Analysis
-
max time kernel
120s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 08:56
Static task
static1
Behavioral task
behavioral1
Sample
5e39796740d470869174eaecd70706af_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5e39796740d470869174eaecd70706af_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
5e39796740d470869174eaecd70706af_JaffaCakes118.exe
-
Size
504KB
-
MD5
5e39796740d470869174eaecd70706af
-
SHA1
76afe1f1de09e25adcbf675f68b2b0370ad37aac
-
SHA256
f93057ea3b4ac606408e145b212d5b257744920dde857e0f3ced57520c22a8fb
-
SHA512
5b48dacb64f3373121a83aedef476854db2331533fe28f98f50b6128b7f22a0c25bf2a497daccb3662b7d6872f1a3e4156b1e3e4edf2da19d35aa63c99e3af25
-
SSDEEP
6144:c867hSKXt8UaTxPMhvXoIdUbYgiE9ZrH16Ov1rN2s4JI/yUICVL8VfaDCFToWQH:y7G5xP+L6kZE9VV6O1MUgfaOzQH
Malware Config
Extracted
C:\Users\Admin\Desktop\_READ_THIS_FILE_1CWOQW_.txt
http://p27dokhpz2n7nvgr.onion/9AC1-4B1F-CB72-0446-9A8E
http://p27dokhpz2n7nvgr.1a7wnt.top/9AC1-4B1F-CB72-0446-9A8E
http://p27dokhpz2n7nvgr.1czh7o.top/9AC1-4B1F-CB72-0446-9A8E
http://p27dokhpz2n7nvgr.1hpvzl.top/9AC1-4B1F-CB72-0446-9A8E
http://p27dokhpz2n7nvgr.1pglcs.top/9AC1-4B1F-CB72-0446-9A8E
http://p27dokhpz2n7nvgr.1cewld.top/9AC1-4B1F-CB72-0446-9A8E
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Blocklisted process makes network request 5 IoCs
Processes:
mshta.exeflow pid process 2180 1608 mshta.exe 2184 1608 mshta.exe 2186 1608 mshta.exe 2188 1608 mshta.exe 2190 1608 mshta.exe -
Contacts a large (1095) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 3008 netsh.exe 2660 netsh.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2504 cmd.exe -
Drops file in System32 directory 38 IoCs
Processes:
5e39796740d470869174eaecd70706af_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook 5e39796740d470869174eaecd70706af_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
5e39796740d470869174eaecd70706af_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp447F.bmp" 5e39796740d470869174eaecd70706af_JaffaCakes118.exe -
Drops file in Program Files directory 20 IoCs
Processes:
5e39796740d470869174eaecd70706af_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\program files (x86)\powerpoint 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\word 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\program files\ 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\bitcoin 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\outlook 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\ 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\office 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\word 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\office 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\steam 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\excel 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\onenote 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\the bat! 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\thunderbird 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 5e39796740d470869174eaecd70706af_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
5e39796740d470869174eaecd70706af_JaffaCakes118.exedescription ioc process File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\ 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam 5e39796740d470869174eaecd70706af_JaffaCakes118.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote 5e39796740d470869174eaecd70706af_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1108 taskkill.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 1572 NOTEPAD.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5e39796740d470869174eaecd70706af_JaffaCakes118.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 108 5e39796740d470869174eaecd70706af_JaffaCakes118.exe Token: SeDebugPrivilege 1108 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
DllHost.exepid process 2376 DllHost.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
5e39796740d470869174eaecd70706af_JaffaCakes118.execmd.exedescription pid process target process PID 108 wrote to memory of 3008 108 5e39796740d470869174eaecd70706af_JaffaCakes118.exe netsh.exe PID 108 wrote to memory of 3008 108 5e39796740d470869174eaecd70706af_JaffaCakes118.exe netsh.exe PID 108 wrote to memory of 3008 108 5e39796740d470869174eaecd70706af_JaffaCakes118.exe netsh.exe PID 108 wrote to memory of 3008 108 5e39796740d470869174eaecd70706af_JaffaCakes118.exe netsh.exe PID 108 wrote to memory of 2660 108 5e39796740d470869174eaecd70706af_JaffaCakes118.exe netsh.exe PID 108 wrote to memory of 2660 108 5e39796740d470869174eaecd70706af_JaffaCakes118.exe netsh.exe PID 108 wrote to memory of 2660 108 5e39796740d470869174eaecd70706af_JaffaCakes118.exe netsh.exe PID 108 wrote to memory of 2660 108 5e39796740d470869174eaecd70706af_JaffaCakes118.exe netsh.exe PID 108 wrote to memory of 1608 108 5e39796740d470869174eaecd70706af_JaffaCakes118.exe mshta.exe PID 108 wrote to memory of 1608 108 5e39796740d470869174eaecd70706af_JaffaCakes118.exe mshta.exe PID 108 wrote to memory of 1608 108 5e39796740d470869174eaecd70706af_JaffaCakes118.exe mshta.exe PID 108 wrote to memory of 1608 108 5e39796740d470869174eaecd70706af_JaffaCakes118.exe mshta.exe PID 108 wrote to memory of 1572 108 5e39796740d470869174eaecd70706af_JaffaCakes118.exe NOTEPAD.EXE PID 108 wrote to memory of 1572 108 5e39796740d470869174eaecd70706af_JaffaCakes118.exe NOTEPAD.EXE PID 108 wrote to memory of 1572 108 5e39796740d470869174eaecd70706af_JaffaCakes118.exe NOTEPAD.EXE PID 108 wrote to memory of 1572 108 5e39796740d470869174eaecd70706af_JaffaCakes118.exe NOTEPAD.EXE PID 108 wrote to memory of 2504 108 5e39796740d470869174eaecd70706af_JaffaCakes118.exe cmd.exe PID 108 wrote to memory of 2504 108 5e39796740d470869174eaecd70706af_JaffaCakes118.exe cmd.exe PID 108 wrote to memory of 2504 108 5e39796740d470869174eaecd70706af_JaffaCakes118.exe cmd.exe PID 108 wrote to memory of 2504 108 5e39796740d470869174eaecd70706af_JaffaCakes118.exe cmd.exe PID 2504 wrote to memory of 1108 2504 cmd.exe taskkill.exe PID 2504 wrote to memory of 1108 2504 cmd.exe taskkill.exe PID 2504 wrote to memory of 1108 2504 cmd.exe taskkill.exe PID 2504 wrote to memory of 1108 2504 cmd.exe taskkill.exe PID 2504 wrote to memory of 1152 2504 cmd.exe PING.EXE PID 2504 wrote to memory of 1152 2504 cmd.exe PING.EXE PID 2504 wrote to memory of 1152 2504 cmd.exe PING.EXE PID 2504 wrote to memory of 1152 2504 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e39796740d470869174eaecd70706af_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5e39796740d470869174eaecd70706af_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_READ_THIS_FILE_RLGL4_.hta"2⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_READ_THIS_FILE_1CWOQW_.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "5e39796740d470869174eaecd70706af_JaffaCakes118.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Cab62EA.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar62FC.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\Desktop\_READ_THIS_FILE_1CWOQW_.txtFilesize
1KB
MD54b8dd5c665b33e0e7c9e3af7af7739eb
SHA146f875ee81556d86b2b38621a9cc678fffcc0cce
SHA2562fff97a380288524175d428329259fa1439ebd99bf3701fec5b42a79435c2ba5
SHA5129014979e8fed3627efcf07e87322b646a68f7e6edce93ca2801f2e042b9d8fbd106a46549520ddab9763b4dfc0ce3ba6f5ff464e0b4a964eacccef00c9d864c6
-
C:\Users\Admin\Desktop\_READ_THIS_FILE_DYYC3Q3_.jpegFilesize
150KB
MD5a1b425c6faf4f89b84d0f904e32f09b4
SHA1bc8c8d2b1192eb791042d50475022f20534a7742
SHA256b7db21726b8840a94bb197996df0523e512d73db7b0101c3a935dc163c19f17a
SHA51258ba2d33d1b8b9f79246016447a8d2667b25638d4b2573b480a29167450bc864d1f1db1b1f40683dda28f1b2792107878e12b4d4c57c0da35bdb323ac2e71fc3
-
C:\Users\Admin\Desktop\_READ_THIS_FILE_RLGL4_.htaFilesize
74KB
MD54de51fc221a1d71ced51dc5c0fa58c3a
SHA166167fd73869f4c8211460ffbc8337a17bed330d
SHA25624cb8ff225a7bb68369b603cccfb60c87412c39395994412df017a8378e18597
SHA51224e5a462c979d8c738cd7048ec36628cda2338507ff2afe44e80c5686c21686fbec3cdb549352a5ea1ae78f813ca4e43c65ea31d611b4eabab9d0b87d41841fd
-
memory/108-89-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/108-0-0x0000000002580000-0x00000000025FB000-memory.dmpFilesize
492KB
-
memory/108-6-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/108-4-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/108-96-0x0000000009C00000-0x0000000009C02000-memory.dmpFilesize
8KB
-
memory/108-3-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/108-2-0x0000000002580000-0x00000000025FB000-memory.dmpFilesize
492KB
-
memory/108-1-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/108-294-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/2376-97-0x0000000000160000-0x0000000000162000-memory.dmpFilesize
8KB