Analysis
-
max time kernel
118s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 04:43
Static task
static1
Behavioral task
behavioral1
Sample
2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe
-
Size
257KB
-
MD5
2d6721f92f8dd73cdb3ee1d54f136b83
-
SHA1
14d0e5969fe842aee2022d5fccfda767d32da7b9
-
SHA256
7cd86f32c825e64820ef292b9d3ef6f47a9712f21930d7c920adfb125d47490f
-
SHA512
f2286e8cb6630cdb2956849fcf30518171be31d0d2b212827ac637375f176fd14f491c91a37e4fe27dc93bcf2e31e427812c99c28ce08ba6ebb1ff872492dc84
-
SSDEEP
6144:es1JoqbGwDAE5XOhkZJ8etJG4pNtqjgpchxCGzo:h1JFFXJ8yJGCfmgmhxd
Malware Config
Extracted
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___UQ2HGB_.txt
http://xpcx6erilkjced3j.onion/2467-46F7-89D4-0099-3FAA
http://xpcx6erilkjced3j.1cgbcv.top/2467-46F7-89D4-0099-3FAA
http://xpcx6erilkjced3j.16hwwh.top/2467-46F7-89D4-0099-3FAA
http://xpcx6erilkjced3j.1fnhyq.top/2467-46F7-89D4-0099-3FAA
http://xpcx6erilkjced3j.onion.cab/2467-46F7-89D4-0099-3FAA
http://xpcx6erilkjced3j.onion.to/2467-46F7-89D4-0099-3FAA
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Blocklisted process makes network request 5 IoCs
Processes:
mshta.exeflow pid process 2181 2412 mshta.exe 2184 2412 mshta.exe 2186 2412 mshta.exe 2188 2412 mshta.exe 2190 2412 mshta.exe -
Contacts a large (1095) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 548 netsh.exe 2896 netsh.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 332 cmd.exe -
Drops file in System32 directory 38 IoCs
Processes:
2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp429C.bmp" 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe -
Drops file in Program Files directory 20 IoCs
Processes:
2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\program files (x86)\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\steam 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files\ 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\bitcoin 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\thunderbird 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\the bat! 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\ 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\ 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1484 taskkill.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 1820 NOTEPAD.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 2068 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe Token: SeDebugPrivilege 1484 taskkill.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.execmd.exedescription pid process target process PID 2068 wrote to memory of 548 2068 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe netsh.exe PID 2068 wrote to memory of 548 2068 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe netsh.exe PID 2068 wrote to memory of 548 2068 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe netsh.exe PID 2068 wrote to memory of 548 2068 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe netsh.exe PID 2068 wrote to memory of 2896 2068 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe netsh.exe PID 2068 wrote to memory of 2896 2068 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe netsh.exe PID 2068 wrote to memory of 2896 2068 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe netsh.exe PID 2068 wrote to memory of 2896 2068 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe netsh.exe PID 2068 wrote to memory of 2412 2068 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe mshta.exe PID 2068 wrote to memory of 2412 2068 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe mshta.exe PID 2068 wrote to memory of 2412 2068 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe mshta.exe PID 2068 wrote to memory of 2412 2068 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe mshta.exe PID 2068 wrote to memory of 1820 2068 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe NOTEPAD.EXE PID 2068 wrote to memory of 1820 2068 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe NOTEPAD.EXE PID 2068 wrote to memory of 1820 2068 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe NOTEPAD.EXE PID 2068 wrote to memory of 1820 2068 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe NOTEPAD.EXE PID 2068 wrote to memory of 332 2068 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe cmd.exe PID 2068 wrote to memory of 332 2068 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe cmd.exe PID 2068 wrote to memory of 332 2068 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe cmd.exe PID 2068 wrote to memory of 332 2068 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe cmd.exe PID 332 wrote to memory of 1484 332 cmd.exe taskkill.exe PID 332 wrote to memory of 1484 332 cmd.exe taskkill.exe PID 332 wrote to memory of 1484 332 cmd.exe taskkill.exe PID 332 wrote to memory of 1484 332 cmd.exe taskkill.exe PID 332 wrote to memory of 1428 332 cmd.exe PING.EXE PID 332 wrote to memory of 1428 332 cmd.exe PING.EXE PID 332 wrote to memory of 1428 332 cmd.exe PING.EXE PID 332 wrote to memory of 1428 332 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___EDM3XE_.hta"2⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___UQ2HGB_.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Cab61B2.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar61D4.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___EDM3XE_.htaFilesize
75KB
MD576ce835dac4a9e07410ed9fc15d24d59
SHA1078c00a07b98db635dc4f779b579affeec220de1
SHA2562729c4e7b511f21e350d16a22ececc97469f2a6959be4aa29a4df4fd71eac4d6
SHA5127627916c4918d4e9a3a99c5dff7fb2ad9dba9bf3a044d9d561fcedce962ebeeca753a96121e56642df370a8fa0f3ac7c1433ce9f9fd25d6e51d1e4fc63057ef4
-
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___UQ2HGB_.txtFilesize
1KB
MD54a30c3ea0c0f072c858d4f25bca25b6e
SHA1131b18d57c05243279b87416d3d1c6988790f3fd
SHA2564bd4d54d4b1fe757abeb85d7a0f043ed7d9f0036d303f5577b9d0f2f4736908e
SHA512784decb4e773917ed0224f76346a67c3debaf5d575f333846b43c8e0a7b770ea251027038d56fe4866b9c0feb2e5955a7f71577a0a71522de8381e313616483e
-
memory/2068-0-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2068-1-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2068-2-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2068-3-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2068-90-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2068-92-0x0000000003660000-0x0000000003670000-memory.dmpFilesize
64KB