Analysis
-
max time kernel
136s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 08:45
Behavioral task
behavioral1
Sample
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe
-
Size
345KB
-
MD5
2e4a5ee417ff54e3bbaaddd2bc5253ae
-
SHA1
803626cc5e2550669ef109a467a41661fe006e03
-
SHA256
5cdc64c997b2fd0086756d61eb82c329f8d35d6d2d23d74e97ce219297454812
-
SHA512
9e6281d5d76786aa785522b07e484055f25bbc27d06b40f25c073c4b6cb9359432f64a89d3b644ab4999a78808709f2aa306fb17d10259a25d3d506eebb615a2
-
SSDEEP
6144:j6cWd7WQ5IHkEGPcnoSFCAXewOVYsFpDSXknKk7ihw2FBTO6XuvJ91Z8cn:mcXRnoSFC0rOisrSXknKkmO27DyJ91t
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_READ_THI$_FILE_GZGO0GV_.txt
http://p27dokhpz2n7nvgr.onion/55DF-F87F-E888-0446-94A1
http://p27dokhpz2n7nvgr.1a7wnt.top/55DF-F87F-E888-0446-94A1
http://p27dokhpz2n7nvgr.1czh7o.top/55DF-F87F-E888-0446-94A1
http://p27dokhpz2n7nvgr.1hpvzl.top/55DF-F87F-E888-0446-94A1
http://p27dokhpz2n7nvgr.1pglcs.top/55DF-F87F-E888-0446-94A1
http://p27dokhpz2n7nvgr.1cewld.top/55DF-F87F-E888-0446-94A1
Extracted
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_READ_THI$_FILE_W2FURZ_.hta
cerber
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (1104) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 3332 netsh.exe 4384 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe -
Drops startup file 1 IoCs
Processes:
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral2/memory/1332-0-0x0000000000070000-0x00000000000D0000-memory.dmp upx behavioral2/memory/1332-5-0x0000000000070000-0x00000000000D0000-memory.dmp upx -
Drops file in System32 directory 38 IoCs
Processes:
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp7BF6.bmp" 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exedescription pid process target process PID 1332 set thread context of 396 1332 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe -
Drops file in Program Files directory 20 IoCs
Processes:
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\program files (x86)\microsoft\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files\ 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\bitcoin 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\steam 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\the bat! 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\thunderbird 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\ 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\ 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3652 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exeAUDIODG.EXEtaskkill.exedescription pid process Token: SeShutdownPrivilege 396 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 396 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe Token: 33 4180 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4180 AUDIODG.EXE Token: SeDebugPrivilege 3652 taskkill.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.execmd.exedescription pid process target process PID 1332 wrote to memory of 396 1332 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe PID 1332 wrote to memory of 396 1332 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe PID 1332 wrote to memory of 396 1332 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe PID 1332 wrote to memory of 396 1332 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe PID 1332 wrote to memory of 396 1332 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe PID 1332 wrote to memory of 396 1332 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe PID 1332 wrote to memory of 396 1332 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe PID 1332 wrote to memory of 396 1332 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe PID 1332 wrote to memory of 396 1332 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe PID 1332 wrote to memory of 396 1332 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe PID 396 wrote to memory of 3332 396 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe netsh.exe PID 396 wrote to memory of 3332 396 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe netsh.exe PID 396 wrote to memory of 3332 396 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe netsh.exe PID 396 wrote to memory of 4384 396 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe netsh.exe PID 396 wrote to memory of 4384 396 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe netsh.exe PID 396 wrote to memory of 4384 396 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe netsh.exe PID 396 wrote to memory of 224 396 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe mshta.exe PID 396 wrote to memory of 224 396 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe mshta.exe PID 396 wrote to memory of 224 396 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe mshta.exe PID 396 wrote to memory of 4828 396 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe NOTEPAD.EXE PID 396 wrote to memory of 4828 396 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe NOTEPAD.EXE PID 396 wrote to memory of 4828 396 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe NOTEPAD.EXE PID 396 wrote to memory of 2732 396 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe cmd.exe PID 396 wrote to memory of 2732 396 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe cmd.exe PID 396 wrote to memory of 2732 396 2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe cmd.exe PID 2732 wrote to memory of 3652 2732 cmd.exe taskkill.exe PID 2732 wrote to memory of 3652 2732 cmd.exe taskkill.exe PID 2732 wrote to memory of 3652 2732 cmd.exe taskkill.exe PID 2732 wrote to memory of 1408 2732 cmd.exe PING.EXE PID 2732 wrote to memory of 1408 2732 cmd.exe PING.EXE PID 2732 wrote to memory of 1408 2732 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_READ_THI$_FILE_CSGH7_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_READ_THI$_FILE_LVHRI_.txt3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "2e4a5ee417ff54e3bbaaddd2bc5253ae_JaffaCakes118.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x320 0x4f81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_READ_THI$_FILE_GZGO0GV_.txtFilesize
1KB
MD5cfe9db6563bf07627aedb39904adc318
SHA1b682e8cd574dd34f971283bbbc298e8a89c073a9
SHA2567e1ad933f6558fce5d6408b83219a28876dde6fc04ce01ebc109e5ab6e30dfe0
SHA5129f5b87eb8cce7ffa970dee62830781737495c56543cb09ac56f0b443c9a8672e1ac35fc2468109b76180a2eaae9ac3bdec5d31a6ed4d410d00f138ed16ab817e
-
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_READ_THI$_FILE_W2FURZ_.htaFilesize
75KB
MD5edc3f1fe01c35d961e9ac0df6736fd0e
SHA1edbcb1b84e8dc3ead0914fadb71f1956c5c4f075
SHA25609b6c7257f65e66815f570751d70d492fce64231f66e4c0eefe383edff743681
SHA512ade72b9f61d28bf4567198522e9319b6fb45bcb23af215039a97c64eb68e2911a84edb40710f0a164986bc3e317d709ed520d841e6f960f69e6ee145adec5bcd
-
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_READ_THI$_FILE_9QAQYP_.jpegFilesize
150KB
MD596bab57acaf89fee99a97bc9995b24cb
SHA1bb853390b8677c84eb5d27e2d9ba116083cb3a1c
SHA2563e42572ff9947b1971cef8ac4bc5c0362495a7f74b69bbb4b8ea5774a493db2f
SHA51210abb27d112db3ac9ab9f9f0858fbc67e06a2e3d620dc05a40c236832c563beb0fb3132d803e7773e47d89f8abcfa047e6809cc65db3d72126ecf816341b8ce1
-
memory/396-4-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/396-6-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/396-9-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/396-13-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/396-3-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/396-1-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/396-378-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/396-411-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/396-412-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1332-5-0x0000000000070000-0x00000000000D0000-memory.dmpFilesize
384KB
-
memory/1332-0-0x0000000000070000-0x00000000000D0000-memory.dmpFilesize
384KB