Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2024 01:00
Static task
static1
Behavioral task
behavioral1
Sample
96d53db0c246b758c080544749b47496_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
96d53db0c246b758c080544749b47496_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
96d53db0c246b758c080544749b47496_JaffaCakes118.exe
-
Size
92KB
-
MD5
96d53db0c246b758c080544749b47496
-
SHA1
c6299596edc48945f92cf8b45554b3e4024a7b4d
-
SHA256
ba1623596ff0c4886437afb3e599afe2d4911c993acaedeacbde1a397b5a50f7
-
SHA512
bac775760d9dcb0999c2630d13c917142a00db6fdd7050afc0bbbaed6a1251512315e116db86e786a6602ea9a4ef00e6bc70bcf207191e8878c7ef1988da5c55
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4AI9MF5fNzPDmSjG5DUgD0rXBYTP45FTx:Qw+asqN5aW/hLzm75D7D07mTwF
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (631) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
96d53db0c246b758c080544749b47496_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 96d53db0c246b758c080544749b47496_JaffaCakes118.exe -
Drops startup file 5 IoCs
Processes:
96d53db0c246b758c080544749b47496_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\96d53db0c246b758c080544749b47496_JaffaCakes118.exe 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 96d53db0c246b758c080544749b47496_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
96d53db0c246b758c080544749b47496_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\96d53db0c246b758c080544749b47496_JaffaCakes118.exe = "C:\\Windows\\System32\\96d53db0c246b758c080544749b47496_JaffaCakes118.exe" 96d53db0c246b758c080544749b47496_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 96d53db0c246b758c080544749b47496_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 96d53db0c246b758c080544749b47496_JaffaCakes118.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
96d53db0c246b758c080544749b47496_JaffaCakes118.exedescription ioc process File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Public\Videos\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Public\Music\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\Links\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Public\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\Music\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 96d53db0c246b758c080544749b47496_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
Processes:
96d53db0c246b758c080544749b47496_JaffaCakes118.exedescription ioc process File created C:\Windows\System32\96d53db0c246b758c080544749b47496_JaffaCakes118.exe 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File created C:\Windows\System32\Info.hta 96d53db0c246b758c080544749b47496_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
96d53db0c246b758c080544749b47496_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\TEMPSITC.TTF.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SyncFusion.Tools.Base.dll.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-us\xlsrvintl.dll 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageStoreLogo.scale-125_contrast-black.png 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\MixerBranding\Mixer_logo_DarkBlue_RGB.png 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\logo_retina.png.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_signed_out.svg 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\ui-strings.js.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\example_icons2x.png.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\PREVIEW.GIF.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Input.Manipulations.resources.dll.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\LargeTile.scale-125_contrast-white.png 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\BadgeLogo.scale-200_contrast-white.png 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\de-de\ui-strings.js.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-j2se-1.3.2.jar.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\resources.pri 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\msedgeupdateres_lv.dll.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner-3x.png.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-60_contrast-white.png 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ul-oob.xrm-ms 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-runtime-l1-1-0.dll 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\ICE.INF.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Trust Protection Lists\Sigma\Other.DATA.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailWideTile.scale-400.png 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_wob.png.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-ma\ui-strings.js.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_contrast-black.png 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\sqlpdw.xsl.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-125_contrast-white.png 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96_altform-unplated.png 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sk.pak.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libsftp_plugin.dll 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\PSGet.Resource.psd1.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\jquery.jstree.js 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_Cliffhouse.jpg 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionLargeTile.scale-400.png 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-unplated.png 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-96_altform-unplated_contrast-white.png 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\tool-search-2x.png.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\selector.js.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\redact_poster.jpg.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-400_contrast-black.png 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.Misc.v8.1.dll.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Input.Manipulations.resources.dll.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-40.png 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\CANYON.INF.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\DirectInk.dll.id-254B72E2.[[email protected]].combo 96d53db0c246b758c080544749b47496_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 6248 vssadmin.exe 8724 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
96d53db0c246b758c080544749b47496_JaffaCakes118.exepid process 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 6732 vssvc.exe Token: SeRestorePrivilege 6732 vssvc.exe Token: SeAuditPrivilege 6732 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
96d53db0c246b758c080544749b47496_JaffaCakes118.execmd.execmd.exedescription pid process target process PID 3708 wrote to memory of 4356 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe cmd.exe PID 3708 wrote to memory of 4356 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe cmd.exe PID 4356 wrote to memory of 4580 4356 cmd.exe mode.com PID 4356 wrote to memory of 4580 4356 cmd.exe mode.com PID 4356 wrote to memory of 6248 4356 cmd.exe vssadmin.exe PID 4356 wrote to memory of 6248 4356 cmd.exe vssadmin.exe PID 3708 wrote to memory of 8048 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe cmd.exe PID 3708 wrote to memory of 8048 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe cmd.exe PID 8048 wrote to memory of 6388 8048 cmd.exe mode.com PID 8048 wrote to memory of 6388 8048 cmd.exe mode.com PID 8048 wrote to memory of 8724 8048 cmd.exe vssadmin.exe PID 8048 wrote to memory of 8724 8048 cmd.exe vssadmin.exe PID 3708 wrote to memory of 7748 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe mshta.exe PID 3708 wrote to memory of 7748 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe mshta.exe PID 3708 wrote to memory of 7672 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe mshta.exe PID 3708 wrote to memory of 7672 3708 96d53db0c246b758c080544749b47496_JaffaCakes118.exe mshta.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\96d53db0c246b758c080544749b47496_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\96d53db0c246b758c080544749b47496_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4332,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.id-254B72E2.[[email protected]].comboFilesize
3.6MB
MD59dc79c57dc7eb5e8850f7e54d684891b
SHA109851debf2b04b20afb59dff7435645f57cbc35e
SHA256a50a0e19e2dbb6a264d2145ce5c8ed0c4fa0933b414456d83d1992c3abddc3a2
SHA5129fe5b48d51b3a5c56a2c728f3d3c765dd408244d591e2eccb95f8b46019c1feeb56fcfe48eaf18df7c437454152a86c40365c66a8d30815c0edf0abd28bf5a12
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
13KB
MD5feaf6a9f412e26f243a31f137097de00
SHA1418ea8d86aae97d67ec979e9373286ca41881cda
SHA2567b12330b628fe38476676500e84a56c99561745262ff74d111a5fb9cb4672258
SHA5125ec74ec656d218161a885c4704136ca19741a8ec3c8334542202833113a159090cd6bdc5adecdaaed33f405f17f49f5bbd9d70cc0c41f7aeb7055d99f0982ae5