Analysis
-
max time kernel
117s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 06:56
Behavioral task
behavioral1
Sample
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe
-
Size
336KB
-
MD5
591ad86e048de0e146e95de06cde9086
-
SHA1
743932fdb8c94eed98a5b1b1f134de8d8f8f12c6
-
SHA256
08bceaa70981fe11a2cd2f4d24475bcc692b577f1747c092fb10b6bc20a5e1c0
-
SHA512
e3fb3f7a85a6c49318b012834c8e7daf2a8abf782d5687d956eeec9b45ac2e63b5e94631ae9ebdb2ae3545a5ae1ef8042abbdb461c0be35891541e4a3912efa9
-
SSDEEP
6144:1t75WZK9JIwfCQoSZxEGBN9WguHB19cJAkcsAu86FzUqyfDgO9/UGEXx4:/lWaIeDoSLpBOhHB19cJAkcst86FzULX
Malware Config
Extracted
C:\Users\Admin\Desktop\_READ_THI$_FILE_WK62VB_.txt
http://p27dokhpz2n7nvgr.onion/2BB4-4D0D-1F50-0446-93CF
http://p27dokhpz2n7nvgr.1czh7o.top/2BB4-4D0D-1F50-0446-93CF
http://p27dokhpz2n7nvgr.1hpvzl.top/2BB4-4D0D-1F50-0446-93CF
http://p27dokhpz2n7nvgr.1pglcs.top/2BB4-4D0D-1F50-0446-93CF
http://p27dokhpz2n7nvgr.1cewld.top/2BB4-4D0D-1F50-0446-93CF
http://p27dokhpz2n7nvgr.1js3tl.top/2BB4-4D0D-1F50-0446-93CF
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Blocklisted process makes network request 7 IoCs
Processes:
mshta.exeflow pid process 2180 1276 mshta.exe 2184 1276 mshta.exe 2186 1276 mshta.exe 2189 1276 mshta.exe 2191 1276 mshta.exe 2193 1276 mshta.exe 2195 1276 mshta.exe -
Contacts a large (1096) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 2980 netsh.exe 3008 netsh.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1104 cmd.exe -
Processes:
resource yara_rule behavioral1/memory/1960-0-0x0000000000100000-0x0000000000151000-memory.dmp upx behavioral1/memory/1960-6-0x0000000000100000-0x0000000000151000-memory.dmp upx -
Drops file in System32 directory 38 IoCs
Processes:
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp28E4.bmp" 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exedescription pid process target process PID 1960 set thread context of 2316 1960 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe -
Drops file in Program Files directory 20 IoCs
Processes:
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\program files (x86)\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files\ 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\bitcoin 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\the bat! 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\thunderbird 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\ 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\steam 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\ 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1160 taskkill.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C mshta.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 mshta.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 mshta.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 2316 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe Token: SeDebugPrivilege 1160 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
DllHost.exepid process 2824 DllHost.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe591ad86e048de0e146e95de06cde9086_JaffaCakes118.execmd.exedescription pid process target process PID 1960 wrote to memory of 2316 1960 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe PID 1960 wrote to memory of 2316 1960 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe PID 1960 wrote to memory of 2316 1960 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe PID 1960 wrote to memory of 2316 1960 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe PID 1960 wrote to memory of 2316 1960 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe PID 1960 wrote to memory of 2316 1960 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe PID 1960 wrote to memory of 2316 1960 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe PID 1960 wrote to memory of 2316 1960 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe PID 1960 wrote to memory of 2316 1960 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe PID 1960 wrote to memory of 2316 1960 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe PID 1960 wrote to memory of 2316 1960 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe PID 2316 wrote to memory of 2980 2316 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe netsh.exe PID 2316 wrote to memory of 2980 2316 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe netsh.exe PID 2316 wrote to memory of 2980 2316 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe netsh.exe PID 2316 wrote to memory of 2980 2316 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe netsh.exe PID 2316 wrote to memory of 3008 2316 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe netsh.exe PID 2316 wrote to memory of 3008 2316 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe netsh.exe PID 2316 wrote to memory of 3008 2316 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe netsh.exe PID 2316 wrote to memory of 3008 2316 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe netsh.exe PID 2316 wrote to memory of 1276 2316 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe mshta.exe PID 2316 wrote to memory of 1276 2316 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe mshta.exe PID 2316 wrote to memory of 1276 2316 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe mshta.exe PID 2316 wrote to memory of 1276 2316 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe mshta.exe PID 2316 wrote to memory of 2508 2316 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe NOTEPAD.EXE PID 2316 wrote to memory of 2508 2316 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe NOTEPAD.EXE PID 2316 wrote to memory of 2508 2316 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe NOTEPAD.EXE PID 2316 wrote to memory of 2508 2316 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe NOTEPAD.EXE PID 2316 wrote to memory of 1104 2316 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe cmd.exe PID 2316 wrote to memory of 1104 2316 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe cmd.exe PID 2316 wrote to memory of 1104 2316 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe cmd.exe PID 2316 wrote to memory of 1104 2316 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe cmd.exe PID 1104 wrote to memory of 1160 1104 cmd.exe taskkill.exe PID 1104 wrote to memory of 1160 1104 cmd.exe taskkill.exe PID 1104 wrote to memory of 1160 1104 cmd.exe taskkill.exe PID 1104 wrote to memory of 1160 1104 cmd.exe taskkill.exe PID 1104 wrote to memory of 1056 1104 cmd.exe PING.EXE PID 1104 wrote to memory of 1056 1104 cmd.exe PING.EXE PID 1104 wrote to memory of 1056 1104 cmd.exe PING.EXE PID 1104 wrote to memory of 1056 1104 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe"2⤵
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_READ_THI$_FILE_YTFK9ZAO_.hta"3⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Modifies system certificate store
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_READ_THI$_FILE_WK62VB_.txt3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD54a12de8e94e0d01fca39a20e0255b7e3
SHA15b8323173e44dc048e2fe41f8e85d91ec6695edb
SHA256b2b43fc6193245b67fcde5825c442b4254a44bc91081e680ac19e2b43152faf2
SHA512a4634c4ea1c1cb2dcd7dcff8541bdfca64879ddab83388672aad91364e075dbb8c48f730d74dd759fffcf258a472a603a1319433cd57fabbd0232db66216d7c7
-
C:\Users\Admin\AppData\Local\Temp\Tar4945.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\Desktop\_READ_THI$_FILE_WK62VB_.txtFilesize
1KB
MD5c918976ebe8278ab0d80b71febb90b80
SHA1b3a5cf8e10e6e8402212c7dfca327b3f91310d44
SHA256cb44a7500f8322698466291e1509324416107402fa7bca7430f048f903d733a9
SHA512fa387c68909b27c179ad5e69290ae03115817b6c4bd88a1c4b1cac828ddad7c4ad965cee71ed9fa7d0ae53fc3e6ae3ea9c3639d909547d6670f051302c5877d0
-
C:\Users\Admin\Desktop\_READ_THI$_FILE_YTFK9ZAO_.htaFilesize
75KB
MD55e3db41cb512dd5a6710bc1435b3f2cd
SHA1ace89790d9883198dd72990b8abfe857aac0b574
SHA25662d01b774d28ea29c0c19b7e267fa594a73af4768c5bbdc0e2fa5fed3aecc4bf
SHA51207e33e9aa87558ad07d50c4e4e4c02047774677bd9a45a3d1f1bf4e47d4df59301ed625ae2d08e61280b84262ca145e51572cc30370ee100556fd7d129de8015
-
C:\Users\Admin\Desktop\_READ_THI$_FILE_ZF2Y_.jpegFilesize
150KB
MD50bc9727cff24c794f2fe1f0b67290ad1
SHA128c81dd39c37bbaf20a32374823089f18deca063
SHA256f192849042ee602d944cdc3ace78998bec25d813d964fa29355ab88431b9d441
SHA5125022509114c2df316736c77dd51011a59c16109044f52397e3740d3b48e2f179f09205616b9931b1b45725013ee155db67f8ef61990d803da309b350c69f390e
-
memory/1960-6-0x0000000000100000-0x0000000000151000-memory.dmpFilesize
324KB
-
memory/1960-0-0x0000000000100000-0x0000000000151000-memory.dmpFilesize
324KB
-
memory/1960-4-0x00000000004B0000-0x0000000000501000-memory.dmpFilesize
324KB
-
memory/2316-3-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2316-92-0x0000000002840000-0x0000000002842000-memory.dmpFilesize
8KB
-
memory/2316-12-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2316-7-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2316-63-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2316-1-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2316-10-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2316-14-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2316-5-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2316-363-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2824-93-0x0000000000180000-0x0000000000182000-memory.dmpFilesize
8KB