Analysis
-
max time kernel
118s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-05-2024 19:12
Static task
static1
Behavioral task
behavioral1
Sample
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe
-
Size
463KB
-
MD5
361d333fba9f9de0e51996d7b85bec12
-
SHA1
f90420543dca7e67e4c89ab4e0ca37046680edcc
-
SHA256
c1daf5d0e47641e24e6835a946933b569d23288f77d86abfc5c5c29ff7c5cd3c
-
SHA512
8cacec85b87ade9f9451063c677c1cc34870cc626aad7bea6e60e026b602d1b59450967e787eb9143fbfb50080f0750ef7666b8ee30a9c38f78b63b0c6acbc19
-
SSDEEP
6144:yjNU2JGxqoOMWFZ3K1n1V171wMMEiTxkbNZTZktVZZpBVx/:yjFQwoArKd1V7wMMFGbNZTZ6vXB3/
Malware Config
Extracted
C:\Users\Admin\Desktop\_READ_THI$_FILE_ZK4W802_.txt
http://p27dokhpz2n7nvgr.onion/330B-385C-E797-0099-3E61
http://p27dokhpz2n7nvgr.1nhkou.top/330B-385C-E797-0099-3E61
http://p27dokhpz2n7nvgr.1a7wnt.top/330B-385C-E797-0099-3E61
http://p27dokhpz2n7nvgr.1czh7o.top/330B-385C-E797-0099-3E61
http://p27dokhpz2n7nvgr.1hpvzl.top/330B-385C-E797-0099-3E61
http://p27dokhpz2n7nvgr.1pglcs.top/330B-385C-E797-0099-3E61
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Blocklisted process makes network request 5 IoCs
Processes:
mshta.exeflow pid process 2181 2808 mshta.exe 2184 2808 mshta.exe 2186 2808 mshta.exe 2188 2808 mshta.exe 2190 2808 mshta.exe -
Contacts a large (1095) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 1256 netsh.exe 1708 netsh.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 488 cmd.exe -
Drops file in System32 directory 38 IoCs
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp4CF8.bmp" 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exedescription pid process target process PID 1916 set thread context of 1584 1916 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe -
Drops file in Program Files directory 20 IoCs
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\program files (x86)\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\ 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\outlook 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\steam 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\thunderbird 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files\ 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\bitcoin 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\the bat! 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\ 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 604 taskkill.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 1584 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe Token: SeDebugPrivilege 604 taskkill.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exeDllHost.exepid process 1916 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 1916 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 2224 DllHost.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exepid process 1916 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 1916 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exepid process 1916 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.execmd.exedescription pid process target process PID 1916 wrote to memory of 1584 1916 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 1916 wrote to memory of 1584 1916 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 1916 wrote to memory of 1584 1916 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 1916 wrote to memory of 1584 1916 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 1916 wrote to memory of 1584 1916 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 1916 wrote to memory of 1584 1916 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 1916 wrote to memory of 1584 1916 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 1916 wrote to memory of 1584 1916 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 1916 wrote to memory of 1584 1916 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 1916 wrote to memory of 1584 1916 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 1916 wrote to memory of 1584 1916 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 1916 wrote to memory of 1584 1916 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 1584 wrote to memory of 1256 1584 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe netsh.exe PID 1584 wrote to memory of 1256 1584 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe netsh.exe PID 1584 wrote to memory of 1256 1584 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe netsh.exe PID 1584 wrote to memory of 1256 1584 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe netsh.exe PID 1584 wrote to memory of 1708 1584 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe netsh.exe PID 1584 wrote to memory of 1708 1584 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe netsh.exe PID 1584 wrote to memory of 1708 1584 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe netsh.exe PID 1584 wrote to memory of 1708 1584 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe netsh.exe PID 1584 wrote to memory of 2808 1584 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe mshta.exe PID 1584 wrote to memory of 2808 1584 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe mshta.exe PID 1584 wrote to memory of 2808 1584 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe mshta.exe PID 1584 wrote to memory of 2808 1584 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe mshta.exe PID 1584 wrote to memory of 2736 1584 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe NOTEPAD.EXE PID 1584 wrote to memory of 2736 1584 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe NOTEPAD.EXE PID 1584 wrote to memory of 2736 1584 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe NOTEPAD.EXE PID 1584 wrote to memory of 2736 1584 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe NOTEPAD.EXE PID 1584 wrote to memory of 488 1584 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe cmd.exe PID 1584 wrote to memory of 488 1584 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe cmd.exe PID 1584 wrote to memory of 488 1584 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe cmd.exe PID 1584 wrote to memory of 488 1584 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe cmd.exe PID 488 wrote to memory of 604 488 cmd.exe taskkill.exe PID 488 wrote to memory of 604 488 cmd.exe taskkill.exe PID 488 wrote to memory of 604 488 cmd.exe taskkill.exe PID 488 wrote to memory of 604 488 cmd.exe taskkill.exe PID 488 wrote to memory of 1800 488 cmd.exe PING.EXE PID 488 wrote to memory of 1800 488 cmd.exe PING.EXE PID 488 wrote to memory of 1800 488 cmd.exe PING.EXE PID 488 wrote to memory of 1800 488 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe"2⤵
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_READ_THI$_FILE_IIPAXJ2T_.hta"3⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_READ_THI$_FILE_ZK4W802_.txt3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar6DB8.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\Desktop\_READ_THI$_FILE_D8PJ_.jpegFilesize
150KB
MD51a2840b4e799b47668cae0454c4f3af9
SHA14a8dcae34c10350564b782a1908b69229fff445c
SHA256996a5964e6ff651715a8a42979e6aff18af1c5550220d774f0e00cc6ad04bd5e
SHA512ed5c654d41a996e8dd35a39dd0a0a99be456292ad75de3eea0341e84a21bdad591e4d18960281fe1660b3c90edbae08ec978f2f8cb8e1430ec144d7bd3242146
-
C:\Users\Admin\Desktop\_READ_THI$_FILE_IIPAXJ2T_.htaFilesize
75KB
MD5a5beff3092b2a1aecf89be852dd26576
SHA19ed906d58968985cc77708fa9d36c0f9d5c00869
SHA256c3702701e883b77cf613442cb4fa9dcbf8da41e2215f6c9711474eb7665732af
SHA512f98b18e804e53d60c0f65ec75d75b2fc57e61a6588fab966fe094bdf06af8e5a81c94669e117823b9df2f3fbd97fb33a5700898c99f54b2bbf2c60b6a0b29399
-
C:\Users\Admin\Desktop\_READ_THI$_FILE_ZK4W802_.txtFilesize
1KB
MD5be0e4acc0ab8c9b782e70b6c84158dd0
SHA1f03a5406869a45f1d9122c9607c5c4ea3e48dd15
SHA256dcbcb83b8015e007152536a5a4e47726d7927ae7f9cee6840b52868764a031db
SHA512df2977c94aebaea449d39df141b661ea7568f7646d0d5e4311c5952cb3ba32a913c3efab0b12dfdd9d02888b04b7ad1bafcbc265c4a331a607d9e661b5cf5321
-
memory/1584-86-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1584-2-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1584-13-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1584-10-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1584-109-0x0000000003A40000-0x0000000003A42000-memory.dmpFilesize
8KB
-
memory/1584-6-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1584-128-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1584-5-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1584-4-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2224-110-0x0000000000120000-0x0000000000122000-memory.dmpFilesize
8KB