Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 11:34
Behavioral task
behavioral1
Sample
128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe
-
Size
158KB
-
MD5
128d82b29a73c5ca4cbab8d745720e80
-
SHA1
6c57602a0896cf725552aa8334a4faa53bc8e9ce
-
SHA256
67dfdd2f62f976b1c265dfe2adb349163ec39e3087948120b1584b6cf71ac2c9
-
SHA512
688158bc844459cc1f5ff5b0ee0ffb25014b11501e520c65860f36fb94e8b4457c940a7bb12383569e1664fc56c2b0a0fdea85ae88d71ab7acd894bdaafa1af5
-
SSDEEP
3072:gnItsOCo4mHLbi4eTMlwDCnutNWXZXXWFeQU:WIyOCvUbnWJt8pnWFe
Malware Config
Extracted
C:\Users\Admin\72552l23-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F2177E53D1E60A50
http://decryptor.top/F2177E53D1E60A50
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (199) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\V: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\S: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\U: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\E: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\P: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\Q: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\D: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\B: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\M: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\J: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\K: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\X: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\G: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\H: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\Z: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\F: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\A: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\N: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\O: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\T: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\W: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\Y: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\I: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened (read-only) \??\L: 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1o3hrwiia.bmp" 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_6.1.7600.16385_none_df4bbe8e10903104_8514sysr.fon_d6a097a2 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-t..rk-msimtf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_40be65277919565f_msimtf.dll.mui_e40b8b25 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_6.1.7600.16385_es-es_f36785427fe61495_sccls.dll.mui_f104be47 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-w..eservices.resources_31bf3856ad364e35_6.1.7601.17514_es-es_db2a5b2e188f18fc_sti.dll.mui_00a4f15b 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-gdi-painting_31bf3856ad364e35_6.1.7600.16385_none_d360c9c235bd1868_mf3216.dll_8fba6fd3 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-gdi-painting_31bf3856ad364e35_6.1.7600.16385_none_d360c9c235bd1868_msimg32.dll_2a4e0bd8 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_sr-..-cs_73d552d28e4165e3_comdlg32.dll.mui_ac8e62f4 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80.manifest 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-winsock-core.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4a6084e58b10a995_afd.sys.mui_ff192075 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-t..stringime.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2c0f48b59617c262.manifest 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-activexcompat_31bf3856ad364e35_8.0.7601.17514_none_6f29eb5391300db2.manifest 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-lsa.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_116d0e2f6d925d2e.manifest 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-m..ents-mdac.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ba650fd806606d37_cliconf.chm_12e2bd62 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_6.1.7600.16385_it-it_bd67490bab84b358_winmgmtr.dll.mui_741bfb68 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-p..ndprintui.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_754bce83add5924d_puiobj.dll.mui_b9c0c4d6 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasbase.resources_31bf3856ad364e35_6.1.7600.16385_de-de_111bacf3e074578c_netrass.inf_loc_17636d00 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasserver.resources_31bf3856ad364e35_6.1.7600.16385_it-it_63e0cf16a0174ffc.manifest 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6b83d7cd687b9918_oleres.dll.mui_ff00d4cb 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-cryptui-dll.resources_31bf3856ad364e35_6.1.7601.17514_de-de_b8975dacc61ac776.manifest 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_pl-pl_61e865cf65610452_comctl32.dll.mui_0da4e682 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-wininit.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d02acaa3e17e4bae.manifest 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_ko-kr_bf37bd127de6c85d_comdlg32.dll.mui_ac8e62f4 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-shell32.resources_31bf3856ad364e35_6.1.7601.17514_de-de_b2c05a8c483fb13a_shell32.dll.mui_19f538b4 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-x..nrollment.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_efdfcb5915f876ae.manifest 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-w..eservices.resources_31bf3856ad364e35_6.1.7600.16385_en-us_354c8605d3d714f3.manifest 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-truetype-kokila_31bf3856ad364e35_6.1.7601.17514_none_4d4bb384a78cecc3_kokilabi.ttf_822b42fe 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_it-it_31f2bea73f8ae0c2_msimsg.dll.mui_72e8994f 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-shlwapi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_53a5cec4855ca29e_shlwapi.dll.mui_a6436c6f 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_6.1.7600.16385_de-de_9e8c88ba3cdfd040_drvinst.exe.mui_e88f4c73 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-u..em-config.resources_31bf3856ad364e35_6.1.7600.16385_en-us_919783112bf8b64b_mdminst.dll.mui_19a87063 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-webservices.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3d5dbdfc94d982d6_webservices.dll.mui_eecc809d 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-lua.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4a7fbba98600197c_consent.exe.mui_2eb3b9db 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-cryptnet-dll_31bf3856ad364e35_6.1.7600.16385_none_16ef973d5d294eb5_cryptnet.dll_e44c577b 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_6.1.7600.16385_none_db04d3f548508fd9_8514fix.fon_dc96978e 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-cryptbase_31bf3856ad364e35_6.1.7600.16385_none_c15ac71fc7aafddc_cryptbase.dll_83e36053 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-m..ents-mdac.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2dba46ae3c357fb2.manifest 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-tunnel_31bf3856ad364e35_6.1.7601.17514_none_01900e7d9b53e4bb_tunnel.sys_90392579 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_7.5.7601.17514_en-us_74a88136fae6c08c_wuaueng.dll.mui_297f975d 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-bcrypt-primitives-dll_31bf3856ad364e35_6.1.7600.16385_none_1207cf88785de24d.manifest 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-msvcp60_31bf3856ad364e35_6.1.7600.16385_none_4277eab412b31810.manifest 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_79b34814f7ded8e5_bootmgr.efi.mui_be5d0075 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_6.1.7600.16385_none_db04d3f548508fd9_85f1257.fon_77baa7cb 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.17932_none_fc20fc2ea15dceba.manifest 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_6.1.7601.17514_none_e5a6ee46b2ff6559_bootmgr.efi_da0f14a8 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-truetype-shruti_31bf3856ad364e35_6.1.7600.16385_none_295c980d6b8c1975_shruti.ttf_c4dbca5d 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-kernelbase_31bf3856ad364e35_6.1.7601.17932_none_8510e4eecb4594ab_kernelbase.dll_7f3dc5f6 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-msasn1_31bf3856ad364e35_6.1.7601.17514_none_c9617fb603a37c36_msasn1.dll_e56dbc57 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-acproxy_31bf3856ad364e35_6.1.7600.16385_none_520444733f7b8add.manifest 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-t..-platform-libraries_31bf3856ad364e35_6.1.7601.17514_none_ec7854d0f990441d_iphlpapi.dll_7ae3573f 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-profsvc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f1814dbfdb6aeac1_userprofilewmiprovider.mfl_b1cb99f9 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-vssapi.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4150642bed0c6eef.manifest 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-htmlhelp-infotech_31bf3856ad364e35_6.1.7601.17514_none_f8ab56ff71fc562a.manifest 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-winsock-helper-tcpip_31bf3856ad364e35_6.1.7600.16385_none_cb895be592db1acb.manifest 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-e..orerframe.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_de3dea60c999aa74_explorerframe.dll.mui_074caeb5 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-fileinfominifilter_31bf3856ad364e35_6.1.7600.16385_none_32a9eccc4afed9ba.manifest 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-sens-client_31bf3856ad364e35_6.1.7600.16385_none_011904ea1e74d196_sensapi.dll_9e623aad 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-bootvid_31bf3856ad364e35_6.1.7600.16385_none_946e6d209fe56342_bootvid.dll_c188118d 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..owmanager.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_34be759892c77101_udwm.dll.mui_43c5183a 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-m..ditevtlog.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_587d687d6686757b_adtschema.dll.mui_208d0981 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-hbaapi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_32f774aeb8785762.manifest 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-f..temutilitylibraries_31bf3856ad364e35_6.1.7601.17514_none_47bc5d47064ce3d9_ulib.dll_d1653396 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-duser_31bf3856ad364e35_6.1.7600.16385_none_5a4b046c5dce176a_duser.dll_a2bd2fa9 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-usermodensi.resources_31bf3856ad364e35_6.1.7600.16385_es-es_3bf2c930414db993.manifest 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-bootvid_31bf3856ad364e35_6.1.7600.16385_none_946e6d209fe56342.manifest 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3068 vssadmin.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1244 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe 1244 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe 1244 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe 1244 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe 1244 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe 1244 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe 1244 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe 1244 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe 1244 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe 1244 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe 1244 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe 1244 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe 1244 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe 1244 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe 1244 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe 1244 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe 1244 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe 1244 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2616 vssvc.exe Token: SeRestorePrivilege 2616 vssvc.exe Token: SeAuditPrivilege 2616 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1244 wrote to memory of 2140 1244 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe 28 PID 1244 wrote to memory of 2140 1244 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe 28 PID 1244 wrote to memory of 2140 1244 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe 28 PID 1244 wrote to memory of 2140 1244 128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe 28 PID 2140 wrote to memory of 3068 2140 cmd.exe 30 PID 2140 wrote to memory of 3068 2140 cmd.exe 30 PID 2140 wrote to memory of 3068 2140 cmd.exe 30 PID 2140 wrote to memory of 3068 2140 cmd.exe 30 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\128d82b29a73c5ca4cbab8d745720e80_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:3068
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2616
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5e9319822ad4e2fa97293f743590e2402
SHA15b73de832220c675d52eb7adaa10457dde33da11
SHA25620b82844d4769c3f1fb14e498e8018e31f9bb27b0a173041203bf5f7f5800f82
SHA51232aa42038f624141d8b56d2f7619c2162b0d61a3bab959380c2cac8f07b8fcd0d15d147ffd0b0111349a11a08aa5ec7f7b7fd3869c9a660987e87de9267c34da
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b13ab943bf1735fcfe994a2bf71b123a
SHA19ecf2c12151c5fcb071a8f61d05646e9849d9336
SHA2560f3b3663e2ef473755c0105b67b14c86c8d6140e0eb6c0a37c3eaa9482546fe1
SHA5126bbac1ed82b6d37fd3f74f51759e663533d268a2357ab2bd9de43f9428b4d070ac85256fa847ad2c80f0b38dac864871642a637a65f0bb1176b1d7e524e9b047
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a