Analysis
- max time kernel
140s - max time network
144s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system - submitted
12/06/2024, 17:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe
- Size 230KB
- Sample240612-v9179stdka
- SHA256 071829bd858ce263733337bd3ccc4a1976a3f582aa50af31815a2edb2a692f01
- MD5 a1900e34fbf2279d4ff96027156f27b3
- SHA1 5dedfc6d264d0d14646599dc327f5b11e8fc2d23
- SHA512 b6cb92a3653afff91962a5a72bac428930aa36e020f71570069d249ffe8297a387da7f6d8276bc01c0254faa2e961989a45f1471bea329d06e95b7972ab79fac
- SSDEEP 6144:PcUDGbFW8W2W0EruXdjC2ZmY8wJcm2atN+bLkF3N:0ueF3W9iXciR8wJcy+bWN
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Path
-
F:\$RECYCLE.BIN\S-1-5-21-2721934792-624042501-2768869379-1000\DFLQQ-DECRYPT.txt
Ransom Note
- ---= GANDCRAB V5.0 =--- Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .DFLQQ The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/351e99ea10bcaf65 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAM3gayQYJq3q/6gRAJTCLHk3bnYunItXHsZ4p6PE0YrhDm2O0voOOxdhjZ+BuW+VZlMeg3sBZ1vJcDV+jVIW4bG+AAsvvqQdlao5dmOO15ZpkPxwpJMt6r6lmJpkAM8jzAbWfYrseZOdU6DURw2B+wT+uAdsvaSBGtSYerxmaAdL/NwOJMaPi0iukgxydLPdreKAWZTKwgFHMBOvQTBFixtPgSe7Uh134zhpCt63Kg0CJ9kOXgvDKdYp9CgLsxW+5dIXCFB3xRrnPODmfq839B3gLab+A6vLlRYyO1QkbdXpuIWc1ICdYgmbRWk0t3XqCf58i8s7JsagzLc9XQo+qqfqjD6reHnbJ7qEAjjwUwVLwFRQLb6n04Dhac0nywMt/FGEhozS5R9LMf8xGzsSlEaMuA9TDXn7WRC1RgtH+QOoYB8bNzskdzBeOHKNBC4SHdKHRIA1O9k97dwXosrcmeAi0Q4uZxNb6v6xL4Z15VlkUmyHz84uVZK3XdB13fqVAVZnXgud0pluHODwJ+6hTQ8iPRcdVH+jQJPLdKF9z+6NFFzP8ehcduH1GFyTInInX+tum6vaia8gHreKCLLYm2Dg8AwJFmKok87Krc+jjkutiIJS06TjGlVhRzGczRGZ9gLREqlRgrAxMPWbwQmN2BfJAKj77XIONbI3BJlswj6qYPTEL2gppZg08Jo2HuAEKCwopz5aq9fEHoZmgPkHpSxK2F8OqW66zUR8dOptx1YiUDj9YaABA/0zxLrQaGs1kKcw7I03i9OtHYtv2sUkdXvjX7/Tcn6fmVPUUBb+cDV4lxiVPmJ35PC47+VjupCeR1cwVVOxmsJLLZ5KmzYeceYclzGYlhEZwrUt0Zn5spUWCWniuxuruopii77nIv3VMGlj9IsIYyQ24+CWeyGoNMeu+lL74agir8G3Rj55ea46e22f1CkIgks3VbSGKpG3bBky6MexS4Zz5qg/cguuW3cTKn/iOEGpnCGLgB8Gd40pFrLCFSYYetuo7LTK2WGfwy8O7GZwKF52VqnZ+nKdoGU0MJVYfrJtJYb1u0ZKiQ2DMmYunvWlTjOTlgD66tcvv6f1jcbAklvxCO9pjOe3Wqhxx/l3DlUoGl8ynKNPGtpXM3aPdfzHr+z545RTadoGbvg3kv4CJ8pXOfZzDQo8DKZMHvstBGn74uvcNt9NZTG6KjkyVEi6SAA9kjTXRIQWwPM8k8zuJJNIoSrBbp+q3vvu0W5gm1yoHHnWYYfQHlvWoEtdzeSClQtqpSb6K6/uFD+ASldm5ICS6ICT+V0SRC9doh6pya0RTyHB0TfcqKgatah7FBaBZN4n24zR3DOrvimQUwWv/dZwHaKG07xYgtjoNh9JfryKNcwmiuRWePsyMd+Mo3RRWxWf/eQv477S0himgO6tJILpJFpOnvsrRUP/sCBc/pvjJFzZzGXhmSFItlWbY05diTKFWU+7M4zeZRYWuRCYYuHDp1p3jIclOsCZmNGcPEOJgPDbGPiL9W1E7qnfs1DQk9od5+cl4wCEzGqKe/hRzvVdp3ybmm7W4t7b8m+O1sek22BdGFl8PDv1cDnEGni4OP0h3R3yaPyYEjzzEzuoSjZ0ca/TLCn2sefFMs9MNEyWwVKmIqz5cmjGu4dIEq6YgFdIrqeJynFG0Fq4YtSbcNlt6mTQPhy6HHnCBweC5NqMwh/s0SeUErQgQgy4OwtIWHnPZBTNcUC5NPmru3Ll27PdAeLq1ge47sb9KOlzCjs2AkNEJzPjPxnT03lSII9Wd7K6rdaiakFrLdGizv/D8aDriyDZ1xj/MU00SpXVDzvokkx9z773KGs6+JdaNUqX9Q5N83B7owRSuUu2Hlu2RT8Sg6T7vSlOGSB+68ZoDeD1F9+TpJkgxJLkMZnvEl3cMUicsQ25Upt0kbSZJIplW5KmoDZvaYSJb1CIpQ2dyBaQY+UGgUd7ny6FWJ0CICWup+YkHb1g8U3+ahCfZS+bM5pkw+Vud9/JAOh3UXIHhDrHw0X/X5FCt7zcWI6E9N0SYWCFu8iknDOY0TWOgOUHo1EYi+FfoQ1aL3u6RM1WioqHETTPxafbH1aRxE3iyZX+FBlI9w6/CEbkW8FjwgVdSgCvJnOLjtXQyYjyCTfmwa5TIQ3FhJ6cgfYOmwVpWpBhI0LtKQgBK+HwDYMh1zPS/eJY62jxnJpbGCy46TKG/Z1BH5jKXX2L/+u1e2H+FF3AUYeWyFrN+GWA82Tgxqg= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZVTp5RrXYS7nFWv7fdTHmHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wLmpQodXZhP6M/UPrO1sZzkDbgjYlAG3g8l65nVd0/CBUxKQ7KDJYrtX0vSmnFXg/ykfgtJNiwqfCnqbr85+Bi4LF3kUnBteKt/282ROt3GtpYbFrRBnTt/BGAEd8bpCcE4oG4b6a1Y8ZyGoyp2Q2iuJRzTRoqGlPQJIAJppFrwNIoDBPOnKw+A+5ZALufjGEwg7NrKg3qxA9Kxg72Zi/pDhFJ3v3LOOar1w4ZLXRgRl+KCjmo1jngAX95mSffmizzQU1nmrIqlsew6HIMVY3pdDfwfAscdcBnP3FNhn9WQ3XC06ZCEvXtdUj8BYRMbJHzHpMOar+NRZwP9okRV/rusrPFzMP9PnYFh9gzrewdRb9tHf+DbmDW4OIcXpVeLdQr9FRha1KO2vpgy2mFLQkzlAtXfjb5QmECiQ== ---END PC DATA---
URLs
-
http://gandcrabmfe6mnef.onion/351e99ea10bcaf65
Signatures
- Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (282) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened (read-only) \??\N: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened (read-only) \??\Q: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened (read-only) \??\U: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened (read-only) \??\Y: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened (read-only) \??\B: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened (read-only) \??\E: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened (read-only) \??\K: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened (read-only) \??\M: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened (read-only) \??\O: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened (read-only) \??\P: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened (read-only) \??\R: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened (read-only) \??\T: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened (read-only) \??\G: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened (read-only) \??\I: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened (read-only) \??\W: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened (read-only) \??\X: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened (read-only) \??\Z: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened (read-only) \??\S: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened (read-only) \??\V: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened (read-only) \??\J: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened (read-only) \??\A: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened (read-only) \??\H: a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\pidor.bmp" a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe - Drops file in Program Files directory 23 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DFLQQ-DECRYPT.txt a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\10bca88810bcaf6544.lock a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File created C:\Program Files\10bca88810bcaf6544.lock a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened for modification C:\Program Files\LockGrant.vb a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened for modification C:\Program Files\MeasureRead.vstm a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened for modification C:\Program Files\ProtectGet.dwfx a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened for modification C:\Program Files\UndoSave.kix a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File created C:\Program Files (x86)\10bca88810bcaf6544.lock a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened for modification C:\Program Files\DebugTest.reg a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened for modification C:\Program Files\EditApprove.ram a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened for modification C:\Program Files\ResolveDebug.wpl a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened for modification C:\Program Files\SyncSend.M2V a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File created C:\Program Files\DFLQQ-DECRYPT.txt a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened for modification C:\Program Files\BackupComplete.htm a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened for modification C:\Program Files\NewRequest.cr2 a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened for modification C:\Program Files\RequestRead.dot a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened for modification C:\Program Files\UnpublishWrite.zip a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File opened for modification C:\Program Files\RemoveWait.xlsx a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File created C:\Program Files (x86)\DFLQQ-DECRYPT.txt a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DFLQQ-DECRYPT.txt a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\10bca88810bcaf6544.lock a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\10bca88810bcaf6544.lock a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DFLQQ-DECRYPT.txt a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3068 a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe 3068 a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2616 wmic.exe Token: SeSecurityPrivilege 2616 wmic.exe Token: SeTakeOwnershipPrivilege 2616 wmic.exe Token: SeLoadDriverPrivilege 2616 wmic.exe Token: SeSystemProfilePrivilege 2616 wmic.exe Token: SeSystemtimePrivilege 2616 wmic.exe Token: SeProfSingleProcessPrivilege 2616 wmic.exe Token: SeIncBasePriorityPrivilege 2616 wmic.exe Token: SeCreatePagefilePrivilege 2616 wmic.exe Token: SeBackupPrivilege 2616 wmic.exe Token: SeRestorePrivilege 2616 wmic.exe Token: SeShutdownPrivilege 2616 wmic.exe Token: SeDebugPrivilege 2616 wmic.exe Token: SeSystemEnvironmentPrivilege 2616 wmic.exe Token: SeRemoteShutdownPrivilege 2616 wmic.exe Token: SeUndockPrivilege 2616 wmic.exe Token: SeManageVolumePrivilege 2616 wmic.exe Token: 33 2616 wmic.exe Token: 34 2616 wmic.exe Token: 35 2616 wmic.exe Token: SeIncreaseQuotaPrivilege 2616 wmic.exe Token: SeSecurityPrivilege 2616 wmic.exe Token: SeTakeOwnershipPrivilege 2616 wmic.exe Token: SeLoadDriverPrivilege 2616 wmic.exe Token: SeSystemProfilePrivilege 2616 wmic.exe Token: SeSystemtimePrivilege 2616 wmic.exe Token: SeProfSingleProcessPrivilege 2616 wmic.exe Token: SeIncBasePriorityPrivilege 2616 wmic.exe Token: SeCreatePagefilePrivilege 2616 wmic.exe Token: SeBackupPrivilege 2616 wmic.exe Token: SeRestorePrivilege 2616 wmic.exe Token: SeShutdownPrivilege 2616 wmic.exe Token: SeDebugPrivilege 2616 wmic.exe Token: SeSystemEnvironmentPrivilege 2616 wmic.exe Token: SeRemoteShutdownPrivilege 2616 wmic.exe Token: SeUndockPrivilege 2616 wmic.exe Token: SeManageVolumePrivilege 2616 wmic.exe Token: 33 2616 wmic.exe Token: 34 2616 wmic.exe Token: 35 2616 wmic.exe Token: SeBackupPrivilege 2532 vssvc.exe Token: SeRestorePrivilege 2532 vssvc.exe Token: SeAuditPrivilege 2532 vssvc.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2616 3068 a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe 30 PID 3068 wrote to memory of 2616 3068 a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe 30 PID 3068 wrote to memory of 2616 3068 a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe 30 PID 3068 wrote to memory of 2616 3068 a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe 30 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 bd37602dbbbbea670e3967654fde1f179d790226c04bee594c79c91c733af34e
- MD5 8a688c9dc6f28faef42760accba00e0a
- SHA1 830d4ea09db03527e33c174c041951760cccd204
- SHA512 783749bf999e2eb6621057b4346a27a9d9b6c576673d15854b5545d6177b313d7b5c26444417e55eb238e221db5501c5828ff1a2df47efdbd9faf78b7946f20a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 80e69e3feb6b5242573bbd450340a84b499b04d2bacd07b1d1c7d35a88e50d54
- MD5 a91109a2d2d946a76b535643a23e5262
- SHA1 798a227e49973ea6105b1aedb04d0976f52a5749
- SHA512 056d398d1a4b32173b642efae8af6e714e18188edaf7377d6abcc83bcb626ed1e6d39d1b1ae1d2affddabd9e63b0c1d3068f7b6a60e373184e0b8ec9137bb48b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab4378.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar438B.tmp
- Size 171KB
- SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
- MD5 9c0c641c06238516f27941aa1166d427
- SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
- SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
- SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar446B.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-2721934792-624042501-2768869379-1000\DFLQQ-DECRYPT.txt
- Size 8KB
- SHA256 f3d94313839d062e0dbd8952032f46391b427e528821edadcb697bc95eb89583
- MD5 90bb1de8a7ff2aad5af93ce6545f68d3
- SHA1 f27b420fd9af4c8da0cb13a6106fc83351f7652a
- SHA512 b96af7db8b429914456b3b9f0377dfa18f00c8aabd809b6d2f3093476a61e064ff1094ae99f26f3fdf408e8b602f3a8bc5356852820a6566d1ad2249be8875bb
- SSDEEP 192:NhfuAi3JSAIoEjdyaDaTnV79M8miiS14Fn:NhGAi3JpWRuRGG4Fn
- MD5 SHA1 SHA512 SSDEEP