8ca19391c24cf4de90d377baabdec11e592dd679489ce7d3b797462d779002f9

General

Target

66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe
Size

554KB
MD5

66820e8a4a1816efdf10334cfafcb7ed
SHA1

4a2ea22822ef065f464efa5ba0ddb1148d7c8395
SHA256

8ca19391c24cf4de90d377baabdec11e592dd679489ce7d3b797462d779002f9
SHA512

977161210c399d4b2a8a5a2aa3c0f4232be32753905a7a941b1239d245cd5bef0046b3170cb3b774c7667f3dd7e01f6acea7690760fcab30347e8b870c7ffab4
SSDEEP

12288:YQjLuRE4xKR72qKoe/ZWsYUxUKQzZZQZsqtOqI:nLueaKR72qKoe/EhdKYavI

Score

9^/10

defense_evasion evasion execution impact persistence ransomware trojan

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzuhujag = "\"C:\\Windows\\tnufuziq.exe\""	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2744 set thread context of 2076	2744	66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe	28
PID 2076 set thread context of 2512	2076	66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe	29

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\tnufuziq.exe	explorer.exe
File created	C:\Windows\tnufuziq.exe	explorer.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2532	vssadmin.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PhishingFilter	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	explorer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2744	66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2436	vssvc.exe
Token: SeRestorePrivilege	2436	vssvc.exe
Token: SeAuditPrivilege	2436	vssvc.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2076	2744	66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe	28
PID 2744 wrote to memory of 2076	2744	66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe	28
PID 2744 wrote to memory of 2076	2744	66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe	28
PID 2744 wrote to memory of 2076	2744	66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe	28
PID 2744 wrote to memory of 2076	2744	66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe	28
PID 2744 wrote to memory of 2076	2744	66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe	28
PID 2744 wrote to memory of 2076	2744	66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe	28
PID 2744 wrote to memory of 2076	2744	66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe	28
PID 2744 wrote to memory of 2076	2744	66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe	28
PID 2744 wrote to memory of 2076	2744	66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe	28
PID 2744 wrote to memory of 2076	2744	66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe	28
PID 2076 wrote to memory of 2512	2076	66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe	29
PID 2076 wrote to memory of 2512	2076	66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe	29
PID 2076 wrote to memory of 2512	2076	66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe	29
PID 2076 wrote to memory of 2512	2076	66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe	29
PID 2076 wrote to memory of 2512	2076	66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe	29
PID 2512 wrote to memory of 2532	2512	explorer.exe	30
PID 2512 wrote to memory of 2532	2512	explorer.exe	30
PID 2512 wrote to memory of 2532	2512	explorer.exe	30
PID 2512 wrote to memory of 2532	2512	explorer.exe	30

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Users\Admin\AppData\Local\Temp\66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\66820e8a4a1816efdf10334cfafcb7ed_JaffaCakes118.exe"
  2⤵
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\system32\explorer.exe"
    3⤵
    - Adds Run key to start application
    - Drops file in Windows directory
    - Modifies Internet Explorer Phishing Filter
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      4⤵
      Interacts with shadow copies
      PID:2532

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1

T1047

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

2

T1070

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ywynugoxasijikec\01000000

Filesize
554KB

MD5
155f291aa24e8cdd8aef2966d982884f

SHA1
e4f2f4b23a60ec6b597c48b9798683d26537c775

SHA256
0aa98fd4ff65049830dd3e7a61f1bd53b551601bcce6d6234371665c4b6dccaf

SHA512
8fb9484d855126d2d8a52d683522b18fc677d6f61d0c0bddd54412444639f2738b519b2f8834e078014b8b8b35626ff27882de0c69df46994e507a76313b1780

Download Submit
memory/2076-7-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2076-5-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2076-17-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2076-16-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2076-13-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2076-11-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2076-15-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2076-0-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2076-9-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2076-25-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2076-2-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2512-19-0x00000000000F0000-0x000000000012C000-memory.dmp

Filesize
240KB

Download
memory/2512-20-0x00000000000F0000-0x000000000012C000-memory.dmp

Filesize
240KB

Download
memory/2512-29-0x00000000000F0000-0x000000000012C000-memory.dmp

Filesize
240KB

Download
memory/2512-32-0x00000000000F0000-0x000000000012C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads