Analysis
-
max time kernel
121s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 08:45
Behavioral task
behavioral1
Sample
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe
-
Size
345KB
-
MD5
2e4a5ee417ff54e3bbaaddd2bc5253ae
-
SHA1
803626cc5e2550669ef109a467a41661fe006e03
-
SHA256
5cdc64c997b2fd0086756d61eb82c329f8d35d6d2d23d74e97ce219297454812
-
SHA512
9e6281d5d76786aa785522b07e484055f25bbc27d06b40f25c073c4b6cb9359432f64a89d3b644ab4999a78808709f2aa306fb17d10259a25d3d506eebb615a2
-
SSDEEP
6144:j6cWd7WQ5IHkEGPcnoSFCAXewOVYsFpDSXknKk7ihw2FBTO6XuvJ91Z8cn:mcXRnoSFC0rOisrSXknKkmO27DyJ91t
Malware Config
Extracted
C:\Users\Admin\Desktop\_READ_THI$_FILE_3GCP2P_.txt
http://p27dokhpz2n7nvgr.onion/AE43-AD27-E31C-0446-9856
http://p27dokhpz2n7nvgr.1a7wnt.top/AE43-AD27-E31C-0446-9856
http://p27dokhpz2n7nvgr.1czh7o.top/AE43-AD27-E31C-0446-9856
http://p27dokhpz2n7nvgr.1hpvzl.top/AE43-AD27-E31C-0446-9856
http://p27dokhpz2n7nvgr.1pglcs.top/AE43-AD27-E31C-0446-9856
http://p27dokhpz2n7nvgr.1cewld.top/AE43-AD27-E31C-0446-9856
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Blocklisted process makes network request 5 IoCs
Processes:
mshta.exeflow pid process 2180 2240 mshta.exe 2184 2240 mshta.exe 2186 2240 mshta.exe 2188 2240 mshta.exe 2190 2240 mshta.exe -
Contacts a large (1095) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 3012 netsh.exe 2592 netsh.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2112 cmd.exe -
Processes:
resource yara_rule behavioral1/memory/2360-0-0x00000000010D0000-0x0000000001130000-memory.dmp upx behavioral1/memory/1312-5-0x00000000010D0000-0x0000000001130000-memory.dmp upx behavioral1/memory/2360-8-0x00000000010D0000-0x0000000001130000-memory.dmp upx -
Drops file in System32 directory 38 IoCs
Processes:
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp3B3C.bmp" 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exedescription pid process target process PID 2360 set thread context of 1312 2360 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe -
Drops file in Program Files directory 20 IoCs
Processes:
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\program files (x86)\microsoft\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\steam 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\ 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\the bat! 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files\ 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\bitcoin 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\thunderbird 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1256 taskkill.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 1312 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe Token: SeDebugPrivilege 1256 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
DllHost.exepid process 1808 DllHost.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.execmd.exedescription pid process target process PID 2360 wrote to memory of 1312 2360 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe PID 2360 wrote to memory of 1312 2360 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe PID 2360 wrote to memory of 1312 2360 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe PID 2360 wrote to memory of 1312 2360 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe PID 2360 wrote to memory of 1312 2360 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe PID 2360 wrote to memory of 1312 2360 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe PID 2360 wrote to memory of 1312 2360 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe PID 2360 wrote to memory of 1312 2360 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe PID 2360 wrote to memory of 1312 2360 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe PID 2360 wrote to memory of 1312 2360 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe PID 2360 wrote to memory of 1312 2360 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe PID 1312 wrote to memory of 3012 1312 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe netsh.exe PID 1312 wrote to memory of 3012 1312 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe netsh.exe PID 1312 wrote to memory of 3012 1312 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe netsh.exe PID 1312 wrote to memory of 3012 1312 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe netsh.exe PID 1312 wrote to memory of 2592 1312 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe netsh.exe PID 1312 wrote to memory of 2592 1312 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe netsh.exe PID 1312 wrote to memory of 2592 1312 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe netsh.exe PID 1312 wrote to memory of 2592 1312 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe netsh.exe PID 1312 wrote to memory of 2240 1312 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe mshta.exe PID 1312 wrote to memory of 2240 1312 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe mshta.exe PID 1312 wrote to memory of 2240 1312 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe mshta.exe PID 1312 wrote to memory of 2240 1312 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe mshta.exe PID 1312 wrote to memory of 2176 1312 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe NOTEPAD.EXE PID 1312 wrote to memory of 2176 1312 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe NOTEPAD.EXE PID 1312 wrote to memory of 2176 1312 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe NOTEPAD.EXE PID 1312 wrote to memory of 2176 1312 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe NOTEPAD.EXE PID 1312 wrote to memory of 2112 1312 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe cmd.exe PID 1312 wrote to memory of 2112 1312 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe cmd.exe PID 1312 wrote to memory of 2112 1312 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe cmd.exe PID 1312 wrote to memory of 2112 1312 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe cmd.exe PID 2112 wrote to memory of 1256 2112 cmd.exe taskkill.exe PID 2112 wrote to memory of 1256 2112 cmd.exe taskkill.exe PID 2112 wrote to memory of 1256 2112 cmd.exe taskkill.exe PID 2112 wrote to memory of 1256 2112 cmd.exe taskkill.exe PID 2112 wrote to memory of 1380 2112 cmd.exe PING.EXE PID 2112 wrote to memory of 1380 2112 cmd.exe PING.EXE PID 2112 wrote to memory of 1380 2112 cmd.exe PING.EXE PID 2112 wrote to memory of 1380 2112 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe"2⤵
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_READ_THI$_FILE_F26TA67X_.hta"3⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_READ_THI$_FILE_3GCP2P_.txt3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar599C.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\Desktop\_READ_THI$_FILE_3GCP2P_.txtFilesize
1KB
MD5fb35f03ce1d2ffd8fd6e8da441e045d4
SHA1336918e018d68a0e4dc5efc9ba147bd2160082f0
SHA2562196c6c9f5d281e6141eb6d058c9532ce249578974791b31308ef91332a11db3
SHA51267d1806c127cde035d2a57871e35bd2d49c78d7e48bf019b46de8cdbc56836551894ad8874021692954dc6c52f9b18829b26c319d9b58d3f2d443c890cbbeb22
-
C:\Users\Admin\Desktop\_READ_THI$_FILE_ARSIGJ_.jpegFilesize
150KB
MD5a010294b84beb114200ea2fc42d6ade3
SHA1678cd0089967e17823702fbd79326c24684a2122
SHA256243e7ce289d0bb0dc0b69a4a6e45622caf41eec0bea1a55374fd25e54ea40c78
SHA512f9ffc1ffa258a1e0e6ce9a8e9ef7b68ef2ba3009943e4af27b403368808ea234652b4901e8a43966114035eacdbc232972df00888ea3f41d9e4b97811b4e201a
-
C:\Users\Admin\Desktop\_READ_THI$_FILE_F26TA67X_.htaFilesize
75KB
MD5f40a9fe62a201d5d0ea6c04888ca991c
SHA1317b6e5859bd9df9bd7a6cb46831c8412cea769f
SHA256d64aea9578a36191010be0a009b01118924671bf0222666a6562a877e9afa2a7
SHA512b78c9eb16ee9815948bbb99acdb372cfd227edb1525629fad13fd68f25f4ac67b9557408cd3183e19513ac66c13b0b44b0232cd827460cb6369c7dfb0a62661b
-
memory/1312-76-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1312-6-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1312-9-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1312-12-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1312-16-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1312-318-0x00000000005B0000-0x00000000005C0000-memory.dmpFilesize
64KB
-
memory/1312-96-0x00000000005B0000-0x00000000005C0000-memory.dmpFilesize
64KB
-
memory/1312-317-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1312-1-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1312-5-0x00000000010D0000-0x0000000001130000-memory.dmpFilesize
384KB
-
memory/1312-101-0x00000000005E0000-0x00000000005E2000-memory.dmpFilesize
8KB
-
memory/1312-4-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1808-102-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2360-3-0x0000000000160000-0x00000000001C0000-memory.dmpFilesize
384KB
-
memory/2360-8-0x00000000010D0000-0x0000000001130000-memory.dmpFilesize
384KB
-
memory/2360-0-0x00000000010D0000-0x0000000001130000-memory.dmpFilesize
384KB