Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 19:12
Static task
static1
Behavioral task
behavioral1
Sample
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe
-
Size
463KB
-
MD5
361d333fba9f9de0e51996d7b85bec12
-
SHA1
f90420543dca7e67e4c89ab4e0ca37046680edcc
-
SHA256
c1daf5d0e47641e24e6835a946933b569d23288f77d86abfc5c5c29ff7c5cd3c
-
SHA512
8cacec85b87ade9f9451063c677c1cc34870cc626aad7bea6e60e026b602d1b59450967e787eb9143fbfb50080f0750ef7666b8ee30a9c38f78b63b0c6acbc19
-
SSDEEP
6144:yjNU2JGxqoOMWFZ3K1n1V171wMMEiTxkbNZTZktVZZpBVx/:yjFQwoArKd1V7wMMFGbNZTZ6vXB3/
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_READ_THI$_FILE_VRB36WM_.txt
http://p27dokhpz2n7nvgr.onion/E064-A790-09CA-0099-31D3
http://p27dokhpz2n7nvgr.1nhkou.top/E064-A790-09CA-0099-31D3
http://p27dokhpz2n7nvgr.1a7wnt.top/E064-A790-09CA-0099-31D3
http://p27dokhpz2n7nvgr.1czh7o.top/E064-A790-09CA-0099-31D3
http://p27dokhpz2n7nvgr.1hpvzl.top/E064-A790-09CA-0099-31D3
http://p27dokhpz2n7nvgr.1pglcs.top/E064-A790-09CA-0099-31D3
Extracted
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_READ_THI$_FILE_URJYW5_.hta
cerber
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (1099) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 5016 netsh.exe 692 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe -
Drops startup file 1 IoCs
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe -
Drops file in System32 directory 38 IoCs
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpBE8D.bmp" 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exedescription pid process target process PID 4912 set thread context of 3824 4912 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe -
Drops file in Program Files directory 20 IoCs
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\program files (x86)\outlook 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\steam 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\ 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\bitcoin 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\thunderbird 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files\ 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\the bat! 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\ 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4248 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 3824 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3824 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe Token: SeDebugPrivilege 4248 taskkill.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exepid process 4912 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 4912 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exepid process 4912 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 4912 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exepid process 4912 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.execmd.exedescription pid process target process PID 4912 wrote to memory of 3824 4912 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 4912 wrote to memory of 3824 4912 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 4912 wrote to memory of 3824 4912 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 4912 wrote to memory of 3824 4912 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 4912 wrote to memory of 3824 4912 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 4912 wrote to memory of 3824 4912 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 4912 wrote to memory of 3824 4912 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 4912 wrote to memory of 3824 4912 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 4912 wrote to memory of 3824 4912 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 4912 wrote to memory of 3824 4912 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 4912 wrote to memory of 3824 4912 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe PID 3824 wrote to memory of 5016 3824 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe netsh.exe PID 3824 wrote to memory of 5016 3824 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe netsh.exe PID 3824 wrote to memory of 5016 3824 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe netsh.exe PID 3824 wrote to memory of 692 3824 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe netsh.exe PID 3824 wrote to memory of 692 3824 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe netsh.exe PID 3824 wrote to memory of 692 3824 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe netsh.exe PID 3824 wrote to memory of 1152 3824 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe mshta.exe PID 3824 wrote to memory of 1152 3824 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe mshta.exe PID 3824 wrote to memory of 1152 3824 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe mshta.exe PID 3824 wrote to memory of 4924 3824 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe NOTEPAD.EXE PID 3824 wrote to memory of 4924 3824 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe NOTEPAD.EXE PID 3824 wrote to memory of 4924 3824 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe NOTEPAD.EXE PID 3824 wrote to memory of 4064 3824 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe cmd.exe PID 3824 wrote to memory of 4064 3824 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe cmd.exe PID 3824 wrote to memory of 4064 3824 361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe cmd.exe PID 4064 wrote to memory of 4248 4064 cmd.exe taskkill.exe PID 4064 wrote to memory of 4248 4064 cmd.exe taskkill.exe PID 4064 wrote to memory of 4248 4064 cmd.exe taskkill.exe PID 4064 wrote to memory of 1884 4064 cmd.exe PING.EXE PID 4064 wrote to memory of 1884 4064 cmd.exe PING.EXE PID 4064 wrote to memory of 1884 4064 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_READ_THI$_FILE_ZIT7_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_READ_THI$_FILE_4DBK3VV_.txt3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "361d333fba9f9de0e51996d7b85bec12_JaffaCakes118.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_READ_THI$_FILE_QG7O4IRW_.jpegFilesize
150KB
MD54db32329cf71818be769198c94dc4c9b
SHA12f96c3ac00baf22853360a1fb4ab91a3ebc7f695
SHA256a5d7e765dec5a1b8d4522885b5827c7fc24590cd4a37e8287bc2e0f3c2612a20
SHA512067fac6f0b2be56288d47e4b1dd44121f869ef7d9caa01f56262418fbbaaa28634672cf73a3e88d10a4a0f7b828f614d99ae27822b223b48380c7bbe7f70dcc2
-
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_READ_THI$_FILE_URJYW5_.htaFilesize
75KB
MD517ed1d1ce2349e2223e5d46b59701687
SHA1f3021f2c781c2c65174b068b2c499a2ba5faec40
SHA256413d9daaa131f4aae4abd20ee1e1064ea4d1d2a44f9c3be7f0319554cfb48f0d
SHA51217498cbacfa4a7203d782248d358af53191296d21fcd9096401bc70335e07693e0c3cec5cef23374903f1de392d46adf82c6c0098dff459580ead57e8082a891
-
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_READ_THI$_FILE_VRB36WM_.txtFilesize
1KB
MD5c79f0943425b1adb32e35260ce766f9c
SHA1b23326182a028d34f268982a1f6228af245b91e2
SHA256989089240da7fa6d918f5d89986cec94dccf97dcca27d08fffd7d6dc822088da
SHA5126fc6b02730e2154f05257d34715c5b200ee3b35a95a36a5cd453d76109522ca3f5b2a9a7413b48df3f52f0d4f3d82780c2703e28da23e65e9f3329ddf0e181bd
-
memory/3824-2-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3824-4-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3824-5-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3824-6-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3824-7-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3824-10-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3824-411-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3824-416-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3824-431-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB