Analysis
-
max time kernel
94s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 01:23
Static task
static1
Behavioral task
behavioral1
Sample
27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe
-
Size
463KB
-
MD5
27a1a9c435a7b0c6a6378df7650b40b6
-
SHA1
5f8d911d9de5657796249f58c0bbbbe53855965d
-
SHA256
e1e9fbb956e75509617c8b686615bf41970a42ea12003761fbd9250025423a5c
-
SHA512
03d0e0ced6cdab6b4d67c184084ade32a91b8f98a6c8e7d8be2a12b2b51a26c5bc8cbd4078b657cefc2e0a603b271ffc051c25b5c7e7af82b621ab800fa7c9b7
-
SSDEEP
6144:5UdWaUY7z6hzuaPOqUjHE6QsMsDWMP/Ibw8MfWTAxbg:5UdWa5z6hzuaPOqMxQsD1P/s1OWkW
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_READ_THI$_FILE_0K84_.txt
http://p27dokhpz2n7nvgr.onion/F8C2-7AED-5A5E-0099-33B4
http://p27dokhpz2n7nvgr.1j2ien.top/F8C2-7AED-5A5E-0099-33B4
http://p27dokhpz2n7nvgr.1nhkou.top/F8C2-7AED-5A5E-0099-33B4
http://p27dokhpz2n7nvgr.1a7wnt.top/F8C2-7AED-5A5E-0099-33B4
http://p27dokhpz2n7nvgr.1czh7o.top/F8C2-7AED-5A5E-0099-33B4
http://p27dokhpz2n7nvgr.1hpvzl.top/F8C2-7AED-5A5E-0099-33B4
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_READ_THI$_FILE_XL5K5EK6_.hta
cerber
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (1093) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 5012 netsh.exe 1244 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe -
Drops startup file 1 IoCs
Processes:
27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe -
Drops file in System32 directory 38 IoCs
Processes:
27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exedescription pid process target process PID 4924 set thread context of 1132 4924 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe -
Drops file in Program Files directory 20 IoCs
Processes:
27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\onenote 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\the bat! 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\thunderbird 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\office 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\powerpoint 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\word 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\ 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\excel 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\office 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\outlook 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\program files\ 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\bitcoin 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\word 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\steam 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\windows\ 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4428 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 1132 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 1132 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe Token: SeDebugPrivilege 4428 taskkill.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exepid process 4924 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe 4924 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exepid process 4924 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe 4924 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exepid process 4924 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.execmd.exedescription pid process target process PID 4924 wrote to memory of 1132 4924 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe PID 4924 wrote to memory of 1132 4924 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe PID 4924 wrote to memory of 1132 4924 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe PID 4924 wrote to memory of 1132 4924 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe PID 4924 wrote to memory of 1132 4924 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe PID 4924 wrote to memory of 1132 4924 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe PID 4924 wrote to memory of 1132 4924 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe PID 4924 wrote to memory of 1132 4924 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe PID 4924 wrote to memory of 1132 4924 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe PID 4924 wrote to memory of 1132 4924 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe PID 4924 wrote to memory of 1132 4924 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe PID 1132 wrote to memory of 5012 1132 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe netsh.exe PID 1132 wrote to memory of 5012 1132 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe netsh.exe PID 1132 wrote to memory of 5012 1132 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe netsh.exe PID 1132 wrote to memory of 1244 1132 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe netsh.exe PID 1132 wrote to memory of 1244 1132 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe netsh.exe PID 1132 wrote to memory of 1244 1132 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe netsh.exe PID 1132 wrote to memory of 2712 1132 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe mshta.exe PID 1132 wrote to memory of 2712 1132 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe mshta.exe PID 1132 wrote to memory of 2712 1132 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe mshta.exe PID 1132 wrote to memory of 4140 1132 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe NOTEPAD.EXE PID 1132 wrote to memory of 4140 1132 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe NOTEPAD.EXE PID 1132 wrote to memory of 4140 1132 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe NOTEPAD.EXE PID 1132 wrote to memory of 844 1132 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe cmd.exe PID 1132 wrote to memory of 844 1132 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe cmd.exe PID 1132 wrote to memory of 844 1132 27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe cmd.exe PID 844 wrote to memory of 4428 844 cmd.exe taskkill.exe PID 844 wrote to memory of 4428 844 cmd.exe taskkill.exe PID 844 wrote to memory of 4428 844 cmd.exe taskkill.exe PID 844 wrote to memory of 3512 844 cmd.exe PING.EXE PID 844 wrote to memory of 3512 844 cmd.exe PING.EXE PID 844 wrote to memory of 3512 844 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_READ_THI$_FILE_2GX5NHP6_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_READ_THI$_FILE_ZDQB_.txt3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "27a1a9c435a7b0c6a6378df7650b40b6_JaffaCakes118.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_READ_THI$_FILE_0K84_.txtFilesize
1KB
MD5ed654299dd175a2524b318e368bef57a
SHA184ed0e00c21a444f7926387d6257b58a48825033
SHA256a110857e0e6d4604a9d417cd777528522de377b84c32fd032e543d3144e0d6b2
SHA5128e720032033a5adf142002dea3b66135c28e7d4f34066802ba1874a7118cb44cf09ee175dfbcaecadad9d64af952b0adb1b03ed18935ca5858fb2b787465a22b
-
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_READ_THI$_FILE_XL5K5EK6_.htaFilesize
75KB
MD54b5c26b7f4ecf544c4b80b0e3595a2f4
SHA1a7eaf6bfb40838b1105b83017591307d7dc8e28e
SHA256135a09d34100a3b601e0a061a63a9ec358465f24c1feefc556e515367682121c
SHA512c421be142b3e32c317ba947214024075c4952e76e4656b6b908c260ff4f620215245c3413bac201c994b1b0f2df498f7f68c487a7d85f4790d6658790ebf5df9
-
memory/1132-2-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1132-4-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1132-5-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1132-6-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1132-7-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1132-10-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1132-14-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1132-384-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1132-402-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1132-409-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB