931eb5ae791991f7ace322ce21f3639c060436af7b7376eb28ebbb2f2cf4c833

General

Target

686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe
Size

554KB
MD5

686b6813e2f24e6e61afe74e9ed1642d
SHA1

cbf55d857f1816056bb2849308c9196e8115b821
SHA256

931eb5ae791991f7ace322ce21f3639c060436af7b7376eb28ebbb2f2cf4c833
SHA512

a67eac318d9947efa6d8dc1919c8026110fd62efd3f0978a5424857349e95287b3b30733be3816efe6c9458d2c35fb12fa6b05b086ffbd7abc4c183663d2fa56
SSDEEP

12288:YQjLuRE4xKR72qKoe/ZWsYUxUKQzZZQZsqtOqD:nLueaKR72qKoe/EhdKYavD

Score

9^/10

defense_evasion evasion execution impact persistence ransomware trojan

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\amikazas = "\"C:\\Windows\\isubisak.exe\""	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe

description	pid	process	target process
PID 1952 set thread context of 1752	1952	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe
PID 1752 set thread context of 3048	1752	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe	explorer.exe

Drops file in Windows directory 2 IoCs

Processes:

explorer.exe

description ioc process

File opened for modification C:\Windows\isubisak.exe explorer.exe
File created C:\Windows\isubisak.exe explorer.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2740 vssadmin.exe

description	ioc	process
File opened for modification	C:\Windows\isubisak.exe	explorer.exe
File created	C:\Windows\isubisak.exe	explorer.exe

pid	process
2740	vssadmin.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PhishingFilter	explorer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe

pid process

1952 686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 2812 vssvc.exe
Token: SeRestorePrivilege 2812 vssvc.exe
Token: SeAuditPrivilege 2812 vssvc.exe

pid	process
1952	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe

description	pid	process
Token: SeBackupPrivilege	2812	vssvc.exe
Token: SeRestorePrivilege	2812	vssvc.exe
Token: SeAuditPrivilege	2812	vssvc.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exeexplorer.exe

description	pid	process	target process
PID 1952 wrote to memory of 1752	1952	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe
PID 1952 wrote to memory of 1752	1952	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe
PID 1952 wrote to memory of 1752	1952	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe
PID 1952 wrote to memory of 1752	1952	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe
PID 1952 wrote to memory of 1752	1952	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe
PID 1952 wrote to memory of 1752	1952	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe
PID 1952 wrote to memory of 1752	1952	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe
PID 1952 wrote to memory of 1752	1952	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe
PID 1952 wrote to memory of 1752	1952	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe
PID 1952 wrote to memory of 1752	1952	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe
PID 1952 wrote to memory of 1752	1952	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe
PID 1752 wrote to memory of 3048	1752	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe	explorer.exe
PID 1752 wrote to memory of 3048	1752	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe	explorer.exe
PID 1752 wrote to memory of 3048	1752	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe	explorer.exe
PID 1752 wrote to memory of 3048	1752	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe	explorer.exe
PID 1752 wrote to memory of 3048	1752	686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe	explorer.exe
PID 3048 wrote to memory of 2740	3048	explorer.exe	vssadmin.exe
PID 3048 wrote to memory of 2740	3048	explorer.exe	vssadmin.exe
PID 3048 wrote to memory of 2740	3048	explorer.exe	vssadmin.exe
PID 3048 wrote to memory of 2740	3048	explorer.exe	vssadmin.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1952

C:\Users\Admin\AppData\Local\Temp\686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\686b6813e2f24e6e61afe74e9ed1642d_JaffaCakes118.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\system32\explorer.exe"
3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer Phishing Filter
- Suspicious use of WriteProcessMemory
PID:3048

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
4⤵
- Interacts with shadow copies
PID:2740

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2812

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Windows Management Instrumentation

1

T1047

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

2

T1070

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ywynugoxasijikec\01000000
Filesize
554KB

MD5
7fef65158f3ef94aa8220109054e8333

SHA1
e609cf631c2b698cea57f860c0c6805204996d0c

SHA256
46b5b3ff4ae0f5acebce2b78bd629c98c5987ae763aec7eae67abd6a72babf73

SHA512
b31502070af8cdd16b12d8679b0bb762bf1850138233b70e8fb5a7eeebb64e4aa22f42b1dc497ac30d71e5d0426af1c37226cb103e635837c3b9af7c7b926f74

Download Submit
memory/1752-10-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1752-15-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1752-11-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1752-18-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1752-7-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1752-6-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1752-13-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1752-0-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1752-2-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1752-26-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1752-16-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3048-20-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/3048-19-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/3048-29-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/3048-32-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads