Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 04:43
Static task
static1
Behavioral task
behavioral1
Sample
2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe
-
Size
257KB
-
MD5
2d6721f92f8dd73cdb3ee1d54f136b83
-
SHA1
14d0e5969fe842aee2022d5fccfda767d32da7b9
-
SHA256
7cd86f32c825e64820ef292b9d3ef6f47a9712f21930d7c920adfb125d47490f
-
SHA512
f2286e8cb6630cdb2956849fcf30518171be31d0d2b212827ac637375f176fd14f491c91a37e4fe27dc93bcf2e31e427812c99c28ce08ba6ebb1ff872492dc84
-
SSDEEP
6144:es1JoqbGwDAE5XOhkZJ8etJG4pNtqjgpchxCGzo:h1JFFXJ8yJGCfmgmhxd
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___BXXYHA5_.hta
cerber
Extracted
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___XZDOG_.txt
http://xpcx6erilkjced3j.onion/4264-0865-660F-0099-3492
http://xpcx6erilkjced3j.1cgbcv.top/4264-0865-660F-0099-3492
http://xpcx6erilkjced3j.16hwwh.top/4264-0865-660F-0099-3492
http://xpcx6erilkjced3j.1fnhyq.top/4264-0865-660F-0099-3492
http://xpcx6erilkjced3j.onion.cab/4264-0865-660F-0099-3492
http://xpcx6erilkjced3j.onion.to/4264-0865-660F-0099-3492
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (1100) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 1400 netsh.exe 2480 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe -
Drops startup file 1 IoCs
Processes:
2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe -
Drops file in System32 directory 38 IoCs
Processes:
2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp977D.bmp" 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe -
Drops file in Program Files directory 20 IoCs
Processes:
2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\program files (x86)\steam 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\ 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\bitcoin 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files\ 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\thunderbird 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\the bat! 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\ 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2460 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 4360 NOTEPAD.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 2556 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2556 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe Token: SeDebugPrivilege 2460 taskkill.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.execmd.exedescription pid process target process PID 2556 wrote to memory of 2480 2556 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe netsh.exe PID 2556 wrote to memory of 2480 2556 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe netsh.exe PID 2556 wrote to memory of 2480 2556 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe netsh.exe PID 2556 wrote to memory of 1400 2556 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe netsh.exe PID 2556 wrote to memory of 1400 2556 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe netsh.exe PID 2556 wrote to memory of 1400 2556 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe netsh.exe PID 2556 wrote to memory of 3640 2556 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe mshta.exe PID 2556 wrote to memory of 3640 2556 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe mshta.exe PID 2556 wrote to memory of 3640 2556 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe mshta.exe PID 2556 wrote to memory of 4360 2556 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe NOTEPAD.EXE PID 2556 wrote to memory of 4360 2556 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe NOTEPAD.EXE PID 2556 wrote to memory of 4360 2556 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe NOTEPAD.EXE PID 2556 wrote to memory of 5032 2556 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe cmd.exe PID 2556 wrote to memory of 5032 2556 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe cmd.exe PID 2556 wrote to memory of 5032 2556 2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe cmd.exe PID 5032 wrote to memory of 2460 5032 cmd.exe taskkill.exe PID 5032 wrote to memory of 2460 5032 cmd.exe taskkill.exe PID 5032 wrote to memory of 2460 5032 cmd.exe taskkill.exe PID 5032 wrote to memory of 4840 5032 cmd.exe PING.EXE PID 5032 wrote to memory of 4840 5032 cmd.exe PING.EXE PID 5032 wrote to memory of 4840 5032 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___ENI86A_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___XBGJFD6_.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "2d6721f92f8dd73cdb3ee1d54f136b83_JaffaCakes118.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___XZDOG_.txtFilesize
1KB
MD5e2f035ac981d75fef6427fd1fa76ca82
SHA178ba8af8f083fdfe4c5cb569c1daf1b6eac7ce25
SHA2562d992ad6d89d42dcf1d2f17c9f7b0b70fb3be99461a26c361f97a9182f509850
SHA5121072cb18e2ea357c29f6802f2a3368189c2bf580adf2025b0234a83468339ef73bb591d4fdc051b21c55cb1370ff91aa6dc5ecf2714602e049c5fd4400b3c6b6
-
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___BXXYHA5_.htaFilesize
75KB
MD577d3051cb54c2b6dbb10503d803352a5
SHA1bca88282311aa6d62d962f8bb07cee7ba58303a6
SHA256da1c57cba39afc779780e3a47783ec4773718a017c8dd22524eb0a6e98b9670b
SHA51257f0d15da34069ee85052fc89c6c9c4d56f9b40a96a0727b59688f2de69d88c34b948959af357f85c095ab1f9f8e808fe9a918d8eca4e8de36a8248b1f57a201
-
memory/2556-0-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2556-1-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2556-2-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2556-4-0x00000000005B0000-0x00000000005B1000-memory.dmpFilesize
4KB
-
memory/2556-3-0x00000000005A0000-0x00000000005A1000-memory.dmpFilesize
4KB
-
memory/2556-5-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2556-8-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2556-420-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB