dharma | 3a12c5a7af5715d62944770c6dd9da366d2f4d20265b9d8f32e79b72705743a0

General

Target

ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
Size

268KB
MD5

ac870d98fcfca054b2c4140bc584c9c6
SHA1

7c49cf18f734afc169914568410bd4fee0a22e4b
SHA256

3a12c5a7af5715d62944770c6dd9da366d2f4d20265b9d8f32e79b72705743a0
SHA512

7e17e7685219258b0ffde772b76defdb1238fbee9cadca67075648b06c7178dd75776fed277fb25d1028cb25a58a43e5888883c9b450e9988fb3acc55c1dd8ac
SSDEEP

6144:ZhWeBAPY6czY/rRPsZdIDgQV7lGLCz1O7i:6eBQHgQ9lZV

Score

10^/10

dharma defense_evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message 69F10C1E In case of no answer in 24 hours write us to theese e-mails: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (514) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe

Drops startup file 5 IoCs

Processes:

ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe = "C:\\Windows\\System32\\ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe"	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Program Files\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Public\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

Processes:

ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\System32\ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Windows\System32\Info.hta	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

Processes:

ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\ui-strings.js	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnvpxy.dll.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-core-localization-l1-2-0.dll	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\km.pak.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\images\Square71x71Logo.scale-100.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Square150x150Logo.scale-100.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_altform-unplated_contrast-black.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fr-CA\View3d\3DViewerProductDescription-universal.xml	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\SourceAppService.winmd	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\msasxpress.dll	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSTYLE.DLL.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\s_radio_unselected_18.svg.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ui-strings.js.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\plugin.js	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ru_get.svg.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.Misc.v11.1.dll	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Pages_R_RHP.aapp	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fill-sign-2x.png.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-tw\ui-strings.js.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_de.dll	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\id.pak	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_Tracing.jpg	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ppd.xrm-ms	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\msedgeupdateres_sr-Cyrl-BA.dll.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\ui-strings.js.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view.png.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONBttnWD.dll	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\EVRGREEN.ELM	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\Add-Numbers.Tests.ps1	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\Microsoft.PowerShell.PackageManagement.resources.dll.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.SPREADSHEETCOMPARE.16.1033.hxn.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-24.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fi-fi\ui-strings.js.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\AFTRNOON.ELM.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W2.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\eu-es\ui-strings.js.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\pt-br\ui-strings.js.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8FR.DLL.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\Logo.scale-100_contrast-white.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-200_contrast-white.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-256_altform-colorize.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailWideTile.scale-125.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-30_altform-unplated.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsSmallTile.contrast-black_scale-125.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 64 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4920	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
2092	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
2540	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4016	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4620	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
1828	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4112	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
832	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
2420	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
2656	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
5012	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
1532	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
756	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
3316	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
1028	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
3684	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
2176	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
212	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
280	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
1460	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
532	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
8672	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
8676	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
1664	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
10272	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
10896	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4816	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
6940	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
7872	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4644	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
10976	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
8236	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
7332	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
6576	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
6256	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
2268	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
9380	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
8640	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4308	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
5312	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
8072	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
3000	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
5168	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
8900	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4116	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
5648	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
3592	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
7276	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
8852	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
9436	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
8972	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
9004	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
1992	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
7824	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
300	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
7876	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
11248	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
8148	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
8592	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
6976	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
3956	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
1040	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
6344	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
7504	4992	WerFault.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe

Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

2484 vssadmin.exe
7404 vssadmin.exe

pid	process
2484	vssadmin.exe
7404	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe

pid	process
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 4056 vssvc.exe
Token: SeRestorePrivilege 4056 vssvc.exe
Token: SeAuditPrivilege 4056 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	4056	vssvc.exe
Token: SeRestorePrivilege	4056	vssvc.exe
Token: SeAuditPrivilege	4056	vssvc.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.execmd.execmd.exe

description	pid	process	target process
PID 4992 wrote to memory of 4904	4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe	cmd.exe
PID 4992 wrote to memory of 4904	4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe	cmd.exe
PID 4904 wrote to memory of 1012	4904	cmd.exe	mode.com
PID 4904 wrote to memory of 1012	4904	cmd.exe	mode.com
PID 4904 wrote to memory of 2484	4904	cmd.exe	vssadmin.exe
PID 4904 wrote to memory of 2484	4904	cmd.exe	vssadmin.exe
PID 4992 wrote to memory of 4800	4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe	cmd.exe
PID 4992 wrote to memory of 4800	4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe	cmd.exe
PID 4800 wrote to memory of 7704	4800	cmd.exe	mode.com
PID 4800 wrote to memory of 7704	4800	cmd.exe	mode.com
PID 4800 wrote to memory of 7404	4800	cmd.exe	vssadmin.exe
PID 4800 wrote to memory of 7404	4800	cmd.exe	vssadmin.exe
PID 4992 wrote to memory of 5356	4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe	mshta.exe
PID 4992 wrote to memory of 5356	4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe	mshta.exe
PID 4992 wrote to memory of 10172	4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe	mshta.exe
PID 4992 wrote to memory of 10172	4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe	mshta.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4992

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4904

C:\Windows\system32\mode.com
mode con cp select=1251
3⤵
PID:1012

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 528
2⤵
- Program crash
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 532
2⤵
- Program crash
PID:2092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 576
2⤵
- Program crash
PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 612
2⤵
- Program crash
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 632
2⤵
- Program crash
PID:4620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 588
2⤵
- Program crash
PID:1828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 548
2⤵
- Program crash
PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 656
2⤵
- Program crash
PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 724
2⤵
- Program crash
PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 676
2⤵
- Program crash
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 752
2⤵
- Program crash
PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 796
2⤵
- Program crash
PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 760
2⤵
- Program crash
PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 816
2⤵
- Program crash
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 852
2⤵
- Program crash
PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 888
2⤵
- Program crash
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 892
2⤵
- Program crash
PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 888
2⤵
- Program crash
PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 992
2⤵
- Program crash
PID:280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 852
2⤵
- Program crash
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 912
2⤵
- Program crash
PID:532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 868
2⤵
- Program crash
PID:8672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 872
2⤵
- Program crash
PID:8676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 952
2⤵
- Program crash
PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 936
2⤵
- Program crash
PID:10272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 952
2⤵
- Program crash
PID:10896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 800
2⤵
- Program crash
PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 792
2⤵
- Program crash
PID:6940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1016
2⤵
- Program crash
PID:7872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 892
2⤵
- Program crash
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 940
2⤵
- Program crash
PID:10976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 868
2⤵
- Program crash
PID:8236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 912
2⤵
- Program crash
PID:7332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1008
2⤵
- Program crash
PID:6576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 896
2⤵
- Program crash
PID:6256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 900
2⤵
- Program crash
PID:2268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 932
2⤵
- Program crash
PID:9380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1012
2⤵
- Program crash
PID:8640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 956
2⤵
- Program crash
PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 796
2⤵
- Program crash
PID:5312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 848
2⤵
- Program crash
PID:8072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 788
2⤵
- Program crash
PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 996
2⤵
- Program crash
PID:5168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 876
2⤵
- Program crash
PID:8900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 840
2⤵
- Program crash
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 864
2⤵
- Program crash
PID:5648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 876
2⤵
- Program crash
PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 828
2⤵
- Program crash
PID:7276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 848
2⤵
- Program crash
PID:8852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 948
2⤵
- Program crash
PID:9436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 836
2⤵
- Program crash
PID:8972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 800
2⤵
- Program crash
PID:9004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 840
2⤵
- Program crash
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1004
2⤵
- Program crash
PID:7824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 876
2⤵
- Program crash
PID:300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 828
2⤵
- Program crash
PID:7876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 836
2⤵
- Program crash
PID:11248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 924
2⤵
- Program crash
PID:8148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1004
2⤵
- Program crash
PID:8592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 840
2⤵
- Program crash
PID:6976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 792
2⤵
- Program crash
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 872
2⤵
- Program crash
PID:1040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1000
2⤵
- Program crash
PID:6344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 748
2⤵
- Program crash
PID:7504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 800
2⤵
PID:3084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 848
2⤵
PID:5256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 748
2⤵
PID:7836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 864
2⤵
PID:7508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 996
2⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 788
2⤵
PID:8308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 936
2⤵
PID:10084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 872
2⤵
PID:7644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 736
2⤵
PID:6836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 844
2⤵
PID:7236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 748
2⤵
PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 864
2⤵
PID:9580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 872
2⤵
PID:9552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 844
2⤵
PID:6424

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4800

C:\Windows\system32\mode.com
mode con cp select=1251
3⤵
PID:7704

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:7404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 884
2⤵
PID:10372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1136
2⤵
PID:6224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1136
2⤵
PID:7560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1320
2⤵
PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1364
2⤵
PID:9656

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
2⤵
PID:5356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1288
2⤵
PID:10196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1528
2⤵
PID:10124

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
2⤵
PID:10172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1556
2⤵
PID:10004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1396
2⤵
PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4992 -ip 4992
1⤵
PID:4940

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4992 -ip 4992
1⤵
PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4992 -ip 4992
1⤵
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4992 -ip 4992
1⤵
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4992 -ip 4992
1⤵
PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4992 -ip 4992
1⤵
PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4992 -ip 4992
1⤵
PID:1040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4992 -ip 4992
1⤵
PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4992 -ip 4992
1⤵
PID:3564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4992 -ip 4992
1⤵
PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4992 -ip 4992
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4992 -ip 4992
1⤵
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4992 -ip 4992
1⤵
PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4992 -ip 4992
1⤵
PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4992 -ip 4992
1⤵
PID:4184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4992 -ip 4992
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4992 -ip 4992
1⤵
PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4992 -ip 4992
1⤵
PID:1768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4992 -ip 4992
1⤵
PID:1084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4992 -ip 4992
1⤵
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4992 -ip 4992
1⤵
PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4992 -ip 4992
1⤵
PID:8872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4992 -ip 4992
1⤵
PID:6728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4992 -ip 4992
1⤵
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4992 -ip 4992
1⤵
PID:1280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4992 -ip 4992
1⤵
PID:9384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4992 -ip 4992
1⤵
PID:8608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4992 -ip 4992
1⤵
PID:8932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4992 -ip 4992
1⤵
PID:7852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4992 -ip 4992
1⤵
PID:6176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4992 -ip 4992
1⤵
PID:9220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4992 -ip 4992
1⤵
PID:6872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4992 -ip 4992
1⤵
PID:6136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4992 -ip 4992
1⤵
PID:5316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4992 -ip 4992
1⤵
PID:6048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4992 -ip 4992
1⤵
PID:1512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4992 -ip 4992
1⤵
PID:8516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4992 -ip 4992
1⤵
PID:8824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4992 -ip 4992
1⤵
PID:8496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4992 -ip 4992
1⤵
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4992 -ip 4992
1⤵
PID:9160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4992 -ip 4992
1⤵
PID:9468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4992 -ip 4992
1⤵
PID:8552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4992 -ip 4992
1⤵
PID:7788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4992 -ip 4992
1⤵
PID:9252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4992 -ip 4992
1⤵
PID:7796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4992 -ip 4992
1⤵
PID:5368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4992 -ip 4992
1⤵
PID:7920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4992 -ip 4992
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4992 -ip 4992
1⤵
PID:8096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4992 -ip 4992
1⤵
PID:5724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4992 -ip 4992
1⤵
PID:8980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4992 -ip 4992
1⤵
PID:5568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4992 -ip 4992
1⤵
PID:6864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4992 -ip 4992
1⤵
PID:7832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4992 -ip 4992
1⤵
PID:5420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4992 -ip 4992
1⤵
PID:7812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4992 -ip 4992
1⤵
PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4992 -ip 4992
1⤵
PID:8788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4992 -ip 4992
1⤵
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4992 -ip 4992
1⤵
PID:9664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4992 -ip 4992
1⤵
PID:7452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4992 -ip 4992
1⤵
PID:6896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4992 -ip 4992
1⤵
PID:6820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4992 -ip 4992
1⤵
PID:5384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4992 -ip 4992
1⤵
PID:9212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4992 -ip 4992
1⤵
PID:8960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4992 -ip 4992
1⤵
PID:7056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4992 -ip 4992
1⤵
PID:7636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4992 -ip 4992
1⤵
PID:9692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4992 -ip 4992
1⤵
PID:9568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4992 -ip 4992
1⤵
PID:7120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4992 -ip 4992
1⤵
PID:6824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4992 -ip 4992
1⤵
PID:7144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4992 -ip 4992
1⤵
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4992 -ip 4992
1⤵
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4992 -ip 4992
1⤵
PID:7464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4992 -ip 4992
1⤵
PID:3968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4992 -ip 4992
1⤵
PID:9324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4992 -ip 4992
1⤵
PID:536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4992 -ip 4992
1⤵
PID:7680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4992 -ip 4992
1⤵
PID:9968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4992 -ip 4992
1⤵
PID:9444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4992 -ip 4992
1⤵
PID:9788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4992 -ip 4992
1⤵
PID:9620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4992 -ip 4992
1⤵
PID:884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4992 -ip 4992
1⤵
PID:376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1

T1047

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

2

T1070

File Deletion

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk-1.8\javafx-src.zip.id-69F10C1E.[[email protected]].bot

Filesize
5.7MB

MD5
b50dfe297cb2b3480b98041d4b6eb3ff

SHA1
8e337cae48792475a05360cac9220262d0c5060e

SHA256
57a0b90d2b5ab5c1ac830596dde93e33542c8f2c2f4752e1a37db05dc089fc20

SHA512
e5d622098ae60a558de8c7c207824e080d993357bf848193cab14c989e36e2a3903f70e13cc6015884d6fbe106d1deefd093cd9c013f30a1163ec742ad3d70c9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Filesize
13KB

MD5
fac097a0d7f0c2d1cfa835cf180cc23e

SHA1
b6ab7054c01f2804c70e41e26f0dcb7558a728b7

SHA256
513c36547a1d2506e1d5684df55fb369968d2867f4a1afec9bfc432b4331f521

SHA512
af645b49d712d9572f03688cf4108b90d707ad569b2783ae825a0ad509639efea220fe2882836d2be4d7201ca48dc40fb97fd0104b0cad4e81cda54e4208a91a

Download Submit
memory/4992-0-0x0000000000400000-0x00000000005E9000-memory.dmp

Filesize
1.9MB

Download
memory/4992-4-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4992-3-0x0000000000850000-0x0000000000869000-memory.dmp

Filesize
100KB

Download
memory/4992-2-0x00000000008B0000-0x00000000009B0000-memory.dmp

Filesize
1024KB

Download
memory/4992-7682-0x0000000000400000-0x00000000005E9000-memory.dmp

Filesize
1.9MB

Download
memory/4992-24848-0x00000000008B0000-0x00000000009B0000-memory.dmp

Filesize
1024KB

Download
memory/4992-24849-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads