Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 06:56
Behavioral task
behavioral1
Sample
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe
-
Size
336KB
-
MD5
591ad86e048de0e146e95de06cde9086
-
SHA1
743932fdb8c94eed98a5b1b1f134de8d8f8f12c6
-
SHA256
08bceaa70981fe11a2cd2f4d24475bcc692b577f1747c092fb10b6bc20a5e1c0
-
SHA512
e3fb3f7a85a6c49318b012834c8e7daf2a8abf782d5687d956eeec9b45ac2e63b5e94631ae9ebdb2ae3545a5ae1ef8042abbdb461c0be35891541e4a3912efa9
-
SSDEEP
6144:1t75WZK9JIwfCQoSZxEGBN9WguHB19cJAkcsAu86FzUqyfDgO9/UGEXx4:/lWaIeDoSLpBOhHB19cJAkcst86FzULX
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_READ_THI$_FILE_84LQ1V_.hta
cerber
Extracted
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_READ_THI$_FILE_IWD6SG2_.txt
http://p27dokhpz2n7nvgr.onion/C167-D458-6DF8-0446-9F9E
http://p27dokhpz2n7nvgr.1czh7o.top/C167-D458-6DF8-0446-9F9E
http://p27dokhpz2n7nvgr.1hpvzl.top/C167-D458-6DF8-0446-9F9E
http://p27dokhpz2n7nvgr.1pglcs.top/C167-D458-6DF8-0446-9F9E
http://p27dokhpz2n7nvgr.1cewld.top/C167-D458-6DF8-0446-9F9E
http://p27dokhpz2n7nvgr.1js3tl.top/C167-D458-6DF8-0446-9F9E
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (1104) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 2708 netsh.exe 4388 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe -
Drops startup file 1 IoCs
Processes:
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral2/memory/760-0-0x0000000000EA0000-0x0000000000EF1000-memory.dmp upx behavioral2/memory/4112-4-0x0000000000EA0000-0x0000000000EF1000-memory.dmp upx behavioral2/memory/760-6-0x0000000000EA0000-0x0000000000EF1000-memory.dmp upx -
Drops file in System32 directory 38 IoCs
Processes:
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp8CDE.bmp" 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exedescription pid process target process PID 760 set thread context of 4112 760 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe -
Drops file in Program Files directory 20 IoCs
Processes:
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\program files (x86)\bitcoin 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files\ 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\steam 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\the bat! 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\thunderbird 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\ 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\ 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2468 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exeAUDIODG.EXEtaskkill.exedescription pid process Token: SeShutdownPrivilege 4112 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 4112 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe Token: 33 4084 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4084 AUDIODG.EXE Token: SeDebugPrivilege 2468 taskkill.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe591ad86e048de0e146e95de06cde9086_JaffaCakes118.execmd.exedescription pid process target process PID 760 wrote to memory of 4112 760 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe PID 760 wrote to memory of 4112 760 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe PID 760 wrote to memory of 4112 760 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe PID 760 wrote to memory of 4112 760 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe PID 760 wrote to memory of 4112 760 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe PID 760 wrote to memory of 4112 760 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe PID 760 wrote to memory of 4112 760 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe PID 760 wrote to memory of 4112 760 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe PID 760 wrote to memory of 4112 760 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe PID 760 wrote to memory of 4112 760 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe PID 4112 wrote to memory of 2708 4112 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe netsh.exe PID 4112 wrote to memory of 2708 4112 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe netsh.exe PID 4112 wrote to memory of 2708 4112 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe netsh.exe PID 4112 wrote to memory of 4388 4112 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe netsh.exe PID 4112 wrote to memory of 4388 4112 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe netsh.exe PID 4112 wrote to memory of 4388 4112 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe netsh.exe PID 4112 wrote to memory of 5076 4112 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe mshta.exe PID 4112 wrote to memory of 5076 4112 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe mshta.exe PID 4112 wrote to memory of 5076 4112 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe mshta.exe PID 4112 wrote to memory of 3248 4112 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe NOTEPAD.EXE PID 4112 wrote to memory of 3248 4112 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe NOTEPAD.EXE PID 4112 wrote to memory of 3248 4112 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe NOTEPAD.EXE PID 4112 wrote to memory of 3012 4112 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe cmd.exe PID 4112 wrote to memory of 3012 4112 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe cmd.exe PID 4112 wrote to memory of 3012 4112 591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe cmd.exe PID 3012 wrote to memory of 2468 3012 cmd.exe taskkill.exe PID 3012 wrote to memory of 2468 3012 cmd.exe taskkill.exe PID 3012 wrote to memory of 2468 3012 cmd.exe taskkill.exe PID 3012 wrote to memory of 4704 3012 cmd.exe PING.EXE PID 3012 wrote to memory of 4704 3012 cmd.exe PING.EXE PID 3012 wrote to memory of 4704 3012 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_READ_THI$_FILE_HES9NE1_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_READ_THI$_FILE_E4WXUG_.txt3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "591ad86e048de0e146e95de06cde9086_JaffaCakes118.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x384 0x4701⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_READ_THI$_FILE_IWD6SG2_.txtFilesize
1KB
MD59120dfe0242cee9d1754f1a8935dee30
SHA1da43a5c78be202b2856a806c6cc3c78aca695017
SHA256d7cc6cfcbc37b31cad39c3a665e1130c47ddd7c68629632b3dac7b0db6690a3e
SHA5122d4da287e4403bc557a668ea0f1049c34eecd4c81d7de93afb37d83c42ef95228926ead82d5b199ccefe5266adf2d7626650d223a4da081fce1df0badd29a57e
-
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_READ_THI$_FILE_TYJ31_.jpegFilesize
150KB
MD5e2afd1a5a0cee190835f99683c581f80
SHA12088d1a1fe541dfa4d725ae8a6d348d87176ea8f
SHA256a2ae9ffcd5f13c97041f0e9676fae00c27c22f872ece1a016aaf2880c6f123d5
SHA5122acc1c646fd2077a8f838a8c17839eb4661d3cbc213266be600a8d25d4ac118db44b1efd099cc7dda34e05ba8b7552d19f41f9c47146033933773092b3fab9b2
-
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_READ_THI$_FILE_84LQ1V_.htaFilesize
75KB
MD5ce967bd7b4a5b7e281a59882cc195956
SHA1356f218bf6ebfcec03c8f8b852fe191a0b6ca7f9
SHA25600ee139c95f16414f0e1f0196e2432f5250c5d6518a1d282f35c7e746136cc68
SHA512ad8d7e415107c358df69bf273e3d638514768fce552df836bb7c8eccd0b76304c4d0366446887b790db77f46ed09a3c5a983c98cbd9ed2b34ee183bbf84c4699
-
memory/760-6-0x0000000000EA0000-0x0000000000EF1000-memory.dmpFilesize
324KB
-
memory/760-0-0x0000000000EA0000-0x0000000000EF1000-memory.dmpFilesize
324KB
-
memory/4112-4-0x0000000000EA0000-0x0000000000EF1000-memory.dmpFilesize
324KB
-
memory/4112-7-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4112-10-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4112-14-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4112-1-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4112-5-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4112-3-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4112-384-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4112-412-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4112-413-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB