Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 20:38
Static task
static1
Behavioral task
behavioral1
Sample
64afe55adefb842826b08effa0af8094_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
64afe55adefb842826b08effa0af8094_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
NsResize.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
NsResize.dll
Resource
win10v2004-20240508-en
General
-
Target
64afe55adefb842826b08effa0af8094_JaffaCakes118.exe
-
Size
241KB
-
MD5
64afe55adefb842826b08effa0af8094
-
SHA1
9f324e8a2f55360667263c1aa0e3f37eb9b43195
-
SHA256
b3c36cbbaf27bc03e3c6d892565d18a46918b87ee4112dbbef108dafd17cd3ec
-
SHA512
de8817fa1deb07d56922d684d2d350378a84e1798bbbc21d7a9624e63161c4a07ab1337d293e36280068fcaeb19e570524525aa5dd53c6f24d8a2d384536cf4b
-
SSDEEP
6144:Kn/L+GOmXqA8VtR4ZhSTpkdpNRauPmuRfV/A/ETrSQ1tM:0zOmXqActRYhgk5Ra6mkflTrSh
Malware Config
Extracted
C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\README.hta
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Contacts a large (512) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Loads dropped DLL 3 IoCs
Processes:
64afe55adefb842826b08effa0af8094_JaffaCakes118.exepid process 1968 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1968 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1968 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
64afe55adefb842826b08effa0af8094_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpED0D.bmp" 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
64afe55adefb842826b08effa0af8094_JaffaCakes118.exedescription pid process target process PID 1968 set thread context of 2520 1968 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe -
Drops file in Program Files directory 6 IoCs
Processes:
64afe55adefb842826b08effa0af8094_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\README.hta 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
64afe55adefb842826b08effa0af8094_JaffaCakes118.exepid process 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
Processes:
64afe55adefb842826b08effa0af8094_JaffaCakes118.exeWMIC.exevssvc.exedescription pid process Token: SeDebugPrivilege 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2400 WMIC.exe Token: SeSecurityPrivilege 2400 WMIC.exe Token: SeTakeOwnershipPrivilege 2400 WMIC.exe Token: SeLoadDriverPrivilege 2400 WMIC.exe Token: SeSystemProfilePrivilege 2400 WMIC.exe Token: SeSystemtimePrivilege 2400 WMIC.exe Token: SeProfSingleProcessPrivilege 2400 WMIC.exe Token: SeIncBasePriorityPrivilege 2400 WMIC.exe Token: SeCreatePagefilePrivilege 2400 WMIC.exe Token: SeBackupPrivilege 2400 WMIC.exe Token: SeRestorePrivilege 2400 WMIC.exe Token: SeShutdownPrivilege 2400 WMIC.exe Token: SeDebugPrivilege 2400 WMIC.exe Token: SeSystemEnvironmentPrivilege 2400 WMIC.exe Token: SeRemoteShutdownPrivilege 2400 WMIC.exe Token: SeUndockPrivilege 2400 WMIC.exe Token: SeManageVolumePrivilege 2400 WMIC.exe Token: 33 2400 WMIC.exe Token: 34 2400 WMIC.exe Token: 35 2400 WMIC.exe Token: SeIncreaseQuotaPrivilege 2400 WMIC.exe Token: SeSecurityPrivilege 2400 WMIC.exe Token: SeTakeOwnershipPrivilege 2400 WMIC.exe Token: SeLoadDriverPrivilege 2400 WMIC.exe Token: SeSystemProfilePrivilege 2400 WMIC.exe Token: SeSystemtimePrivilege 2400 WMIC.exe Token: SeProfSingleProcessPrivilege 2400 WMIC.exe Token: SeIncBasePriorityPrivilege 2400 WMIC.exe Token: SeCreatePagefilePrivilege 2400 WMIC.exe Token: SeBackupPrivilege 2400 WMIC.exe Token: SeRestorePrivilege 2400 WMIC.exe Token: SeShutdownPrivilege 2400 WMIC.exe Token: SeDebugPrivilege 2400 WMIC.exe Token: SeSystemEnvironmentPrivilege 2400 WMIC.exe Token: SeRemoteShutdownPrivilege 2400 WMIC.exe Token: SeUndockPrivilege 2400 WMIC.exe Token: SeManageVolumePrivilege 2400 WMIC.exe Token: 33 2400 WMIC.exe Token: 34 2400 WMIC.exe Token: 35 2400 WMIC.exe Token: SeBackupPrivilege 2500 vssvc.exe Token: SeRestorePrivilege 2500 vssvc.exe Token: SeAuditPrivilege 2500 vssvc.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
64afe55adefb842826b08effa0af8094_JaffaCakes118.exe64afe55adefb842826b08effa0af8094_JaffaCakes118.execmd.exedescription pid process target process PID 1968 wrote to memory of 2520 1968 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe PID 1968 wrote to memory of 2520 1968 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe PID 1968 wrote to memory of 2520 1968 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe PID 1968 wrote to memory of 2520 1968 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe PID 1968 wrote to memory of 2520 1968 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe PID 1968 wrote to memory of 2520 1968 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe PID 1968 wrote to memory of 2520 1968 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe PID 1968 wrote to memory of 2520 1968 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe PID 1968 wrote to memory of 2520 1968 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe PID 1968 wrote to memory of 2520 1968 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe PID 2520 wrote to memory of 2724 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe cmd.exe PID 2520 wrote to memory of 2724 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe cmd.exe PID 2520 wrote to memory of 2724 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe cmd.exe PID 2520 wrote to memory of 2724 2520 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe cmd.exe PID 2724 wrote to memory of 2400 2724 cmd.exe WMIC.exe PID 2724 wrote to memory of 2400 2724 cmd.exe WMIC.exe PID 2724 wrote to memory of 2400 2724 cmd.exe WMIC.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\64afe55adefb842826b08effa0af8094_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\64afe55adefb842826b08effa0af8094_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\64afe55adefb842826b08effa0af8094_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\64afe55adefb842826b08effa0af8094_JaffaCakes118.exe"2⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic.exe shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\README.htaFilesize
61KB
MD5ba2718eaeae3bcd28c200c3b1a531845
SHA1a496d544c2298e4510748214f1893b452f08d495
SHA25683597df7ff662c78706bea51b4b73af70c534a4151bafd8d402db85bd7d59e82
SHA512bf60586f376df8b0f23d004abffebd554d1c4b234fab11a13ec4cc5f5d0ff88719ec6fa9a91558af445cffcca4e586283fd09a5cc1f938221e685f59395897bf
-
C:\Users\Admin\AppData\Roaming\Addendum.HFilesize
189KB
MD579382b8ded97b3c296d13ec3174627c4
SHA10941ac3bcf63768986fc247587edf7b93ff14137
SHA25698d3bbb508f1e7dc27acc7820f91b6dfb4602bedaa76da8bca49ad33150524db
SHA51276eee44a156dc7183febf03978df9f378a2cbb873f5f70c9ed034dd78d07bae0ada72f022c1d07e9b828a9d14eeff7be994ecb77380ae91180ced57621a6eb5a
-
C:\Users\Admin\AppData\Roaming\article.appendix.title.properties.xmlFilesize
1KB
MD5adb1a285a2b926f98c062fbb74e1e992
SHA11f9799a61072673042a1a3da0fdf3fa93cf10f90
SHA2564ba4637bffa741ba5619c3de97b6c209b5a9deb330385efc7a588492a98b7b45
SHA512aa65628e34601645dfcdcb1f5f0347ae84555bd1a99432d4c25a50044dae932385bfa1f50551f6577d184de684f9264743facb53f4aa2e46bdfeff5c85bc6bd7
-
C:\Users\Admin\AppData\Roaming\btn-next-static.pngFilesize
3KB
MD5c1f70c1569d93f88367d9bf318093b8b
SHA19838688677a326413f85640832fc59b06a0c044e
SHA2564dd18717c088d92bdc1d9e2f5b917d7916e77a23f88f72ad0e62d997c45ef269
SHA512214f88e12239aa1253afcd95bafdd8fc24edf567643d300f0896948e9745f5fa74f4c1c20e286999869eb715f521c05c3adb4ccf975bc7ce0ee17b3167f715a2
-
\Users\Admin\AppData\Local\Temp\nstBC9C.tmp\System.dllFilesize
11KB
MD5a436db0c473a087eb61ff5c53c34ba27
SHA165ea67e424e75f5065132b539c8b2eda88aa0506
SHA25675ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
SHA512908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d
-
\Users\Admin\AppData\Roaming\NsResize.dllFilesize
28KB
MD5d53bd2d5591a78ea15b3bd59e2652bd6
SHA140968bcae13ee63469d241200679b25dfa5fdd4c
SHA2561734bceb77dab6739b80575fd7ee87c437327d8eb147339e1d93b7d3235c5394
SHA512c07bbab95251f16ac4b1c03e0324792b35badd111cced2e5c8e0de467226e572edfe5ca6e528c3494664f2569774f6a422806f54883cc2ef3726e21f4a011f5b
-
memory/2520-181-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-360-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-21-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-35-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-37-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-42-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-43-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-44-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-52-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-53-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-54-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-25-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-27-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-29-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2520-23-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-364-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-367-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-370-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-373-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-376-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-379-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-382-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-385-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-388-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-33-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-391-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-395-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-398-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-402-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-405-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2520-408-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB