globeimposter | 2c34888b579bfe9598f5ab006346ce318ece71375b4deed4a5baf46aa867f274

General

Target

7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
Size

220KB
MD5

7b65b6bdd6866345d6f9d0e18a0dcbc9
SHA1

fe3fdda918a3db1b17fc48716b574356700d5fc0
SHA256

2c34888b579bfe9598f5ab006346ce318ece71375b4deed4a5baf46aa867f274
SHA512

0e73217400e0763ff6e455f7e6fec40b9bfc849c45d2dfec88e5b4ea7f5f102578a0694d35c1b18993bf8f41a5bcbf09903f5bc9662b08fbcae4f6484a274ef1
SSDEEP

3072:93VrTNNer1tXqjkJ+G0vskV+Rr/wtBMHD4C6S7FSrK3xn9j0J:tV/MvJaL+lItqISxMGxh0

Score

10^/10

globeimposter defense_evasion execution impact persistence ransomware spyware stealer

Malware Config

Signatures

GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (8675) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1936 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1936	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Roaming\\7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe"	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe

Drops desktop.ini file(s) 38 IoCs

Processes:

7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Public\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

Processes:

7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Campo_Grande	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Palau	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN110.XML	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00413_.WMF	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382955.JPG	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_FormsHomePageSlice.gif	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WORDREP.DPV	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLPERF.INI	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0212751.WMF	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_h264_plugin.dll	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libgain_plugin.dll	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-services.xml	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_ja_4.4.0.v20140623020002.jar	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR28B.GIF	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL00260_.WMF	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_ja_4.4.0.v20140623020002.jar	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\Read___ME.html	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.servlet_8.1.14.v20131031.jar	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Paris	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB4.BDR	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SlateBlue.css	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\TAB_ON.GIF	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0149118.JPG	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sa.xml	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_gather_plugin.dll	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\MST7MDT	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\System.AddIn.dll	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239191.WMF	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TR00116_.WMF	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-util-enumerations.jar	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\TAB_OFF.GIF	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14868_.GIF	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\TAB_ON.GIF	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106020.WMF	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART1.BDR	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libscte18_plugin.dll	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_ja_4.4.0.v20140623020002.jar	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Athens	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Casablanca	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\EssentialMergeLetter.dotx	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WebToolIconImagesMask.bmp	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CONFLICT.ICO	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309904.WMF	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\VisioCustom.propdesc	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01176_.WMF	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00435_.WMF	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\Read___ME.html	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1336 vssadmin.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe

pid process

2100 7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 2000 vssvc.exe
Token: SeRestorePrivilege 2000 vssvc.exe
Token: SeAuditPrivilege 2000 vssvc.exe

pid	process
1336	vssadmin.exe

pid	process
2100	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe

description	pid	process
Token: SeBackupPrivilege	2000	vssvc.exe
Token: SeRestorePrivilege	2000	vssvc.exe
Token: SeAuditPrivilege	2000	vssvc.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.execmd.exe

description	pid	process	target process
PID 2100 wrote to memory of 2080	2100	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe	cmd.exe
PID 2100 wrote to memory of 2080	2100	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe	cmd.exe
PID 2100 wrote to memory of 2080	2100	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe	cmd.exe
PID 2100 wrote to memory of 2080	2100	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe	cmd.exe
PID 2100 wrote to memory of 1936	2100	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe	cmd.exe
PID 2100 wrote to memory of 1936	2100	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe	cmd.exe
PID 2100 wrote to memory of 1936	2100	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe	cmd.exe
PID 2100 wrote to memory of 1936	2100	7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe	cmd.exe
PID 2080 wrote to memory of 1336	2080	cmd.exe	vssadmin.exe
PID 2080 wrote to memory of 1336	2080	cmd.exe	vssadmin.exe
PID 2080 wrote to memory of 1336	2080	cmd.exe	vssadmin.exe
PID 2080 wrote to memory of 1336	2080	cmd.exe	vssadmin.exe
PID 2080 wrote to memory of 852	2080	cmd.exe	reg.exe
PID 2080 wrote to memory of 852	2080	cmd.exe	reg.exe
PID 2080 wrote to memory of 852	2080	cmd.exe	reg.exe
PID 2080 wrote to memory of 852	2080	cmd.exe	reg.exe
PID 2080 wrote to memory of 1848	2080	cmd.exe	reg.exe
PID 2080 wrote to memory of 1848	2080	cmd.exe	reg.exe
PID 2080 wrote to memory of 1848	2080	cmd.exe	reg.exe
PID 2080 wrote to memory of 1848	2080	cmd.exe	reg.exe
PID 2080 wrote to memory of 864	2080	cmd.exe	reg.exe
PID 2080 wrote to memory of 864	2080	cmd.exe	reg.exe
PID 2080 wrote to memory of 864	2080	cmd.exe	reg.exe
PID 2080 wrote to memory of 864	2080	cmd.exe	reg.exe
PID 2080 wrote to memory of 1508	2080	cmd.exe	attrib.exe
PID 2080 wrote to memory of 1508	2080	cmd.exe	attrib.exe
PID 2080 wrote to memory of 1508	2080	cmd.exe	attrib.exe
PID 2080 wrote to memory of 1508	2080	cmd.exe	attrib.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

1508 attrib.exe

pid	process
1508	attrib.exe

C:\Users\Admin\AppData\Local\Temp\7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\tmpB693.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:1336
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
    3⤵
    PID:852
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
    3⤵
    PID:1848
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
    3⤵
    PID:864
- - C:\Windows\SysWOW64\attrib.exe
    attrib Default.rdp -s -h
    3⤵
    - Views/modifies file attributes
    PID:1508
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118.exe > nul
  2⤵
  - Deletes itself
  PID:1936

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1

T1047

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Indicator Removal

2

T1070

File Deletion

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini

Filesize
1KB

MD5
9a479e05f3b236a22d3274ddf4d55b7a

SHA1
2dd35f0ad9482b6b47c9b787e3fa0a669706008f

SHA256
c6e8d87f313b8f6bd42f0099ef491d23eabb8bd8845aef3f3abb8d58ad7af236

SHA512
ec8ef6e475783202df7f3a4208e3c1ee55b5e6be43b134a38f82c9bce455f7773cb39cc9d4f20d72e4ad779a8d4ee7ef1e22ec3a40ea0efb828b9987970d83d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB693.tmp.bat

Filesize
445B

MD5
32d8f7a3d0c796cee45f64b63c1cca38

SHA1
d58466430a2bba8641bd92c880557379e25b140c

SHA256
1a6f73b5c28d1c10f63f2056068c1de61487b8cf8f1dcf7516548df144b3e9ea

SHA512
288213b92a03ac750ea319bb23c52e7bdf47f5a47ecb70c905c7610a84c63a3ec0a30801b5880e6def8df2c9f577082072e342198d23a19f64e561923e1ef698

Download Submit
C:\Users\Public\Videos\Read___ME.html

Filesize
4KB

MD5
75fc9039bcfbe651c5e9943174fc8914

SHA1
14ed798b157360e959f86ec14e69a8abc2e82aab

SHA256
f7f7c81bdbb397c3327e00edea38ea5404b86c5a6abcb326c5bf60afa1c089e9

SHA512
a7d18abcd1c1e8d6703be9ff68b70e8ffceb2c032296d9a9873e62297bd782820f93dce798bd4a4d1a92caea08a19cba2eb8153ac07087b99d736fd19c816eec

Download Submit
memory/2100-3-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2100-2-0x0000000000270000-0x0000000000370000-memory.dmp

Filesize
1024KB

Download
memory/2100-1432-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2100-2925-0x0000000000270000-0x0000000000370000-memory.dmp

Filesize
1024KB

Download
memory/2100-2926-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads