Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 12:57
Static task
static1
Behavioral task
behavioral1
Sample
54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Crypto.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Crypto.dll
Resource
win10v2004-20240508-en
General
-
Target
54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe
-
Size
240KB
-
MD5
54d105a742ae07f7f55d30738a7b014f
-
SHA1
a36767f17476133be1529e832b2be11a4cb8ee6c
-
SHA256
c36a3c1d92892fb3fc4d8cba4e5f55fb4f027a0e61b351eee3c343a9cdbcd723
-
SHA512
972fed4bece6945527a450f43a39f1ca2a339fdbe9782ddd73cef5c71b217d0a54fb90e0ef2b53f3ed4cc6262548e2da47cee781378e542dfe1f10453cc3214b
-
SSDEEP
6144:Yn/L+VE11MHqeo1k5b2LDkTbuD4VDwjc3/r+:uaE1CF0moAnubjc3/r+
Malware Config
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Contacts a large (528) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Loads dropped DLL 4 IoCs
Processes:
54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exepid process 4764 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe 4764 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe 4764 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe 4764 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exedescription pid process target process PID 4764 set thread context of 4856 4764 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
Processes:
54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\ 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exepid process 4856 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe 4856 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe 4856 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe 4856 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe 4856 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe 4856 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exeWMIC.exevssvc.exedescription pid process Token: SeDebugPrivilege 4856 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 720 WMIC.exe Token: SeSecurityPrivilege 720 WMIC.exe Token: SeTakeOwnershipPrivilege 720 WMIC.exe Token: SeLoadDriverPrivilege 720 WMIC.exe Token: SeSystemProfilePrivilege 720 WMIC.exe Token: SeSystemtimePrivilege 720 WMIC.exe Token: SeProfSingleProcessPrivilege 720 WMIC.exe Token: SeIncBasePriorityPrivilege 720 WMIC.exe Token: SeCreatePagefilePrivilege 720 WMIC.exe Token: SeBackupPrivilege 720 WMIC.exe Token: SeRestorePrivilege 720 WMIC.exe Token: SeShutdownPrivilege 720 WMIC.exe Token: SeDebugPrivilege 720 WMIC.exe Token: SeSystemEnvironmentPrivilege 720 WMIC.exe Token: SeRemoteShutdownPrivilege 720 WMIC.exe Token: SeUndockPrivilege 720 WMIC.exe Token: SeManageVolumePrivilege 720 WMIC.exe Token: 33 720 WMIC.exe Token: 34 720 WMIC.exe Token: 35 720 WMIC.exe Token: 36 720 WMIC.exe Token: SeIncreaseQuotaPrivilege 720 WMIC.exe Token: SeSecurityPrivilege 720 WMIC.exe Token: SeTakeOwnershipPrivilege 720 WMIC.exe Token: SeLoadDriverPrivilege 720 WMIC.exe Token: SeSystemProfilePrivilege 720 WMIC.exe Token: SeSystemtimePrivilege 720 WMIC.exe Token: SeProfSingleProcessPrivilege 720 WMIC.exe Token: SeIncBasePriorityPrivilege 720 WMIC.exe Token: SeCreatePagefilePrivilege 720 WMIC.exe Token: SeBackupPrivilege 720 WMIC.exe Token: SeRestorePrivilege 720 WMIC.exe Token: SeShutdownPrivilege 720 WMIC.exe Token: SeDebugPrivilege 720 WMIC.exe Token: SeSystemEnvironmentPrivilege 720 WMIC.exe Token: SeRemoteShutdownPrivilege 720 WMIC.exe Token: SeUndockPrivilege 720 WMIC.exe Token: SeManageVolumePrivilege 720 WMIC.exe Token: 33 720 WMIC.exe Token: 34 720 WMIC.exe Token: 35 720 WMIC.exe Token: 36 720 WMIC.exe Token: SeBackupPrivilege 2436 vssvc.exe Token: SeRestorePrivilege 2436 vssvc.exe Token: SeAuditPrivilege 2436 vssvc.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.execmd.exedescription pid process target process PID 4764 wrote to memory of 4856 4764 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe PID 4764 wrote to memory of 4856 4764 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe PID 4764 wrote to memory of 4856 4764 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe PID 4764 wrote to memory of 4856 4764 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe PID 4764 wrote to memory of 4856 4764 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe PID 4764 wrote to memory of 4856 4764 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe PID 4764 wrote to memory of 4856 4764 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe PID 4764 wrote to memory of 4856 4764 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe PID 4764 wrote to memory of 4856 4764 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe PID 4764 wrote to memory of 4856 4764 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe PID 4856 wrote to memory of 3764 4856 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe cmd.exe PID 4856 wrote to memory of 3764 4856 54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe cmd.exe PID 3764 wrote to memory of 720 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 720 3764 cmd.exe WMIC.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic.exe shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3944 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsqDFBD.tmp\System.dllFilesize
11KB
MD5a436db0c473a087eb61ff5c53c34ba27
SHA165ea67e424e75f5065132b539c8b2eda88aa0506
SHA25675ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
SHA512908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d
-
C:\Users\Admin\AppData\Roaming\Crypto.dllFilesize
11KB
MD5d7abc2b77ed9178f00c2bef667a988da
SHA166f2f2ea1161f2f48b5df3a49fd3e43651642237
SHA2568708aad9e59923e1b7830e763c5a42107449a378a6f355d46d58e8c85e44f8d2
SHA5120dc6b4719ad872402573960f6be6e14f80cd5a000d240bd7a171d625833eac2c9c6d44e1c145d5d28b6dc4a4920174f2c19f76efa1f3d33ecca59994f6ec324f
-
memory/4764-24-0x00000000022A0000-0x00000000022AC000-memory.dmpFilesize
48KB
-
memory/4856-23-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4856-26-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4856-29-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4856-34-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4856-35-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4856-36-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB