Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 08:27
Static task
static1
Behavioral task
behavioral1
Sample
66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
CabDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
CabDLL.dll
Resource
win10v2004-20240426-en
General
-
Target
66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe
-
Size
238KB
-
MD5
66a29907be635eec743eb65225c63ec7
-
SHA1
5dc5270d6c45185efdc149291fea0ac4b3cbe212
-
SHA256
949f8d17e9e2e632e8d0f1e7f47327300a5c2e8d937eccf15f5b78a4fc882e35
-
SHA512
553e568e6c2420fb8b396606789d2739260fe986c5186fb1efdcde5e6ac6d4d7ecc66ba6644c0ceb902e17b72e110d9454fa0ad8f3857e7da1cad0be093e2f0f
-
SSDEEP
3072:KNdm6/Xbi5XJC/O45Riu9ShhIuiGKSLtNO9axj/LT5yFP26Mt3fZNXTWy813W:Kn/L+GOmF8hFKSZ/1yFujJPW3W
Malware Config
Extracted
C:\Users\Admin\Music\README.hta
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Contacts a large (512) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Loads dropped DLL 3 IoCs
Processes:
66a29907be635eec743eb65225c63ec7_JaffaCakes118.exepid process 2020 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2020 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2020 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
66a29907be635eec743eb65225c63ec7_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp6AF3.bmp" 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
66a29907be635eec743eb65225c63ec7_JaffaCakes118.exedescription pid process target process PID 2020 set thread context of 2860 2020 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe -
Drops file in Program Files directory 6 IoCs
Processes:
66a29907be635eec743eb65225c63ec7_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\README.hta 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
Processes:
66a29907be635eec743eb65225c63ec7_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\towpath 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
66a29907be635eec743eb65225c63ec7_JaffaCakes118.exepid process 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
66a29907be635eec743eb65225c63ec7_JaffaCakes118.exeWMIC.exevssvc.exeAUDIODG.EXEdescription pid process Token: SeDebugPrivilege 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2672 WMIC.exe Token: SeSecurityPrivilege 2672 WMIC.exe Token: SeTakeOwnershipPrivilege 2672 WMIC.exe Token: SeLoadDriverPrivilege 2672 WMIC.exe Token: SeSystemProfilePrivilege 2672 WMIC.exe Token: SeSystemtimePrivilege 2672 WMIC.exe Token: SeProfSingleProcessPrivilege 2672 WMIC.exe Token: SeIncBasePriorityPrivilege 2672 WMIC.exe Token: SeCreatePagefilePrivilege 2672 WMIC.exe Token: SeBackupPrivilege 2672 WMIC.exe Token: SeRestorePrivilege 2672 WMIC.exe Token: SeShutdownPrivilege 2672 WMIC.exe Token: SeDebugPrivilege 2672 WMIC.exe Token: SeSystemEnvironmentPrivilege 2672 WMIC.exe Token: SeRemoteShutdownPrivilege 2672 WMIC.exe Token: SeUndockPrivilege 2672 WMIC.exe Token: SeManageVolumePrivilege 2672 WMIC.exe Token: 33 2672 WMIC.exe Token: 34 2672 WMIC.exe Token: 35 2672 WMIC.exe Token: SeIncreaseQuotaPrivilege 2672 WMIC.exe Token: SeSecurityPrivilege 2672 WMIC.exe Token: SeTakeOwnershipPrivilege 2672 WMIC.exe Token: SeLoadDriverPrivilege 2672 WMIC.exe Token: SeSystemProfilePrivilege 2672 WMIC.exe Token: SeSystemtimePrivilege 2672 WMIC.exe Token: SeProfSingleProcessPrivilege 2672 WMIC.exe Token: SeIncBasePriorityPrivilege 2672 WMIC.exe Token: SeCreatePagefilePrivilege 2672 WMIC.exe Token: SeBackupPrivilege 2672 WMIC.exe Token: SeRestorePrivilege 2672 WMIC.exe Token: SeShutdownPrivilege 2672 WMIC.exe Token: SeDebugPrivilege 2672 WMIC.exe Token: SeSystemEnvironmentPrivilege 2672 WMIC.exe Token: SeRemoteShutdownPrivilege 2672 WMIC.exe Token: SeUndockPrivilege 2672 WMIC.exe Token: SeManageVolumePrivilege 2672 WMIC.exe Token: 33 2672 WMIC.exe Token: 34 2672 WMIC.exe Token: 35 2672 WMIC.exe Token: SeBackupPrivilege 2376 vssvc.exe Token: SeRestorePrivilege 2376 vssvc.exe Token: SeAuditPrivilege 2376 vssvc.exe Token: 33 2008 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2008 AUDIODG.EXE Token: 33 2008 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2008 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe66a29907be635eec743eb65225c63ec7_JaffaCakes118.execmd.exedescription pid process target process PID 2020 wrote to memory of 2860 2020 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe PID 2020 wrote to memory of 2860 2020 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe PID 2020 wrote to memory of 2860 2020 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe PID 2020 wrote to memory of 2860 2020 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe PID 2020 wrote to memory of 2860 2020 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe PID 2020 wrote to memory of 2860 2020 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe PID 2020 wrote to memory of 2860 2020 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe PID 2020 wrote to memory of 2860 2020 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe PID 2020 wrote to memory of 2860 2020 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe PID 2020 wrote to memory of 2860 2020 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe PID 2860 wrote to memory of 2536 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe cmd.exe PID 2860 wrote to memory of 2536 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe cmd.exe PID 2860 wrote to memory of 2536 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe cmd.exe PID 2860 wrote to memory of 2536 2860 66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe cmd.exe PID 2536 wrote to memory of 2672 2536 cmd.exe WMIC.exe PID 2536 wrote to memory of 2672 2536 cmd.exe WMIC.exe PID 2536 wrote to memory of 2672 2536 cmd.exe WMIC.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\66a29907be635eec743eb65225c63ec7_JaffaCakes118.exe"2⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic.exe shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2376
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:1344
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5a01⤵
- Suspicious use of AdjustPrivilegeToken
PID:2008
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Music\README.htaFilesize
61KB
MD5d3a571e403455835b5729221ab7bc819
SHA1c5fa2e80af064aee41035c3c97bb43108f16f957
SHA256dccfe36a8e1c42bd023030f84d26f56f939ad1bd7182a1354c30a8d2bb3e7e75
SHA512b578b085b0b6e43c62eeb2ece4d1db446944b45c09177b124aa0814018c0b9b8d6978d3488cf41f2eead0cbb8d6a3ec5752afc0f50b273fb24cd43e17bae4ef0
-
\Users\Admin\AppData\Local\Temp\nsj8A66.tmp\System.dllFilesize
11KB
MD5a436db0c473a087eb61ff5c53c34ba27
SHA165ea67e424e75f5065132b539c8b2eda88aa0506
SHA25675ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
SHA512908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d
-
\Users\Admin\AppData\Roaming\CabDLL.dllFilesize
28KB
MD5a4c07c7c2328612f32465ed4350fc6b1
SHA1578e751f602ed19336406e85e59fdc807e8e5e47
SHA2561fb5fd45067a68ca5cd7428ff2ac81cb5b090ee48383e3ab771d89d08eb10332
SHA51224990ceb668f03410ee62fcf47cfae57a0c5cd1dc09308f8b839c9bcb3ae20c332fdd9ab4a1e63996035b2c835a2aba07b1a38d5a94a47f4432d2c781d711283
-
memory/2860-326-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-37-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2860-329-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-25-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-23-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-35-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-332-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-42-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-43-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-44-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-53-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-54-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-335-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-29-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-22-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-27-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-33-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-106-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-338-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-341-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-344-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-350-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-347-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-353-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-356-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-359-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-362-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-365-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-368-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-371-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-373-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2860-379-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB