gandcrab | 08b0ec21722d740e19571aadaab15778ac5a8a85274bfed842fddfa8e4673ae1

General

Target

701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
Size

183KB
MD5

701afacec588c55ddce7088c8fa65b93
SHA1

1808efc4b1e61e36b3e3e04a26b92034d74f006b
SHA256

08b0ec21722d740e19571aadaab15778ac5a8a85274bfed842fddfa8e4673ae1
SHA512

5d944e848c0754c229e95c3f3caee5255f693b0e84bfefa9d663a3e3d5e51918c01c0d2092514805dc581b7414233a49b7c6f2eee64ce482c4b83a8e692e7dec
SSDEEP

3072:Ealy19emgKe0QuYS3UmWuDTEltI3S/7IarDrjCgrQp0MUW:EaqxxDwx/7IS40MB

Score

10^/10

gandcrab backdoor defense_evasion execution impact ransomware spyware stealer

Malware Config

Signatures

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\L:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened (read-only)	\??\N:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened (read-only)	\??\X:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened (read-only)	\??\Y:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened (read-only)	\??\A:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened (read-only)	\??\H:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened (read-only)	\??\Q:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened (read-only)	\??\R:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened (read-only)	\??\V:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened (read-only)	\??\W:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened (read-only)	\??\G:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened (read-only)	\??\J:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened (read-only)	\??\I:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened (read-only)	\??\K:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened (read-only)	\??\O:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened (read-only)	\??\U:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened (read-only)	\??\Z:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened (read-only)	\??\B:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened (read-only)	\??\E:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened (read-only)	\??\S:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened (read-only)	\??\T:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened (read-only)	\??\M:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened (read-only)	\??\P:	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\pidor.bmp"	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe

Drops file in Program Files directory 43 IoCs

Processes:

701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Program Files\ClearProtect.docx	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\CompressApprove.wdp	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\EnterExpand.mid	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\RequestMount.zip	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File created	C:\Program Files (x86)\XNZIQ-DECRYPT.html	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\XNZIQ-DECRYPT.html	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\ExitRequest.doc	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\PushMount.xlsm	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\RemoveOpen.docx	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\ConfirmUse.reg	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\DisablePing.vst	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\GrantWrite.wps	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\ResolveBlock.nfo	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\InvokeLock.m4a	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\OutProtect.DVR-MS	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\SubmitImport.mpg	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\LockSync.mp2	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\5460c06e5460c780210.lock	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\CompareHide.doc	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\HideUninstall.rle	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\PublishConvert.potm	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\RepairSend.bmp	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\RevokeEnter.ps1	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\SelectDeny.TTS	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File created	C:\Program Files (x86)\5460c06e5460c780210.lock	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\XNZIQ-DECRYPT.html	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File created	C:\Program Files\5460c06e5460c780210.lock	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\CloseCopy.pot	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\ConvertSave.pot	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\SuspendEnable.ps1	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\TraceSwitch.pot	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\5460c06e5460c780210.lock	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File created	C:\Program Files\XNZIQ-DECRYPT.html	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\ExportPop.ogg	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\GetSubmit.aiff	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\LimitReceive.xlsx	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\OutExpand.xhtml	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\RegisterHide.avi	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\RegisterSearch.vssx	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\SplitGet.mid	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File opened for modification	C:\Program Files\UninstallLimit.mpeg	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5460c06e5460c780210.lock	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\XNZIQ-DECRYPT.html	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe

Modifies system certificate store 2 TTPs 9 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe

pid process

2844 701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
2844 701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe

pid	process
2844	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
2844	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

wmic.exevssvc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2252	wmic.exe
Token: SeSecurityPrivilege	2252	wmic.exe
Token: SeTakeOwnershipPrivilege	2252	wmic.exe
Token: SeLoadDriverPrivilege	2252	wmic.exe
Token: SeSystemProfilePrivilege	2252	wmic.exe
Token: SeSystemtimePrivilege	2252	wmic.exe
Token: SeProfSingleProcessPrivilege	2252	wmic.exe
Token: SeIncBasePriorityPrivilege	2252	wmic.exe
Token: SeCreatePagefilePrivilege	2252	wmic.exe
Token: SeBackupPrivilege	2252	wmic.exe
Token: SeRestorePrivilege	2252	wmic.exe
Token: SeShutdownPrivilege	2252	wmic.exe
Token: SeDebugPrivilege	2252	wmic.exe
Token: SeSystemEnvironmentPrivilege	2252	wmic.exe
Token: SeRemoteShutdownPrivilege	2252	wmic.exe
Token: SeUndockPrivilege	2252	wmic.exe
Token: SeManageVolumePrivilege	2252	wmic.exe
Token: 33	2252	wmic.exe
Token: 34	2252	wmic.exe
Token: 35	2252	wmic.exe
Token: SeIncreaseQuotaPrivilege	2252	wmic.exe
Token: SeSecurityPrivilege	2252	wmic.exe
Token: SeTakeOwnershipPrivilege	2252	wmic.exe
Token: SeLoadDriverPrivilege	2252	wmic.exe
Token: SeSystemProfilePrivilege	2252	wmic.exe
Token: SeSystemtimePrivilege	2252	wmic.exe
Token: SeProfSingleProcessPrivilege	2252	wmic.exe
Token: SeIncBasePriorityPrivilege	2252	wmic.exe
Token: SeCreatePagefilePrivilege	2252	wmic.exe
Token: SeBackupPrivilege	2252	wmic.exe
Token: SeRestorePrivilege	2252	wmic.exe
Token: SeShutdownPrivilege	2252	wmic.exe
Token: SeDebugPrivilege	2252	wmic.exe
Token: SeSystemEnvironmentPrivilege	2252	wmic.exe
Token: SeRemoteShutdownPrivilege	2252	wmic.exe
Token: SeUndockPrivilege	2252	wmic.exe
Token: SeManageVolumePrivilege	2252	wmic.exe
Token: 33	2252	wmic.exe
Token: 34	2252	wmic.exe
Token: 35	2252	wmic.exe
Token: SeBackupPrivilege	2324	vssvc.exe
Token: SeRestorePrivilege	2324	vssvc.exe
Token: SeAuditPrivilege	2324	vssvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe

description	pid	process	target process
PID 2844 wrote to memory of 2252	2844	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe	wmic.exe
PID 2844 wrote to memory of 2252	2844	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe	wmic.exe
PID 2844 wrote to memory of 2252	2844	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe	wmic.exe
PID 2844 wrote to memory of 2252	2844	701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe	wmic.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\701afacec588c55ddce7088c8fa65b93_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2844

C:\Windows\SysWOW64\wbem\wmic.exe
"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2252

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2324

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Windows Management Instrumentation

1

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

1

T1490

Defacement

1

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
39e837eae6ef99e7f91dd292fa0ca9bc

SHA1
9f546cdd00289a76bc45a15d2402fc94269e9c4e

SHA256
40b7674f2699ccbec21830b309f6ed8862103ca20ebc7057f795c1de08e2d3c0

SHA512
6c79adc520ad9710a3b4188369d34d5d75592d4673da86586e21f6093fc9f93845730a6143f01df423a9f6ec3305fd6db51200129a6d2ad75e5d69b76b152b83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e97a93dea31f95bce06bf3fc322086d9

SHA1
bf5647304e36f4501df98da77295ab365e608c78

SHA256
993004284d79bf9f84810991e78c2ab7f31effb8ee2de2096d5f2aac6f501a6e

SHA512
f3d0abbad683b809c891f046aa30dec67f81fbca10c33fdd20a6778d3284cdc889f1e5757f507078afe7c669cad26c1368c1587518418ef550e3192547bebce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F46.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F68.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-481678230-3773327859-3495911762-1000\XNZIQ-DECRYPT.html
Filesize
64KB

MD5
dc1addb38c2e1360f21cfaa77edf6655

SHA1
1030dee2f52c2720c0aa9ff502bb77cce64cd2c1

SHA256
81704edfceb40da7c522842df7ef49e56db977964b0bb6fd26e2d55a45a5bb44

SHA512
7ae5fc3f448bea3e8dfd557a57e667cbd5150f8f17351dce423c33305c114907b12e64e3f4904298502dd2800ac77aafe158b6cc1708d94c27f1c1cee340cadb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads