Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 19:07
Behavioral task
behavioral1
Sample
42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
-
Size
222KB
-
MD5
42a2e208bc7721348699212bc5cf50e5
-
SHA1
15934add1f6f10bc50daa707bf8d02bb62edbdf7
-
SHA256
d186adf9bf8ae0b9759a2836f94597d6832f076bd03de9886181be53183d25de
-
SHA512
2549f5273ea6120dc18a97c1f59324e6e5696b15bf7f56a5c22c4d1c461fd6da200272aa58529b42a8e2ce6e8c8b1298030b38298bed9194b26882be8cb8cebb
-
SSDEEP
3072:sr85CIyyTsnAdu5tjgn/RRKwkwvMT3QE4f07YouoFhiLFrb30BRtBZZg+i2T:k9nyTsnXToKJw4gEWpoFuJ0BXScT
Malware Config
Extracted
sodinokibi
$2a$10$SlLR2WWgiOxrDQLqdHYA/Or5zeu.wNuMGc5rN/HHrIObc1EkKCIZa
3181
vannesteconstruct.be
irishmachineryauctions.com
zervicethai.co.th
ymca-cw.org.uk
trystana.com
smessier.com
beautychance.se
sabel-bf.com
kafu.ch
aselbermachen.com
first-2-aid-u.com
finediningweek.pl
berlin-bamboo-bikes.org
lbcframingelectrical.com
augenta.com
abitur-undwieweiter.de
digi-talents.com
wellplast.se
conasmanagement.de
simpkinsedwards.co.uk
romeguidedvisit.com
tastewilliamsburg.com
bingonearme.org
mylovelybluesky.com
nacktfalter.de
oldschoolfun.net
baylegacy.com
buroludo.nl
corelifenutrition.com
vietlawconsultancy.com
deschl.net
proudground.org
commercialboatbuilding.com
serce.info.pl
eadsmurraypugh.com
joseconstela.com
offroadbeasts.com
evangelische-pfarrgemeinde-tuniberg.de
richard-felix.co.uk
beyondmarcomdotcom.wordpress.com
christinarebuffetcourses.com
supportsumba.nl
jusibe.com
hairstylesnow.site
bildungsunderlebnis.haus
yassir.pro
nestor-swiss.ch
lachofikschiet.nl
bordercollie-nim.nl
sexandfessenjoon.wordpress.com
whittier5k.com
artallnightdc.com
ilive.lt
strategicstatements.com
lionware.de
latribuessentielle.com
delchacay.com.ar
mooreslawngarden.com
bodyfulls.com
moveonnews.com
ussmontanacommittee.us
slupetzky.at
softsproductkey.com
parking.netgateway.eu
bowengroup.com.au
ilso.net
visiativ-industry.fr
danielblum.info
uimaan.fi
walter-lemm.de
iphoneszervizbudapest.hu
ncuccr.org
wraithco.com
steampluscarpetandfloors.com
bodyforwife.com
victoriousfestival.co.uk
thenewrejuveme.com
argenblogs.com.ar
freie-baugutachterpraxis.de
bunburyfreightservices.com.au
finde-deine-marke.de
cactusthebrand.com
sanaia.com
maasreusel.nl
4youbeautysalon.com
crosspointefellowship.church
micro-automation.de
plantag.de
airconditioning-waalwijk.nl
danholzmann.com
mymoneyforex.com
jasonbaileystudio.com
stallbyggen.se
schmalhorst.de
geoffreymeuli.com
dw-css.de
kostenlose-webcams.com
bierensgebakkramen.nl
greenfieldoptimaldentalcare.com
waywithwords.net
advokathuset.dk
phantastyk.com
xltyu.com
gemeentehetkompas.nl
olejack.ru
slashdb.com
theapifactory.com
otsu-bon.com
globedivers.wordpress.com
modelmaking.nl
hushavefritid.dk
insigniapmg.com
castillobalduz.es
bristolaeroclub.co.uk
plastidip.com.ar
plv.media
naswrrg.org
vyhino-zhulebino-24.ru
opatrovanie-ako.sk
fensterbau-ziegler.de
farhaani.com
shonacox.com
narcert.com
rozemondcoaching.nl
torgbodenbollnas.se
projetlyonturin.fr
embracinghiscall.com
actecfoundation.org
falcou.fr
slwgs.org
copystar.co.uk
galleryartfair.com
kikedeoliveira.com
eco-southafrica.com
digivod.de
katketytaanet.fi
socstrp.org
goodgirlrecovery.com
body-guards.it
gopackapp.com
ivfminiua.com
ladelirante.fr
people-biz.com
kariokids.com
creative-waves.co.uk
praxis-management-plus.de
suncrestcabinets.ca
journeybacktolife.com
hoteledenpadova.it
handi-jack-llc.com
sojamindbody.com
carlosja.com
crowcanyon.com
run4study.com
seproc.hn
plotlinecreative.com
coffreo.biz
sandd.nl
autofolierung-lu.de
charlottepoudroux-photographie.fr
oncarrot.com
trapiantofue.it
aprepol.com
dekkinngay.com
homesdollar.com
fatfreezingmachines.com
