Analysis
-
max time kernel
145s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 04:14
Static task
static1
Behavioral task
behavioral1
Sample
70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
70d462fc99a5c81c15a0738faeadd584
-
SHA1
6babff7528d909326ada0cbcff5e280485aa5eac
-
SHA256
be320e20f29e49ef90082f84fed1736dd2434f1bd9d222b2ba76030ad92e93fa
-
SHA512
19ecd315fdf0f5a390b3343f1b4e5169986ca9b0dcbcbc19e77d6c8f124f369680a6c1a99b8df1fff87a3d59e5229ee8500ef070f2261f23dc47bc63367eac04
-
SSDEEP
24576:TEtl9mRda1cSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0NuJvM:oEs1ha
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exeHelpMe.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" HelpMe.exe -
Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 3 IoCs
Processes:
70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exeHelpMe.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk HelpMe.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
HelpMe.exepid process 2288 HelpMe.exe -
Loads dropped DLL 2 IoCs
Processes:
70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exepid process 2800 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe 2800 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exeHelpMe.exedescription ioc process File opened (read-only) \??\O: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\Q: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\R: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\Y: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\N: HelpMe.exe File opened (read-only) \??\Q: HelpMe.exe File opened (read-only) \??\K: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\M: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\V: HelpMe.exe File opened (read-only) \??\A: HelpMe.exe File opened (read-only) \??\O: HelpMe.exe File opened (read-only) \??\A: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\G: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\X: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\Z: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\E: HelpMe.exe File opened (read-only) \??\J: HelpMe.exe File opened (read-only) \??\K: HelpMe.exe File opened (read-only) \??\E: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\J: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\T: HelpMe.exe File opened (read-only) \??\U: HelpMe.exe File opened (read-only) \??\Y: HelpMe.exe File opened (read-only) \??\H: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\M: HelpMe.exe File opened (read-only) \??\P: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\W: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\B: HelpMe.exe File opened (read-only) \??\W: HelpMe.exe File opened (read-only) \??\Z: HelpMe.exe File opened (read-only) \??\B: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\N: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\P: HelpMe.exe File opened (read-only) \??\R: HelpMe.exe File opened (read-only) \??\S: HelpMe.exe File opened (read-only) \??\X: HelpMe.exe File opened (read-only) \??\U: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\I: HelpMe.exe File opened (read-only) \??\S: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\T: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\G: HelpMe.exe File opened (read-only) \??\L: HelpMe.exe File opened (read-only) \??\I: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\L: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\V: 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened (read-only) \??\H: HelpMe.exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
HelpMe.exe70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exedescription ioc process File opened for modification F:\AUTORUN.INF HelpMe.exe File opened for modification F:\AUTORUN.INF 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File opened for modification C:\AUTORUN.INF 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
Processes:
70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exeHelpMe.exedescription ioc process File created C:\Windows\SysWOW64\HelpMe.exe 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe File created C:\Windows\SysWOW64\HelpMe.exe HelpMe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exedescription pid process target process PID 2800 wrote to memory of 2288 2800 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe HelpMe.exe PID 2800 wrote to memory of 2288 2800 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe HelpMe.exe PID 2800 wrote to memory of 2288 2800 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe HelpMe.exe PID 2800 wrote to memory of 2288 2800 70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe HelpMe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\70d462fc99a5c81c15a0738faeadd584_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\HelpMe.exeC:\Windows\system32\HelpMe.exe2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
PID:2288
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.exeFilesize
1.4MB
MD53135967bec9b84caaae86be457158a77
SHA1941e72e65d14aea9ba572c48278a8c32705cee6e
SHA256d4a55db1593f90088b0debb760be0006a5fef3eb2f97e8582d57f12af98d3852
SHA51228aa9891da00e362959670e50bf48f58667cf80d9fc293bfb05da1c5353831ff8d397b2e7352ccdb2cf30974a8a78e3799306124b8fdebdd4d5d76649502cf57
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnkFilesize
1KB
MD5b95ce058c56c3aefd5ee845fe94650cb
SHA1ae7c8043cfb3394d63277f67e38a6661b7f16613
SHA256b6ffe892d431f03586d07dcdb586d9bad74ff754f9bd003ad63160afdef72145
SHA51281422b90f91cb205afb33cf99197efa1572e5977a4ce5dcd6bc35be789e177bc03f203be607430ed4629acdef95f1505a2eba7e73067673afcf28d9c4f1763d4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnkMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnkFilesize
950B
MD5502a5b67c591bf60eeefa71065a2ae75
SHA13b74b7b1c777897cbed9ea883dbb6e779a02a84b
SHA2563595d934df1f309c23af71814acf49b5b043755432bf98698b4279bddafbc9b0
SHA512983c18641340b305955181cf1ed5a839be6c3ab49c245a48489079bb5ca9ca3c9f7c59fac41021ac7081914418854647a4cedfd1c8c82ab3a50ac9c6a8fbb47f
-
F:\AUTORUN.INFFilesize
145B
MD5ca13857b2fd3895a39f09d9dde3cca97
SHA18b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA256cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
SHA51255e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
-
F:\AutoRun.exeFilesize
1.4MB
MD570d462fc99a5c81c15a0738faeadd584
SHA16babff7528d909326ada0cbcff5e280485aa5eac
SHA256be320e20f29e49ef90082f84fed1736dd2434f1bd9d222b2ba76030ad92e93fa
SHA51219ecd315fdf0f5a390b3343f1b4e5169986ca9b0dcbcbc19e77d6c8f124f369680a6c1a99b8df1fff87a3d59e5229ee8500ef070f2261f23dc47bc63367eac04
-
\Windows\SysWOW64\HelpMe.exeFilesize
1.4MB
MD53e51d60fde771db71aa37ff81bc88c84
SHA1e82205dedb9e1606df254fc0db3dec3640f4d5d9
SHA256c45285cb849a2aa19e733d7fe4de8ac987d1ef31154274aa866e609c61a8c0d3
SHA512b6475d5fe532d06e1dc7f8c818fb7a066ad253d6d1eca2b9f81baf3d413acfb41eb5cb72798aa8d5a04cc853727bfbddabe1db85a3601afbd09649752c04785d
-
memory/2288-255-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2288-277-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2288-11-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2288-367-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2288-357-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2288-347-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2288-232-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2288-335-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2288-327-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2288-243-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2288-245-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2288-317-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2288-307-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2288-297-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2288-287-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2288-267-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2288-12-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2800-244-0x0000000000330000-0x00000000003A7000-memory.dmpFilesize
476KB
-
memory/2800-4-0x0000000000330000-0x00000000003A7000-memory.dmpFilesize
476KB
-
memory/2800-276-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2800-296-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2800-0-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2800-306-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2800-254-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2800-316-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2800-262-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2800-286-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2800-334-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2800-242-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2800-237-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2800-346-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2800-231-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2800-356-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2800-1-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2800-366-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2800-326-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB