Overview

overview

10

Static

static

3

37f4f850cd...18.exe

windows7-x64

10

37f4f850cd...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-05-2024 03:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    37f4f850cdbff63aeaa7cddc1c109a2f_JaffaCakes118.exe

  • Size

    133KB

  • MD5

    37f4f850cdbff63aeaa7cddc1c109a2f

  • SHA1

    aff7432e46dd7208360489b200b5a3681b49c64c

  • SHA256

    9c9722eb1fe7c7d35eff80252cf3b88d2e82b9cdcd52afed719da516a6fd8e57

  • SHA512

    908daa1b310f9ed6f45dad2ab41cae986d041d654f71d01da1006899a3291f90145e4594b634e71f75a69735155d103c857662ebac054fec5069d9019efd1617

  • SSDEEP

    3072:TMoMengMYwQn0Qcagg1jSM125THtY8zIOYRGJSr/zf1bbBJ:IoMigDF03HDzPYRGJSrJv

Score
10/10
phobosdefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (78) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\37f4f850cdbff63aeaa7cddc1c109a2f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\37f4f850cdbff63aeaa7cddc1c109a2f_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4728
    • C:\Users\Admin\AppData\Local\Temp\37f4f850cdbff63aeaa7cddc1c109a2f_JaffaCakes118.exe
      "{path}"
      2⤵
      • Drops startup file
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1172
      • C:\Users\Admin\AppData\Local\Temp\37f4f850cdbff63aeaa7cddc1c109a2f_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\37f4f850cdbff63aeaa7cddc1c109a2f_JaffaCakes118.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4764
        • C:\Users\Admin\AppData\Local\Temp\37f4f850cdbff63aeaa7cddc1c109a2f_JaffaCakes118.exe
          "{path}"
          4⤵
            PID:3396
          • C:\Users\Admin\AppData\Local\Temp\37f4f850cdbff63aeaa7cddc1c109a2f_JaffaCakes118.exe
            "{path}"
            4⤵
              PID:2164
            • C:\Users\Admin\AppData\Local\Temp\37f4f850cdbff63aeaa7cddc1c109a2f_JaffaCakes118.exe
              "{path}"
              4⤵
                PID:4564
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2080
              • C:\Windows\system32\vssadmin.exe
                vssadmin delete shadows /all /quiet
                4⤵
                • Interacts with shadow copies
                PID:4848
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic shadowcopy delete
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1968
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} bootstatuspolicy ignoreallfailures
                4⤵
                • Modifies boot configuration data using bcdedit
                PID:2064
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} recoveryenabled no
                4⤵
                • Modifies boot configuration data using bcdedit
                PID:2448
              • C:\Windows\system32\wbadmin.exe
                wbadmin delete catalog -quiet
                4⤵
                • Deletes backup catalog
                PID:3720
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
          1⤵
            PID:2156
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1620
          • C:\Windows\system32\wbengine.exe
            "C:\Windows\system32\wbengine.exe"
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4688
          • C:\Windows\System32\vdsldr.exe
            C:\Windows\System32\vdsldr.exe -Embedding
            1⤵
              PID:2204
            • C:\Windows\System32\vds.exe
              C:\Windows\System32\vds.exe
              1⤵
              • Checks SCSI registry key(s)
              PID:2356

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files\7-Zip\7z.dll.id[78394AE8-2275].[[email protected]].help
              Filesize

              2.5MB

              MD5

              09da13c5757b7cf80f65ed8f3f59aa96

              SHA1

              4fc20049038cbd95644382f4adb8989627add519

              SHA256

              63ff20e8c5b9fe1932fbbb1baca8719bd1a991f73bf82145929aedb986003472

              SHA512

              5cd2b40a0c7f8c49e9059e22c5f7f7b529a12e9188cca89efa74701c6328e6068bdc654e6006c181b078bf6b62de071d465ca26874b2f8ec2af3b070a74014f8

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\37f4f850cdbff63aeaa7cddc1c109a2f_JaffaCakes118.exe.log
              Filesize

              496B

              MD5

              cb76b18ebed3a9f05a14aed43d35fba6

              SHA1

              836a4b4e351846fca08b84149cb734cb59b8c0d6

              SHA256

              8d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349

              SHA512

              7631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db
              Filesize

              24B

              MD5

              1681ffc6e046c7af98c9e6c232a3fe0a

              SHA1

              d3399b7262fb56cb9ed053d68db9291c410839c4

              SHA256

              9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0

              SHA512

              11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5

              Download Submit
            • memory/1172-27-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1172-670-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1172-5-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1172-8-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1172-9-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1172-2208-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1172-2200-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1172-40-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1172-461-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1172-61-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1172-28-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1172-45-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1172-26-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1172-25-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1172-24-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1172-29-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/4728-2-0x0000000074CA0000-0x0000000075251000-memory.dmp
              Filesize

              5.7MB

              Download
            • memory/4728-0-0x0000000074CA2000-0x0000000074CA3000-memory.dmp
              Filesize

              4KB

              Download
            • memory/4728-4-0x0000000074CA0000-0x0000000075251000-memory.dmp
              Filesize

              5.7MB

              Download
            • memory/4728-1-0x0000000074CA0000-0x0000000075251000-memory.dmp
              Filesize

              5.7MB

              Download
            • memory/4728-12-0x0000000074CA0000-0x0000000075251000-memory.dmp
              Filesize

              5.7MB

              Download
            • memory/4728-3-0x0000000074CA2000-0x0000000074CA3000-memory.dmp
              Filesize

              4KB

              Download
            • memory/4764-14-0x0000000074CA0000-0x0000000075251000-memory.dmp
              Filesize

              5.7MB

              Download
            • memory/4764-13-0x0000000074CA0000-0x0000000075251000-memory.dmp
              Filesize

              5.7MB

              Download
            • memory/4764-11-0x0000000074CA2000-0x0000000074CA3000-memory.dmp
              Filesize

              4KB

              Download
            • memory/4764-740-0x0000000074CA0000-0x0000000075251000-memory.dmp
              Filesize

              5.7MB

              Download
            • memory/4764-870-0x0000000074CA0000-0x0000000075251000-memory.dmp
              Filesize

              5.7MB

              Download