smhydro.com.pl
cityorchardhtx.com
evologic-technologies.com
berliner-versicherungsvergleich.de
testcoreprohealthuk.com
mrsfieldskc.com
kirkepartner.dk
stemplusacademy.com
longislandelderlaw.com
johnsonfamilyfarmblog.wordpress.com
spsshomeworkhelp.com
fransespiegels.nl
ino-professional.ru
nvwoodwerks.com
colorofhorses.com
bptdmaluku.com
themadbotter.com
boulderwelt-muenchen-west.de
stampagrafica.es
fiscalsort.com
epwritescom.wordpress.com
tennisclubetten.nl
satyayoga.de
1kbk.com.ua
gadgetedges.com
darnallwellbeing.org.uk
shiftinspiration.com
kidbucketlist.com.au
y-archive.com
idemblogs.com
new.devon.gov.uk
jakekozmor.com
rumahminangberdaya.com
campusoutreach.org
dontpassthepepper.com
anybookreader.de
qlog.de
deko4you.at
birnam-wood.com
eglectonk.online
allfortheloveofyou.com
irinaverwer.com
chatizel-paysage.fr
pogypneu.sk
revezlimage.com
solhaug.tk
arteservicefabbro.com
vorotauu.ru
rushhourappliances.com
chaotrang.com
basisschooldezonnewijzer.nl
milsing.hr
abogadosadomicilio.es
hellohope.com
perbudget.com
muamuadolls.com
edelman.jp
gasolspecialisten.se
ianaswanson.com
heliomotion.com
skanah.com
zenderthelender.com
simpliza.com
zonamovie21.net
amerikansktgodis.se
slimidealherbal.com
jobcenterkenya.com
neuschelectrical.co.za
zieglerbrothers.de
webmaster-peloton.com
atmos-show.com
architekturbuero-wagner.net
tetinfo.in
poultrypartners.nl
sportiomsportfondsen.nl
deoudedorpskernnoordwijk.nl
groupe-cets.com
mousepad-direkt.de
crowd-patch.co.uk
gw2guilds.org
fitnessbazaar.com
coastalbridgeadvisors.com
marchand-sloboda.com
bouquet-de-roses.com
woodleyacademy.org
camsadviser.com
strandcampingdoonbeg.com
esope-formation.fr
tenacitytenfold.com
walkingdeadnj.com
zimmerei-fl.de
pcprofessor.com
theadventureedge.com
edgewoodestates.org
imperfectstore.com
kingfamily.construction
drnice.de
effortlesspromo.com
appsformacpc.com
troegs.com
blacksirius.de
team-montage.dk
cnoia.org
theclubms.com
klimt2012.info
tuuliautio.fi
launchhubl.com
verifort-capital.de
elimchan.com
lloydconstruction.com
gastsicht.de
harveybp.com
forestlakeuca.org.au
portoesdofarrobo.com
videomarketing.pro
kedak.de
calxplus.eu
naturstein-hotte.de
zimmerei-deboer.de
myteamgenius.com
celeclub.org
paulisdogshop.de
anteniti.com
charlesreger.com
justinvieira.com
geisterradler.de
behavioralmedicinespecialists.com
tampaallen.com
jacquin-maquettes.com
smokeysstoves.com
hiddencitysecrets.com.au
higadograsoweb.com
allentownpapershow.com
thomasvicino.com
smogathon.com
bastutunnan.se
chefdays.de
polymedia.dk
heurigen-bauer.at
ikads.org
live-your-life.jp
noixdecocom.fr
nandistribution.nl
turkcaparbariatrics.com
meusharklinithome.wordpress.com
rollingrockcolumbia.com
real-estate-experts.com
kadesignandbuild.co.uk
agence-referencement-naturel-geneve.net
solerluethi-allart.ch
caribdoctor.org
sw1m.ru
directwindowco.com
fitovitaforum.com
buymedical.biz
rosavalamedahr.com
monark.com
biapi-coaching.fr
cheminpsy.fr
alsace-first.com
creamery201.com
chavesdoareeiro.com
besttechie.com
pv-design.de
craigmccabe.fun
unim.su
brandl-blumen.de
sinal.org
botanicinnovations.com
michaelsmeriglioracing.com
herbstfeststaefa.ch
haar-spange.com
krcove-zily.eu
wari.com.pe
corendonhotels.com
dinslips.se
pasivect.co.uk
villa-marrakesch.de
ungsvenskarna.se
manutouchmassage.com
myhostcloud.com
schraven.de
ahouseforlease.com
abogadoengijon.es
allamatberedare.se
mepavex.nl
nurturingwisdom.com
mooshine.com
officehymy.com
croftprecision.co.uk
solinegraphic.com
despedidascostablanca.es
samnewbyjax.com
surespark.org.uk
houseofplus.com
puertamatic.es
ihr-news.jp
pcp-nc.com
importardechina.info
cursosgratuitosnainternet.com
saka.gr
agence-chocolat-noir.com
miriamgrimm.de
yousay.site
notmissingout.com
mindpackstudios.com
denifl-consulting.at
tomoiyuma.com
noesis.tech
mrsplans.net
ravensnesthomegoods.com
microcirc.net
woodworkersolution.com
fannmedias.com
teczowadolina.bytom.pl
greenko.pl
fairfriends18.de
antenanavi.com
gaiam.nl
mountsoul.de
maineemploymentlawyerblog.com
femxarxa.cat
madinblack.com
hvccfloorcare.com
jeanlouissibomana.com
assurancesalextrespaille.fr
liveottelut.com
retroearthstudio.com
funjose.org.gt
maureenbreezedancetheater.org
mercantedifiori.com
xn--logopdie-leverkusen-kwb.de
blewback.com
presseclub-magdeburg.de
xn--singlebrsen-vergleich-nec.com
nijaplay.com
rostoncastings.co.uk
vloeren-nu.nl
carrybrands.nl
hexcreatives.co
asteriag.com
planchaavapor.net
autopfand24.de
nataschawessels.com
geekwork.pl
mariposapropaneaz.com
bockamp.com
upmrkt.co
id-vet.com
mbfagency.com
facettenreich27.de
deltacleta.cat
judithjansen.com
whyinterestingly.ru
id-et-d.fr
thaysa.com
sterlingessay.com
blood-sports.net
instatron.net
shsthepapercut.com
lascuola.nl
dareckleyministries.com
igorbarbosa.com
thedresserie.com
lapinvihreat.fi
ftlc.es
teresianmedia.org
norovirus-ratgeber.de
xn--fn-kka.no
vitavia.lt
unetica.fr
schlafsack-test.net
mank.de
htchorst.nl
theshungiteexperience.com.au
shadebarandgrillorlando.com
rhinosfootballacademy.com
danskretursystem.dk
ruralarcoiris.com
innote.fi
rerekatu.com
rieed.de
hhcourier.com
americafirstcommittee.org
theletter.company
bundabergeyeclinic.com.au
resortmtn.com
paymybill.guru
lubetkinmediacompanies.com
mountaintoptinyhomes.com
associacioesportivapolitg.cat
faroairporttransfers.net
stemenstilte.nl
werkkring.nl
ecoledansemulhouse.fr
kaotikkustomz.com
deprobatehelp.com
jerling.de
commonground-stories.com
balticdermatology.lt
maryloutaylor.com
pt-arnold.de
compliancesolutionsstrategies.com
leeuwardenstudentcity.nl
mylolis.com
vibehouse.rw
centrospgolega.com
piajeppesen.dk
xn--rumung-bua.online
hairnetty.wordpress.com
dutchcoder.nl
datacenters-in-europe.com
bogdanpeptine.ro
rimborsobancario.net
manifestinglab.com
midmohandyman.com
flexicloud.hk
stefanpasch.me
katiekerr.co.uk
hihaho.com
igfap.com
koko-nora.dk
henricekupper.com
corona-handles.com
freie-gewerkschaften.de
atozdistribution.co.uk
mirjamholleman.nl
zweerscreatives.nl
educar.org
international-sound-awards.com
intecwi.com
hrabritelefon.hr
bestbet.com
schoolofpassivewealth.com
cwsitservices.co.uk
advizewealth.com
psnacademy.in
nosuchthingasgovernment.com
friendsandbrgrs.com
35-40konkatsu.net
milanonotai.it
wurmpower.at
modamilyon.com
scenepublique.net
verytycs.com
hotelzentral.at
2ekeus.nl
pawsuppetlovers.com
alysonhoward.com
tomaso.gr
brevitempore.net
linnankellari.fi
mdacares.com
ogdenvision.com
roadwarrior.app
love30-chanko.com
better.town
dublikator.com
dr-seleznev.com
ceid.info.tr
101gowrie.com
pferdebiester.de
pierrehale.com
karacaoglu.nl
ilcdover.com
rehabilitationcentersinhouston.net
kissit.ca
analiticapublica.es
schoellhammer.com
memaag.com
sla-paris.com
bloggyboulga.net
dezatec.es
antiaginghealthbenefits.com
edv-live.de
kunze-immobilien.de
anthonystreetrimming.com
bee4win.com
d1franchise.com
withahmed.com
beaconhealthsystem.org
kamahouse.net
catholicmusicfest.com
hannah-fink.de
bxdf.info
liikelataamo.fi
stupbratt.no
filmstreamingvfcomplet.be
sportverein-tambach.de
work2live.de
craftleathermnl.com
classycurtainsltd.co.uk
deepsouthclothingcompany.com
autodujos.lt
braffinjurylawfirm.com
carriagehousesalonvt.com
collaborativeclassroom.org
miraclediet.fun
greenpark.ch
ostheimer.at
balticdentists.com
acomprarseguidores.com
bhwlawfirm.com
ralister.co.uk
porno-gringo.com
leda-ukraine.com.ua
waynela.com
dubnew.com
bargningharnosand.se
antonmack.de
abl1.net
grupocarvalhoerodrigues.com.br
tinkoff-mobayl.ru
degroenetunnel.com
makeitcount.at
ccpbroadband.com
ohidesign.com
abogadosaccidentetraficosevilla.es
adoptioperheet.fi
lenreactiv-shop.ru
imaginado.de
centromarysalud.com
ora-it.de
familypark40.com
nuzech.com
licor43.de
kevinjodea.com
joyeriaorindia.com
polychromelabs.com
wasmachtmeinfonds.at
luckypatcher-apkz.com
triggi.de
gamesboard.info
bigler-hrconsulting.ch
gymnasedumanagement.com
chrissieperry.com
schutting-info.nl
webcodingstudio.com
amylendscrestview.com
herbayupro.com
dramagickcom.wordpress.com
fotoideaymedia.es
fayrecreations.com
stoneys.ch
naturavetal.hr
sofavietxinh.com
seagatesthreecharters.com
tinyagency.com
platformier.com
DupontSellsHomes.com
danubecloud.com
hatech.io
extensionmaison.info
ventti.com.ar
paradicepacks.com
maratonaclubedeportugal.com
zewatchers.com
forskolorna.org
art2gointerieurprojecten.nl
the-virtualizer.com
kao.at
tecnojobsnet.com
alhashem.net
readberserk.com
lichencafe.com
sauschneider.info
girlillamarketing.com
backstreetpub.com
entopic.com
hugoversichert.de
mikeramirezcpa.com
highimpactoutdoors.net
csgospeltips.se
ai-spt.jp
spacecitysisters.org
completeweddingkansas.com
ecopro-kanto.com
devlaur.com
klusbeter.nl
nmiec.com
faronics.com
manijaipur.com
sanyue119.com
securityfmm.com
huesges-gruppe.de
smithmediastrategies.com
dubscollective.com
hypozentrum.com
employeesurveys.com
nokesvilledentistry.com
pinkexcel.com
nakupunafoundation.org
xlarge.at
financescorecard.com
bouncingbonanza.com
kenhnoithatgo.com
tradiematepro.com.au
musictreehouse.net
asgestion.com
ontrailsandboulevards.com
krlosdavid.com
siliconbeach-realestate.com
live-con-arte.de
pubweb.carnet.hr
naturalrapids.com
consultaractadenacimiento.com
stingraybeach.com
tongdaifpthaiphong.net
wacochamber.com
mrtour.site
onlyresultsmarketing.com
nsec.se
southeasternacademyofprosthodontics.org
thewellnessmimi.com
gasbarre.com
toponlinecasinosuk.co.uk
baumkuchenexpo.jp
baptisttabernacle.com
div-vertriebsforschung.de
smale-opticiens.nl
365questions.org
kampotpepper.gives
biortaggivaldelsa.com
cerebralforce.net
citymax-cr.com
polzine.net
argos.wityu.fund
zso-mannheim.de
4net.guru
gporf.fr
partnertaxi.sk
coursio.com
cortec-neuro.com
milltimber.aberdeen.sch.uk
urist-bogatyr.ru
cranleighscoutgroup.org
mmgdouai.fr
punchbaby.com
bsaship.com
jadwalbolanet.info
harpershologram.wordpress.com
hkr-reise.de
nhadatcanho247.com
milestoneshows.com
osterberg.fi
conexa4papers.trade
hotelsolbh.com.br
aniblinova.wordpress.com
blumenhof-wegleitner.at
praxis-foerderdiagnostik.de
markelbroch.com
bauertree.com
smart-light.co.uk
qualitus.com
makeflowers.ru
raschlosser.de
pelorus.group
baronloan.org
radaradvies.nl
travelffeine.com
mirkoreisser.de
carolinepenn.com
homecomingstudio.com
boompinoy.com
lapmangfpt.info.vn
stopilhan.com
lange.host
smejump.co.th
wychowanieprzedszkolne.pl
aminaboutique247.com
restaurantesszimmer.de
elpa.se
mediaplayertest.net
dutchbrewingcoffee.com
triactis.com
dnepr-beskid.com.ua
ausair.com.au
syndikat-asphaltfieber.de
firstpaymentservices.com
pmcimpact.com
yourobgyn.net
asiluxury.com
oneplusresource.org
jolly-events.com
upplandsspar.se
figura.team
quizzingbee.com
tandartspraktijkheesch.nl
kath-kirche-gera.de
teknoz.net
maxadams.london
sloverse.com
panelsandwichmadrid.es
havecamerawilltravel2017.wordpress.com
12starhd.online
liliesandbeauties.org
skiltogprint.no
ki-lowroermond.nl
tips.technology
gonzalezfornes.es
broseller.com
denovofoodsgroup.com
ivivo.es
smartypractice.com
profectis.de
iwelt.de
physiofischer.de
boldcitydowntown.com
dr-tremel-rednitzhembach.de
tonelektro.nl
www1.proresult.no
patrickfoundation.net
pickanose.com
desert-trails.com
worldhealthbasicinfo.com
limassoldriving.com
the-domain-trader.com
itelagen.com
ecpmedia.vn
igrealestate.com
personalenhancementcenter.com
oemands.dk
thefixhut.com
summitmarketingstrategies.com
vermoote.de
xn--fnsterputssollentuna-39b.se
lusak.at
wien-mitte.co.at
heidelbergartstudio.gallery
drinkseed.com
you-bysia.com.au
adultgamezone.com
vancouver-print.ca
tophumanservicescourses.com
sahalstore.com
noskierrenteria.com
bricotienda.com
parebrise-tla.fr
tanzschule-kieber.de
sobreholanda.com
pier40forall.org
simplyblessedbykeepingitreal.com
rota-installations.co.uk
xtptrack.com
helenekowalsky.com
songunceliptv.com
parkcf.nl
xoabigail.com
takeflat.com
bargningavesta.se
iyengaryogacharlotte.com
aakritpatel.com
austinlchurch.com
ncs-graphic-studio.com
podsosnami.ru
juneauopioidworkgroup.org
aunexis.ch
boosthybrid.com.au
roygolden.com
iviaggisonciliegie.it
ausbeverage.com.au
bookspeopleplaces.com
cleliaekiko.online
waveneyrivercentre.co.uk
vibethink.net
exenberger.at
todocaracoles.com
siluet-decor.ru
tux-espacios.com
thailandholic.com
hebkft.hu
coding-machine.com
blossombeyond50.com
destinationclients.fr
ra-staudte.de
waermetauscher-berechnen.de
foryourhealth.live
ampisolabergeggi.it
ledmes.ru
verbisonline.com
promesapuertorico.com
senson.fi
allure-cosmetics.at
icpcnj.org
fitnessingbyjessica.com
kamienny-dywan24.pl
vox-surveys.com
jameskibbie.com
merzi.info
c-a.co.in
expandet.dk
seitzdruck.com
tulsawaterheaterinstallation.com
synlab.lt
montrium.com
saxtec.com
c2e-poitiers.com
hmsdanmark.dk
morawe-krueger.de
sipstroysochi.ru
mediaclan.info
devok.info
vdberg-autoimport.nl
web.ion.ag
refluxreducer.com
hashkasolutindo.com
lightair.com
simulatebrain.com
onlybacklink.com
labobit.it
leoben.at
tanciu.com
truenyc.co
echtveilig.nl
executiveairllc.com
em-gmbh.ch
zflas.com
sweering.fr
tstaffing.nl
frontierweldingllc.com
sairaku.net
alfa-stroy72.com
baustb.de
macabaneaupaysflechois.com
nativeformulas.com
slimani.net
cursoporcelanatoliquido.online
tigsltd.com
socialonemedia.com
westdeptfordbuyrite.com
123vrachi.ru
diversiapsicologia.es
kuntokeskusrok.fi
twohourswithlena.wordpress.com
mastertechengineering.com
extraordinaryoutdoors.com
littlebird.salon
pixelarttees.com
gantungankunciakrilikbandung.com
imadarchid.com
connectedace.com
theduke.de
uranus.nl
i-arslan.de
dirittosanitario.biz
no-plans.com
gratispresent.se
dsl-ip.de
sportsmassoren.com
brigitte-erler.com
cimanchesterescorts.co.uk
webhostingsrbija.rs
artotelamsterdam.com
levdittliv.se
nancy-informatique.fr
peterstrobos.com
wmiadmin.com
shhealthlaw.com
ceres.org.au
vetapharma.fr
kosterra.com
dr-pipi.de
bouldercafe-wuppertal.de
jbbjw.com
kaminscy.com
saarland-thermen-resort.com
grelot-home.com
courteney-cox.net
trulynolen.co.uk
tsklogistik.eu
ateliergamila.com
newyou.at
blog.solutionsarchitect.guru
christ-michael.net
caribbeansunpoker.com
promalaga.es
wsoil.com.sg
seminoc.com
body-armour.online
glennroberts.co.nz
x-ray.ca
ouryoungminds.wordpress.com
systemate.dk
garage-lecompte-rouen.fr
vesinhnha.com.vn
erstatningsadvokaterne.dk
sotsioloogia.ee
marketingsulweb.com
koken-voor-baby.nl
admos-gleitlager.de
bayoga.co.uk
marathonerpaolo.com
qualitaetstag.de
oceanastudios.com
aarvorg.com
tarotdeseidel.com
kmbshipping.co.uk
clos-galant.com
bigbaguettes.eu
huehnerauge-entfernen.de
fax-payday-loans.com
rebeccarisher.com
thomas-hospital.de
abogados-en-alicante.es
eraorastudio.com
corola.es
notsilentmd.org
hardinggroup.com
rksbusiness.com
calabasasdigest.com
penco.ie
otto-bollmann.de
operaslovakia.sk
1team.es
transliminaltribe.wordpress.com
myhealth.net.au
kaliber.co.jp
jobmap.at
spectrmash.ru
bridgeloanslenders.com
humancondition.com
myzk.site
minipara.com
d2marketing.co.uk
enovos.de
toreria.es
campus2day.de
aglend.com.au
mapawood.com
ziegler-praezisionsteile.de
thee.network
lecantou-coworking.com
edrcreditservices.nl
pasvenska.se
urmasiimariiuniri.ro
odiclinic.org
cirugiauretra.es
psa-sec.de
bbsmobler.se
cite4me.org
simoneblum.de
vihannesporssi.fi
oneheartwarriors.at
alvinschwartz.wordpress.com
ftf.or.at
healthyyworkout.com
quickyfunds.com
sevenadvertising.com
helikoptervluchtnewyork.nl
kojima-shihou.com
fibrofolliculoma.info
prochain-voyage.net
mrxermon.de
transportesycementoshidalgo.es
newstap.com.ng
boisehosting.net
pivoineetc.fr
precisionbevel.com
caffeinternet.it
petnest.ir
apprendrelaudit.com
comparatif-lave-linge.fr
mdk-mediadesign.de
wolf-glas-und-kunst.de
burkert-ideenreich.de
crediacces.com
veybachcenter.de
navyfederalautooverseas.com
daklesa.de
babcockchurch.org
space.ua
delawarecorporatelaw.com
ligiercenter-sachsen.de
jorgobe.at
eaglemeetstiger.de
iwr.nl
answerstest.ru
darrenkeslerministries.com
parks-nuernberg.de
starsarecircular.org
homng.net
pay4essays.net
ncid.bc.ca
aodaichandung.com
luxurytv.jp
winrace.no
pmc-services.de
highlinesouthasc.com
hokagestore.com
architecturalfiberglass.org
alten-mebel63.ru
purposeadvisorsolutions.com
spargel-kochen.de
latestmodsapks.com
ulyssemarketing.com
i-trust.dk
almosthomedogrescue.dog
durganews.com
dushka.ua
reddysbakery.com
modestmanagement.com
levihotelspa.fi
vickiegrayimages.com
chandlerpd.com
candyhouseusa.com
bafuncs.org
daniel-akermann-architektur-und-planung.ch
aco-media.nl
autodemontagenijmegen.nl
sagadc.com
norpol-yachting.com
stacyloeb.com
kindersitze-vergleich.de
thedad.com
jandaonline.com
euro-trend.pl
cyntox.com
apolomarcas.com
cuspdental.com
mytechnoway.com
brawnmediany.com
lefumetdesdombes.com
jsfg.com
dlc.berlin
iyahayki.nl
outcomeisincome.com
celularity.com
philippedebroca.com
lykkeliv.net
stoeferlehalle.de
cuppacap.com
symphonyenvironmental.com
bigasgrup.com
craigvalentineacademy.com
layrshift.eu
huissier-creteil.com
stoeberstuuv.de
cafemattmeera.com
micahkoleoso.de
lynsayshepherd.co.uk
bimnapratica.com
gmto.fr
marcuswhitten.site
iqbalscientific.com
loprus.pl
humanityplus.org
streamerzradio1.site
pocket-opera.de
centuryrs.com
psc.de
knowledgemuseumbd.com
malychanieruchomoscipremium.com
groupe-frayssinet.fr
insp.bi
kojinsaisei.info
zzyjtsgls.com
jiloc.com
tandartspraktijkhartjegroningen.nl
lorenacarnero.com
mediaacademy-iraq.org
pointos.com
drfoyle.com
accountancywijchen.nl
ctrler.cn
kisplanning.com.au
logopaedie-blomberg.de
mir-na-iznanku.com
associationanalytics.com
sachnendoc.com
jvanvlietdichter.nl
smalltownideamill.wordpress.com
vitalyscenter.es
seevilla-dr-sturm.at
comarenterprises.com
artige.com
insidegarage.pl
n1-headache.com
haremnick.com
lapinlviasennus.fi
tanzprojekt.com
sporthamper.com
remcakram.com
drugdevice.org
blogdecachorros.com
faizanullah.com
andersongilmour.co.uk
ditog.fr
marietteaernoudts.nl
pomodori-pizzeria.de
dpo-as-a-service.com
abuelos.com
rocketccw.com
global-kids.info
bradynursery.com
blgr.be
lmtprovisions.com
servicegsm.net
mooglee.com
renergysolution.com
makeurvoiceheard.com
devstyle.org
happyeasterimages.org
foretprivee.ca
yamalevents.com
fizzl.ru
jyzdesign.com
kalkulator-oszczednosci.pl
evergreen-fishing.com
jenniferandersonwriter.com
controldekk.com
shiresresidential.com
spylista.com
mardenherefordshire-pc.gov.uk
talentwunder.com
xn--thucmctc-13a1357egba.com
nicoleaeschbachorg.wordpress.com
interactcenter.org
quemargrasa.net
easytrans.com.au
mezhdu-delom.ru
vanswigchemdesign.com
parkstreetauto.net
galserwis.pl
lescomtesdemean.be
atalent.fi
lillegrandpalais.com
fundaciongregal.org
leather-factory.co.jp
sarbatkhalsafoundation.org
izzi360.com
fotoscondron.com
julis-lsa.de
rafaut.com
trackyourconstruction.com
oslomf.no
spd-ehningen.de
nachhilfe-unterricht.com
mbxvii.com
321play.com.hk
lukeshepley.wordpress.com
binder-buerotechnik.at
selfoutlet.com
xn--vrftet-pua.biz
lucidinvestbank.com
all-turtles.com
stormwall.se
pridoxmaterieel.nl
filmvideoweb.com
spinheal.ru
lebellevue.fr
testzandbakmetmening.online
8449nohate.org
aurum-juweliere.de
urclan.net
coding-marking.com
-
net
true
-
pid
$2a$10$SlLR2WWgiOxrDQLqdHYA/Or5zeu.wNuMGc5rN/HHrIObc1EkKCIZa
-
prc
agntsvc
wordpad
onenote
mydesktopqos
mydesktopservice
thunderbird
winword
excel
visio
isqlplussvc
dbeng50
encsvc
steam
mspub
firefox
outlook
dbsnmp
ocautoupds
xfssvccon
tbirdconfig
msaccess
ocomm
sqbcoreservice
sql
ocssd
oracle
infopath
synctime
thebat
powerpnt
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
3181
-
svc
svc$
backup
vss
sophos
memtas
sql
mepocs
veeam
Extracted
C:\Users\69r5t5847-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0E049F2593381959
http://decryptor.cc/0E049F2593381959
Signatures
-
Detect Neshta payload 3 IoCs
resource yara_rule behavioral1/files/0x0001000000010315-13.dat family_neshta behavioral1/memory/836-729-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/836-768-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Executes dropped EXE 1 IoCs
pid Process 3064 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe -
Loads dropped DLL 3 IoCs
pid Process 836 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe 836 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe 836 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\k51299BQXH = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3582-490\\42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe" 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\F: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\A: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\B: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\J: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\P: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\V: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\E: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\G: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\K: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\Q: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\T: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\D: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\M: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\O: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\U: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\L: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\W: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\X: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\H: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\Y: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\R: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\S: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\I: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened (read-only) \??\N: 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mrt1.bmp" 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification \??\c:\program files\WritePop.gif 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification \??\c:\program files\ReceiveUnlock.rmi 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification \??\c:\program files\PingResume.css 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification \??\c:\program files\DisconnectEdit.jfif 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification \??\c:\program files\EnterExit.php 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification \??\c:\program files\SearchUnpublish.i64 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification \??\c:\program files\RenameClose.xls 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\69r5t5847-readme.txt 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File created \??\c:\program files (x86)\69r5t5847-readme.txt 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification \??\c:\program files\RestoreFormat.jpeg 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification \??\c:\program files\SkipOut.001 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification \??\c:\program files\TestSplit.raw 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification \??\c:\program files\BackupProtect.xht 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification \??\c:\program files\ProtectShow.mpeg2 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification \??\c:\program files\AssertSave.jpeg 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3064 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe 3056 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3064 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe Token: SeDebugPrivilege 3056 powershell.exe Token: SeBackupPrivilege 1872 vssvc.exe Token: SeRestorePrivilege 1872 vssvc.exe Token: SeAuditPrivilege 1872 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 836 wrote to memory of 3064 836 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe 28 PID 836 wrote to memory of 3064 836 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe 28 PID 836 wrote to memory of 3064 836 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe 28 PID 836 wrote to memory of 3064 836 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe 28 PID 3064 wrote to memory of 3056 3064 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe 30 PID 3064 wrote to memory of 3056 3064 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe 30 PID 3064 wrote to memory of 3056 3064 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe 30 PID 3064 wrote to memory of 3056 3064 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe 30 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\3582-490\42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3056
-
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2600
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1872
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
547KB
MD5cf6c595d3e5e9667667af096762fd9c4
SHA19bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80
-
Filesize
6KB
MD509501885e7a579925bb3988a07f108f3
SHA102c704a76e4ca1255121bbfadcf9c8a3dd2af115
SHA25616815fbddce345ede9da748f8f53317297a6afb2e39e4e2b28a241de056f95b5
SHA512a05641fe43adf899ce16df7eda076f88d3593d371d403e9b701fc7ca91eec024946d51c5c93c20e7c1bf137de335bfb2ff732511ad75bb56dde8e501d1541880
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
191KB
MD5307547b1af1cc21b1c6bed2a5fdc68f7
SHA1e45cda38c434b299deff88bcd36f0cb40d0bdc34
SHA2563be521ad71165336731fdf387d8051c3e63b5984eaeeebf4dc1c03e8ec5ef478
SHA5122b9ad6c6366ba0c83f4bd440caa378ac5fe26cffe48d184c34c26ad216593f77f6c6a6e3baa342aa499c1e2a114c87a034894cbca9cb7a61511a7b7f4b83f30a
-
Filesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
Filesize
182KB
MD5dbe120d11b3601be9d102ac83dbdc449
SHA13ecf3759ed50e08a3ee6e2dc298525baac0e861f
SHA2560a16f3a7610aa43ee770d81a5324b9d7d6cbc85f9968d215ccc4bc39fe884999
SHA5125769ff54058c023800fbf25939ae528e3f4ec7145553b666af9fc73087c7dab6ec37c762daa8a5741c29ed276babbfd3d626ad457ecc4308a0e71a4a52e399a3