9b96179fdb2583c44dc0039d92e321ab3a44307ea045b7a98e3c245c0b2691c9

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
Size

907KB
MD5

1f034a17091b7512212a6d875967f38c
SHA1

aeb5dd8c9a0fc2d938469a463c7e67ea8a89fa09
SHA256

9b96179fdb2583c44dc0039d92e321ab3a44307ea045b7a98e3c245c0b2691c9
SHA512

90cc130115eb72cc37e3ac94d127af46e159f42424bc1117524962ea0014e89838c0dfa35e4098308d7964f76b9494990c4af4ef9861db5f259cb32f58552526
SSDEEP

24576:TEtl9mRda1cSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0NuJvl:oEs1hz

Score

10^/10

persistence ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2964	HelpMe.exe

Loads dropped DLL 2 IoCs

pid	Process
2932	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
2932	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\G:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\L:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\K:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\T:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\V:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\Y:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\O:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\X:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\Z:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\I:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\P:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\A:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\E:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\Q:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\R:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\S:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\U:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\W:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\H:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\J:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\M:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\N:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\B:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened for modification	C:\AUTORUN.INF	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2964	2932	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe	28
PID 2932 wrote to memory of 2964	2932	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe	28
PID 2932 wrote to memory of 2964	2932	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe	28
PID 2932 wrote to memory of 2964	2932	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.exe

Filesize
908KB

MD5
df38d538de9b1b1eeed4f69bed1eb2ff

SHA1
4e543dfcfcfbf653bbb138d82da3355cab870cb0

SHA256
8092eb557b41957c4d588d71f05bfb77c6af106ffe2837d38a4c4369383d60d8

SHA512
bec1da13a71c3d2e86e10ae63b0dd62bae4b6c13294f17d285f6e313898d76bc97560795977ad5a51a6894a2e90554f52711a1b810163dce81ffd70c4c34900e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
68feefcc821572a2732e3a375383740b

SHA1
131e38c035f2623635df9c302d9022b6ff241a58

SHA256
b87bfb5fd00022185a4ef0056205c094c5932f53fc6135fffa8bf4734becaf52

SHA512
787280faa5bdceee0d6151acc8b10a283262fc4413153635a13f23a64fde22c5be05e95e929f3703a50ab6ca0656e95e197c860918ad4fd87ea9fe736f9051c4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
9c4db21b2641fd290cef03d43f87248b

SHA1
05ff7773c53ae82179142f2c9acffea81402e58e

SHA256
dced3f2bb8f7fbf014eb3af28ba011f706e0c7bae57c738ad736d8b3c02be874

SHA512
25c9f413525d4e30aaee30f37d910d9913e4fe5060ccc0106ce853c3a4f40cc0316c7b098089fbfc5b337549fd4745d3e248699903597a6fbd0daf3bcaea2fcb

Download Submit
F:\AUTORUN.INF

Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
F:\AutoRun.exe

Filesize
907KB

MD5
1f034a17091b7512212a6d875967f38c

SHA1
aeb5dd8c9a0fc2d938469a463c7e67ea8a89fa09

SHA256
9b96179fdb2583c44dc0039d92e321ab3a44307ea045b7a98e3c245c0b2691c9

SHA512
90cc130115eb72cc37e3ac94d127af46e159f42424bc1117524962ea0014e89838c0dfa35e4098308d7964f76b9494990c4af4ef9861db5f259cb32f58552526

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
906KB

MD5
a15ff0c716a843450b42b8f28d432c1f

SHA1
ed0de660d049d9b419b7f8bd6fc0f7a8140c2c5d

SHA256
90d646054942eb8746c9762b7490d18b971d7e2478a64930ec14f4a86eb1de79

SHA512
27e75d7d7b62a4da875fb3b8c30c73f3c86fc1a19543a2c32bd9c1b47a0d17549e751ff1d1c647b7f2c2d7ab31a3ea2ee2af83edf372ad976a1bf46a906c886f

Download Submit
memory/2932-263-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2932-245-0x0000000002F20000-0x0000000002F97000-memory.dmp

Filesize
476KB

Download
memory/2932-373-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2932-4-0x0000000002F20000-0x0000000002F97000-memory.dmp

Filesize
476KB

Download
memory/2932-0-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2932-367-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2932-231-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2932-233-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2932-238-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2932-357-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2932-347-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2932-297-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2932-243-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2932-255-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2932-335-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2932-1-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2932-327-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2932-277-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2932-317-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2932-287-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2932-307-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2964-246-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2964-298-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2964-288-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2964-308-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2964-278-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2964-318-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2964-268-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2964-328-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2964-256-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2964-336-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2964-13-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2964-348-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2964-244-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2964-358-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2964-232-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2964-368-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2964-11-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads