Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/06/2024, 22:22
Static task
static1
Behavioral task
behavioral1
Sample
b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe
-
Size
92KB
-
MD5
b57980b72eb6497212f86353447d2e5f
-
SHA1
27b49e51dfde8186287bc936e1197423951fa9a6
-
SHA256
498df06b0a8d8715e818a582c919bcb5964e5f0eef64bd21f32e52b4ec4861ab
-
SHA512
c9e19dc2a5845176954599e0c0b9b9c06c941f79d65f86ead0120f0eb6a3fe2976502127f31f5c35fc57304939665f57f24c248eb7418b64694587930fabf4cc
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4AD8Dsx7Zoygwff/WDb4hkUwqS06ky597:Qw+asqN5aW/hLXZ2bDbCkUK0
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (517) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe -
Drops startup file 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe = "C:\\Windows\\System32\\b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe" b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Public\Music\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\Searches\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Public\Documents\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Public\Libraries\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\Documents\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Public\Downloads\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Public\Videos\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\Music\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\Links\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Public\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\Videos\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File created C:\Windows\System32\Info.hta b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\is.txt.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\uk.pak b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClient.resources.dll.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\main.css.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\classlist b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_10_p010_plugin.dll.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\THMBNAIL.PNG b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-20.png b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Xml.dll.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Design.dll.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OMRAUT.DLL.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\SpreadsheetCompare_col.hxc.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\Staging.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\it-it\ui-strings.js.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ul-oob.xrm-ms b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\System\ole db\xmlrwbin.dll.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinEditors.v8.1.dll b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\vlc.mo.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\PREVIEW.GIF.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\ui-strings.js.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\MSFT_PackageManagement.schema.mfl b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationTypes.resources.dll b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSplashLogo.scale-100.png b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ca-es\ui-strings.js.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\AppxSignature.p7x b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\lib\ext\zipfs.jar.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\sfs_icons.png.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_dummy_plugin.dll.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libcaf_plugin.dll b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected].[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\main.css.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\TecProxy.dll.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ko-kr\ui-strings.js b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\ui-strings.js.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-pl.xrm-ms b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL065.XML b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fi-fi\ui-strings.js.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square150x150Logo.scale-100.png b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailBadge.scale-100.png b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\tt.pak.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogoDev.png.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected].[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\PREVIEW.GIF.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\cstm_brand_preview2x.png.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fi-fi\ui-strings.js.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXT b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_de.dll.id-E1AE8CD8.[[email protected]].bip b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4900 vssadmin.exe 2396 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 7284 vssvc.exe Token: SeRestorePrivilege 7284 vssvc.exe Token: SeAuditPrivilege 7284 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4508 wrote to memory of 4340 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 80 PID 4508 wrote to memory of 4340 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 80 PID 4340 wrote to memory of 4148 4340 cmd.exe 82 PID 4340 wrote to memory of 4148 4340 cmd.exe 82 PID 4340 wrote to memory of 4900 4340 cmd.exe 83 PID 4340 wrote to memory of 4900 4340 cmd.exe 83 PID 4508 wrote to memory of 6804 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 87 PID 4508 wrote to memory of 6804 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 87 PID 6804 wrote to memory of 4520 6804 cmd.exe 89 PID 6804 wrote to memory of 4520 6804 cmd.exe 89 PID 6804 wrote to memory of 2396 6804 cmd.exe 90 PID 6804 wrote to memory of 2396 6804 cmd.exe 90 PID 4508 wrote to memory of 6384 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 91 PID 4508 wrote to memory of 6384 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 91 PID 4508 wrote to memory of 4436 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 92 PID 4508 wrote to memory of 4436 4508 b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe 92 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b57980b72eb6497212f86353447d2e5f_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:4148
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4900
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:6804 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:4520
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2396
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵PID:6384
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵PID:4436
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7284
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-E1AE8CD8.[[email protected]].bip
Filesize2.7MB
MD5b6a673a3408581b474f6888f683c3092
SHA1e2be74c64f75be2875c57d26b50f7b0290332e56
SHA25691d095d4ae91c177d09914f40aeb65c522f6fe200507583294e3ba9203c1e10d
SHA512a6fafe3c9fadb9e4a8cba832523c90230493686887ad40042161dee3a6489826614e04bb56298650b9fd2aadb90bcfe6a5f38f0920f07dd1435767300f69d113
-
Filesize
13KB
MD59c6d761c4e61e2e364318fe150803ea9
SHA1557750a00f271e65f8fab641ef620b1b937d9a72
SHA256371ada3ed0f3114240ffe825bf87611f7a8e20bc63da476d81c88fb900c72d29
SHA512b863597cbb0185993285ccb130fec00e870676b8938423d856aea84b56b8611d90152d8166ecb3aef3d4a90167c7e57fbccec0265aad30f4191250fc0c91c80b