Analysis
-
max time kernel
146s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 16:35
Static task
static1
Behavioral task
behavioral1
Sample
67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe
-
Size
843KB
-
MD5
67e66ebd63a38dbe2599eaf8e8e36154
-
SHA1
2939b45589d48189538618a599c81ecc49e4d8dc
-
SHA256
bd5d34c1e069176861d46539d8abceabb2e9060d54191080cd64eb4bf907b879
-
SHA512
3257daaa155ad3c2f05e68d0a907177f20b317b95b69c32d75ae977d6e7945809ada572e4333b003d469aadd4b38493f48b476b271a7e3e78323d1e8dad0aab0
-
SSDEEP
24576:TEtl9mRda1cSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0NuJvo:oEs1hC
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exeHelpMe.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" HelpMe.exe -
Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 3 IoCs
Processes:
HelpMe.exe67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk HelpMe.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
HelpMe.exepid process 2052 HelpMe.exe -
Loads dropped DLL 2 IoCs
Processes:
67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exepid process 2812 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe 2812 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exeHelpMe.exedescription ioc process File opened (read-only) \??\O: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened (read-only) \??\Q: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened (read-only) \??\T: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened (read-only) \??\R: HelpMe.exe File opened (read-only) \??\V: HelpMe.exe File opened (read-only) \??\K: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened (read-only) \??\M: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened (read-only) \??\J: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened (read-only) \??\S: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened (read-only) \??\Z: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened (read-only) \??\E: HelpMe.exe File opened (read-only) \??\I: HelpMe.exe File opened (read-only) \??\J: HelpMe.exe File opened (read-only) \??\A: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened (read-only) \??\H: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened (read-only) \??\U: HelpMe.exe File opened (read-only) \??\Y: HelpMe.exe File opened (read-only) \??\M: HelpMe.exe File opened (read-only) \??\Q: HelpMe.exe File opened (read-only) \??\Y: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened (read-only) \??\N: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened (read-only) \??\P: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened (read-only) \??\X: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened (read-only) \??\I: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened (read-only) \??\V: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened (read-only) \??\B: HelpMe.exe File opened (read-only) \??\S: HelpMe.exe File opened (read-only) \??\Z: HelpMe.exe File opened (read-only) \??\E: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened (read-only) \??\A: HelpMe.exe File opened (read-only) \??\K: HelpMe.exe File opened (read-only) \??\L: HelpMe.exe File opened (read-only) \??\P: HelpMe.exe File opened (read-only) \??\X: HelpMe.exe File opened (read-only) \??\B: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened (read-only) \??\U: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened (read-only) \??\T: HelpMe.exe File opened (read-only) \??\W: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened (read-only) \??\G: HelpMe.exe File opened (read-only) \??\R: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened (read-only) \??\H: HelpMe.exe File opened (read-only) \??\N: HelpMe.exe File opened (read-only) \??\O: HelpMe.exe File opened (read-only) \??\W: HelpMe.exe File opened (read-only) \??\G: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened (read-only) \??\L: 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exeHelpMe.exedescription ioc process File opened for modification F:\AUTORUN.INF 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened for modification C:\AUTORUN.INF 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File opened for modification F:\AUTORUN.INF HelpMe.exe -
Drops file in System32 directory 2 IoCs
Processes:
67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exeHelpMe.exedescription ioc process File created C:\Windows\SysWOW64\HelpMe.exe 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe File created C:\Windows\SysWOW64\HelpMe.exe HelpMe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exedescription pid process target process PID 2812 wrote to memory of 2052 2812 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe HelpMe.exe PID 2812 wrote to memory of 2052 2812 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe HelpMe.exe PID 2812 wrote to memory of 2052 2812 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe HelpMe.exe PID 2812 wrote to memory of 2052 2812 67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe HelpMe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\67e66ebd63a38dbe2599eaf8e8e36154_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\HelpMe.exeC:\Windows\system32\HelpMe.exe2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.exeFilesize
844KB
MD595909d584c93284345dd588d1037b96d
SHA119d1bedaf6a3940fc7a5c85c075bf6148bdab4a0
SHA2562093d7a57ab4af151ed3b640248a069e1a03fe77692e9edcc20aa7d46c875752
SHA512bea00154b573f8c1e60acce8a3513bd4d17bc204685c35480d5191982f25599dbcabbf2afcfebcfc1a41d3b95d25e64688d1aa013b918e1b1111fd956f80db95
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnkMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnkFilesize
950B
MD595c93eb34c63f43c236ee1c551e64bdb
SHA1a545c534c40400278cd3fd461bc60247c1504aca
SHA2566fca10d82109f2d524b3882de6b1eebec64618e303dfd045b28a6569a589367c
SHA512cbc26366532d3a7a40373e7105d76e080984ce4a9bd4710efc3b8b8eb642e7612b07221bf3256600b77b6e688201d9333d499ac0b1ea93a0ec19f60e52afa2f0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnkFilesize
1KB
MD58af98dbb33a06b1d232f40fb44d5956e
SHA120b2bef9c4b1a0619d0ce71f663b0c85dcbc2c05
SHA256f3dd9bd382a48d745dec88a7c61d217fe7bcc3aed443339e7460ba9e0b466924
SHA512139e5755a6d176494ebaaadedd09d417bb166f6b3310b0d48b990c38400ac4855d0f2e3a3d84752cdd05aa0ddecff49f3b96c1551d97765ddb09578ac2d266a2
-
F:\AUTORUN.INFFilesize
145B
MD5ca13857b2fd3895a39f09d9dde3cca97
SHA18b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA256cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
SHA51255e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
-
F:\AutoRun.exeFilesize
843KB
MD567e66ebd63a38dbe2599eaf8e8e36154
SHA12939b45589d48189538618a599c81ecc49e4d8dc
SHA256bd5d34c1e069176861d46539d8abceabb2e9060d54191080cd64eb4bf907b879
SHA5123257daaa155ad3c2f05e68d0a907177f20b317b95b69c32d75ae977d6e7945809ada572e4333b003d469aadd4b38493f48b476b271a7e3e78323d1e8dad0aab0
-
\Windows\SysWOW64\HelpMe.exeFilesize
843KB
MD594e936d354a971b1efa32c3f3402286b
SHA119b59e39a8b89a5e6253474a420698c5f7f1130f
SHA256d261ebc6468002d45f08f2cd8bc4f2424a572e4ba0c63eba0d683659e8a65b78
SHA5128bfae03cf7739ea0337f1006da53f47632cf5e34cb37d109fcc442649d7676c3f8a2612f69d852e47b1e9c35339a9ce5a7936f87551f7e24f46dbbf1aad2866d
-
memory/2052-318-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2052-268-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2052-368-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2052-358-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2052-346-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2052-96-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2052-338-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2052-328-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2052-306-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2052-244-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2052-12-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/2052-246-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2052-298-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2052-256-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2052-288-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2052-278-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2812-245-0x0000000001E40000-0x0000000001EB7000-memory.dmpFilesize
476KB
-
memory/2812-327-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2812-267-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2812-287-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2812-1-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/2812-297-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2812-255-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2812-305-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2812-243-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2812-313-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2812-0-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2812-273-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2812-238-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/2812-337-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2812-173-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2812-345-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2812-4-0x0000000001E40000-0x0000000001EB7000-memory.dmpFilesize
476KB
-
memory/2812-357-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2812-91-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2812-367-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2812-11-0x0000000001E40000-0x0000000001EB7000-memory.dmpFilesize
476KB