Analysis
-
max time kernel
145s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16-05-2024 06:49
Behavioral task
behavioral1
Sample
49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
49df499ce823e33e888b896d894fd74b
-
SHA1
0f8b3ffc457df9f8221bdc21ba426c426bd22490
-
SHA256
aa7c5e6e9e377301576f0ce37320b915d35f4c2b22eb9926f2ca5622e0fc707b
-
SHA512
5bd721b29be5523189955bb59bb50dfd03d683dbb7eff80f0036da7e205449f164a34767841edb1140aa7eba2389ab52b913b876c527dae450a4f3b2e687371f
-
SSDEEP
24576:ZMMpXS0hN0V0HzDyo1tj9E6Ehg7mM+M6RkMkIM7gE6Eh67s:Kwi0L0q7tz0g7mM+M6RkMkIM7I067s
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" MZ Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" HelpMe.exe -
Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/files/0x000d00000001227e-2.dat aspack_v212_v242 behavioral1/files/0x0037000000015406-12.dat aspack_v212_v242 behavioral1/files/0x0007000000015c93-53.dat aspack_v212_v242 -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk HelpMe.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk MZ File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk HelpMe.exe -
Executes dropped EXE 2 IoCs
pid Process 2564 HelpMe.exe 2668 MZ -
Loads dropped DLL 4 IoCs
pid Process 2196 49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe 2196 49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe 2196 49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe 2196 49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: MZ File opened (read-only) \??\L: MZ File opened (read-only) \??\M: MZ File opened (read-only) \??\B: MZ File opened (read-only) \??\J: MZ File opened (read-only) \??\Q: MZ File opened (read-only) \??\U: MZ File opened (read-only) \??\A: HelpMe.exe File opened (read-only) \??\P: HelpMe.exe File opened (read-only) \??\R: HelpMe.exe File opened (read-only) \??\Y: HelpMe.exe File opened (read-only) \??\Z: MZ File opened (read-only) \??\H: HelpMe.exe File opened (read-only) \??\O: HelpMe.exe File opened (read-only) \??\V: MZ File opened (read-only) \??\X: MZ File opened (read-only) \??\O: MZ File opened (read-only) \??\G: HelpMe.exe File opened (read-only) \??\J: HelpMe.exe File opened (read-only) \??\V: HelpMe.exe File opened (read-only) \??\K: MZ File opened (read-only) \??\T: HelpMe.exe File opened (read-only) \??\Z: HelpMe.exe File opened (read-only) \??\A: MZ File opened (read-only) \??\E: MZ File opened (read-only) \??\E: HelpMe.exe File opened (read-only) \??\I: HelpMe.exe File opened (read-only) \??\K: HelpMe.exe File opened (read-only) \??\M: HelpMe.exe File opened (read-only) \??\N: MZ File opened (read-only) \??\P: MZ File opened (read-only) \??\S: MZ File opened (read-only) \??\N: HelpMe.exe File opened (read-only) \??\Q: HelpMe.exe File opened (read-only) \??\W: HelpMe.exe File opened (read-only) \??\X: HelpMe.exe File opened (read-only) \??\T: MZ File opened (read-only) \??\W: MZ File opened (read-only) \??\L: HelpMe.exe File opened (read-only) \??\S: HelpMe.exe File opened (read-only) \??\H: MZ File opened (read-only) \??\R: MZ File opened (read-only) \??\B: HelpMe.exe File opened (read-only) \??\U: HelpMe.exe File opened (read-only) \??\I: MZ File opened (read-only) \??\Y: MZ -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\AUTORUN.INF MZ File opened for modification F:\AUTORUN.INF HelpMe.exe File opened for modification C:\AUTORUN.INF HelpMe.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\HelpMe.exe MZ File opened for modification C:\Windows\SysWOW64\HelpMe.exe 49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe File created C:\Windows\SysWOW64\notepad.exe.exe 49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe File created C:\Windows\SysWOW64\HelpMe.exe 49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe File created C:\Windows\SysWOW64\HelpMe.exe HelpMe.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe 49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2196 49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2564 2196 49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe 28 PID 2196 wrote to memory of 2564 2196 49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe 28 PID 2196 wrote to memory of 2564 2196 49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe 28 PID 2196 wrote to memory of 2564 2196 49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe 28 PID 2196 wrote to memory of 2668 2196 49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe 29 PID 2196 wrote to memory of 2668 2196 49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe 29 PID 2196 wrote to memory of 2668 2196 49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe 29 PID 2196 wrote to memory of 2668 2196 49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\HelpMe.exeC:\Windows\system32\HelpMe.exe2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
PID:2564
-
-
C:\Users\Admin\AppData\Local\Temp\MZC:\Users\Admin\AppData\Local\Temp\\MZ2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
PID:2668
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
500KB
MD5ef5dbcc9ebb9da8424ef8b23bc8a3833
SHA114e6f1f640588775850b6dfcbd5b411176d21d0c
SHA25602e4519b9e03180a92457dac30799dbe8b856045e755667f202c71882857e79c
SHA512236ab86cb2c6296705bbbd0379ac6dd50c1075bdc2017e839e9038e198382663c2c52384896ac5abeea4569acfa0533ce8eb9a47d1a8b58283051679e443aad7
-
Filesize
992B
MD56f7d124b2d61af58808509c41170a318
SHA19ae05c19fd51ebc4c43874022d4b935d407213ed
SHA2561afd12ac2e519abb863565763a0a4b7db2728c16774b12045b69620b054d7048
SHA5128fb8df4dea1df4294fcc59bfdeed3e9335a41a37768712cd56eb4e62b63a8496bcc4559f026d996e2239b2a7b89fce02302e0d6e0a0a1255a59a8bdc465f0ee1
-
Filesize
950B
MD51693bc729747584a3b30fcf3af7862be
SHA1b66380a52cef17bc7e547a280244562cba1634cc
SHA2568a1ad8fe0bf6424e236f9b649d763191e483ecfea333ae83f8817756f2d7079c
SHA512003894e0a91aecc092ae7853db1fb96f55107f40d4023ab4a77b8a336c186a5fdeeb585db3e9c3586d813e3187e378e29daa050c343b00271ccf1ebb93562c6e
-
Filesize
145B
MD5ca13857b2fd3895a39f09d9dde3cca97
SHA18b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA256cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
SHA51255e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
-
Filesize
1.1MB
MD549df499ce823e33e888b896d894fd74b
SHA10f8b3ffc457df9f8221bdc21ba426c426bd22490
SHA256aa7c5e6e9e377301576f0ce37320b915d35f4c2b22eb9926f2ca5622e0fc707b
SHA5125bd721b29be5523189955bb59bb50dfd03d683dbb7eff80f0036da7e205449f164a34767841edb1140aa7eba2389ab52b913b876c527dae450a4f3b2e687371f
-
Filesize
500KB
MD51b24107c65331bd345824657e63ac30b
SHA19dcc11e7252488266d4e3f0a6f91b9bd5ab7f7a4
SHA25650e25be03315cf2f0c4d7f193d092dde70128b3d2ad7dfb601357cbf1d922855
SHA51258b11ab4ce4f7153f499e7b11530d4661f669e245c079dc8ea36268e812c933cd6020d70dce4b0b7a2e4c356fb0577cf39de848da1de6252982eaf0080ac888b