291dd0928569306e54b7ff9fc217bf704d646960fe1ec25a7cc431e4af6874e4

General

Target
a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
Size 142KB
Sample240613-ehm9bstcph
SHA256 291dd0928569306e54b7ff9fc217bf704d646960fe1ec25a7cc431e4af6874e4
MD5 a3c0870cf6e4ca6e43d78a64e6b87c5c
SHA1 5704e05575d026a1c87d1496a9c63d5979ad9e39
SHA512 d31745d4deb5a89aa5ef8c6d46a73738dbead525072c20cc55e5e25d7f1a22de031f26925942209c4b6f3f48414df57fcc169c1b61fde2119bb2c8fca7d7eb18
SSDEEP 3072:DJMawtnGqtWoKeZC62aoNUSFcsCDFgfBS:3w9vteQJYUGcPO
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

persistence ransomware

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oXnEn2JlQT = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe"	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\Q:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\U:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\Z:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\L:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\O:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\V:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\W:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\X:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\B:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\I:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\K:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\M:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\A:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\G:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\T:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\J:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\N:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\R:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\F:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\E:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\P:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\S:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\Y:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened (read-only)	\??\D:	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\73734g2.bmp"	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\EnterRevoke.ttc	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened for modification	\??\c:\program files\GetSuspend.ps1xml	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened for modification	\??\c:\program files\InvokeReceive.ADTS	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File created	\??\c:\program files\98yanp-CHECK.txt	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File created	\??\c:\program files (x86)\98yanp-CHECK.txt	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MeasurePush.css	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened for modification	\??\c:\program files\OptimizeDismount.xht	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SearchRevoke.xsl	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UnregisterWatch.M2V	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened for modification	\??\c:\program files\WatchCheckpoint.contact	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CopyAssert.mht	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
File opened for modification	\??\c:\program files\LockCompress.wmv	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
432	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
432	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
6052	powershell.exe
6052	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	432	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
Token: SeDebugPrivilege	6052	powershell.exe
Token: SeBackupPrivilege	3380	vssvc.exe
Token: SeRestorePrivilege	3380	vssvc.exe
Token: SeAuditPrivilege	3380	vssvc.exe
Token: SeTakeOwnershipPrivilege	432	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 6052	432	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe	81
PID 432 wrote to memory of 6052	432	a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe	81

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3c0870cf6e4ca6e43d78a64e6b87c5c_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6052

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:4632

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

98yanp-CHECK.txt

Path C:\Users\98yanp-CHECK.txt
Size 4KB
SHA256 56786bd40c058c5ea0764d1064fb86e98a70d0f86b45e36bbe573ef82eacd2f2
MD5 333274125134bf50be1cf023446b5f47
SHA1 a494f925ebf8a85f16efe83b675b266aafdfdde8
SHA512 efab77a91e8c31e38325ca35d66e5483176b4c092cf0dab93c0475824299d66f3505cc731cb87219c757500ec95c41d5a870335e6c65cd89624cce6c053ab77e
SSDEEP 96:hTnTx03QiC+6cmT2I3I1kQziRYDaHM+GQoFdXeV:lnQC72I3GkQzxAaQomV
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_2ib0uhtw.vfo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2ib0uhtw.vfo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/6052-0-0x00007FFA03793000-0x00007FFA03795000-memory.dmp

Download

memory/6052-6-0x000001FABF670000-0x000001FABF692000-memory.dmp

Download

memory/6052-11-0x00007FFA03790000-0x00007FFA04251000-memory.dmp

Download

memory/6052-12-0x00007FFA03790000-0x00007FFA04251000-memory.dmp

Download

memory/6052-15-0x00007FFA03790000-0x00007FFA04251000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads