Local\Temp\0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.7 -n 33⤵
- Runs ping.exe
PID:5440
-
-
C:\Windows\SysWOW64\fsutil.exefsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\0f7c57b8647f802f7e37d0701dfd4b63_JaffaCakes118.exe"3⤵PID:6008
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:3472
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:4044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4312 -ip 43121⤵PID:3324
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\dotnet\Restore-My-Files.txt
- Size 1KB
- SHA256 39a89bb110a47ae43450bd39ef2c2c8aaf4d1a75b907b5a72953266bb5f945eb
- MD5 1f4396a942712a3a4cc465240371a35b
- SHA1 d2016722f404452141b2512a15f96ef0e078a9f3
- SHA512 1c6f6319381b7076ea687b3aab230e628636dae736a7b589cc96c4c0243a5350ca89c3d7fce25521e6b1d6e39102509a87e8ee11d0802d4ca6ad599b2987ff8b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Desktop\LockBit-note.hta
- Size 17KB
- SHA256 f799fcc8fc733ddf8143ef7e4653464601defbb77ddc467d954b0257fb355a28
- MD5 6ccfc05e830cb8301a815e00331ec9ba
- SHA1 51bdac8314d39daa55c70732d50089ff63135713
- SHA512 83320c10240ce3a8625a7168cb8d089e564be27c6d4db6ad83feca3268bb416f52ff970ab4296c53305ecf0d9fd0969442dedfa54a3e3de784ce1c242cfabadd
- SSDEEP 384:rGBsO2tgP5D4CAzuTL5NDyJr/BNbNe2e/Ux3pI:692tgPyzuTL7+pbNe2+Ux5I
- MD5 SHA1 SHA512 SSDEEP