globeimposter | c45ef4a35047e14d8eaf54cab44a432be18e93915ac26a2f1294d260f220aea8

General

Target

b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
Size

170KB
MD5

b0ee9dae7de7781ea809278c48c310a5
SHA1

28be65219441d78399027aa42c9cc7456ee67130
SHA256

c45ef4a35047e14d8eaf54cab44a432be18e93915ac26a2f1294d260f220aea8
SHA512

5b954dd7bd05549d8f29b720db615b4e79cf07a41efab7ed765eb8533ad429c0d351e610900fbc6ee8f1dc5f2c8c10e53a494a4f9ec8ffd54444a8ab0c2bd8ff
SSDEEP

3072:cPgObYtVfyWSBNSXxPB5fXGWgP548gbl9GNPz+DPGfK:ygJ7Gw57WWg6l9iSl

Score

10^/10

globeimposter persistence ransomware spyware stealer

Malware Config

Signatures

GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter
Renames multiple (9084) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Roaming\\b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe"	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe

Drops desktop.ini file(s) 30 IoCs

Processes:

b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Users\Public\Documents\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Public\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2447855248-390457009-3660902674-1000\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2447855248-390457009-3660902674-1000\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\desktop.ini	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

Processes:

b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MYSL.ICO	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.ViewElements.winmd	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Reflection.Emit.Lightweight.dll	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.scale-125.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\thumb_animation.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\STSUCRES.DLL	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Read___ME.html	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsMedTile.scale-125.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\it-it\Read___ME.html	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\gnsdk_fp.dll	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\BuildInfo.xml	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-IN\en-IN_female_TTS\common.lua	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarBadge.scale-100.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-24_contrast-white.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\ui-strings.js	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderWideTile.contrast-white_scale-100.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxAccountsSmallTile.scale-100.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeMediumTile.scale-125.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\progress.gif	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Concrete.dxt	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\Read___ME.html	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\Microsoft.Services.Store.Engagement.winmd	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\deploy.dll	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-100.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\LargeTile.scale-200_contrast-black.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-GoogleCloudCacheMini.scale-200.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Outlook.scale-100.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\plugin.js	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-96_altform-unplated_contrast-black.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\caller-id-illustration.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-lightunplated.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailWideTile.scale-150.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\archives\data-80bd83b592567d50f84a26711cad1cf82f4057f1.archive	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\WideTile.scale-100_contrast-white.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirect3d11_plugin.dll	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-fr\Read___ME.html	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-ma\ui-strings.js	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\SmallTile.scale-200.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-40.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_checkbox_selected_18.svg	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\Read___ME.html	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\osm.x-none.msi.16.x-none.tree.dat	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Runtime.Numerics.dll	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.winmd	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-20.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookWideTile.scale-200.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.targetsize-96_altform-unplated_contrast-white.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\ui-strings.js	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailMediumTile.scale-200.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_altform-unplated_contrast-white.png	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

372 1556 WerFault.exe b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe

pid process

1556 b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
1556 b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe

pid	pid_target	process	target process
372	1556	WerFault.exe	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe

pid	process
1556	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
1556	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.execmd.exe

description	pid	process	target process
PID 1556 wrote to memory of 3004	1556	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe	cmd.exe
PID 1556 wrote to memory of 3004	1556	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe	cmd.exe
PID 1556 wrote to memory of 3004	1556	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe	cmd.exe
PID 3004 wrote to memory of 2328	3004	cmd.exe	reg.exe
PID 3004 wrote to memory of 2328	3004	cmd.exe	reg.exe
PID 3004 wrote to memory of 2328	3004	cmd.exe	reg.exe
PID 1556 wrote to memory of 2968	1556	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe	cmd.exe
PID 1556 wrote to memory of 2968	1556	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe	cmd.exe
PID 1556 wrote to memory of 2968	1556	b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe	cmd.exe
PID 3004 wrote to memory of 4860	3004	cmd.exe	reg.exe
PID 3004 wrote to memory of 4860	3004	cmd.exe	reg.exe
PID 3004 wrote to memory of 4860	3004	cmd.exe	reg.exe
PID 3004 wrote to memory of 2460	3004	cmd.exe	reg.exe
PID 3004 wrote to memory of 2460	3004	cmd.exe	reg.exe
PID 3004 wrote to memory of 2460	3004	cmd.exe	reg.exe
PID 3004 wrote to memory of 1512	3004	cmd.exe	attrib.exe
PID 3004 wrote to memory of 1512	3004	cmd.exe	attrib.exe
PID 3004 wrote to memory of 1512	3004	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

1512 attrib.exe

pid	process
1512	attrib.exe

C:\Users\Admin\AppData\Local\Temp\b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp3520.tmp.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:3004

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
3⤵
PID:2328

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
3⤵
PID:4860

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
3⤵
PID:2460

C:\Windows\SysWOW64\attrib.exe
attrib Default.rdp -s -h
3⤵
- Views/modifies file attributes
PID:1512

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\b0ee9dae7de7781ea809278c48c310a5_JaffaCakes118.exe > nul
2⤵
PID:2968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 1264
2⤵
- Program crash
PID:372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1556 -ip 1556
1⤵
PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2447855248-390457009-3660902674-1000\desktop.ini
Filesize
1KB

MD5
eecc3803df4f1fbe7faf79bd7c0d849a

SHA1
0f87c712ed54aca14c3858c065d42511940a9b99

SHA256
3b9cc95985b9898dc57649ba492e21d02eba2a7e79e0a06fd5e0069d4eebdb4f

SHA512
0ccb6a321a3af3b8271207dc3743eb4b05aecda2df5e0040d329b9b8dda75daffae0acb634e2358c9d53cd99df7f30006e47084443a2d00147adc43ee196ed13

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3520.tmp.bat
Filesize
445B

MD5
32d8f7a3d0c796cee45f64b63c1cca38

SHA1
d58466430a2bba8641bd92c880557379e25b140c

SHA256
1a6f73b5c28d1c10f63f2056068c1de61487b8cf8f1dcf7516548df144b3e9ea

SHA512
288213b92a03ac750ea319bb23c52e7bdf47f5a47ecb70c905c7610a84c63a3ec0a30801b5880e6def8df2c9f577082072e342198d23a19f64e561923e1ef698

Download Submit
C:\Users\Public\Videos\Read___ME.html
Filesize
4KB

MD5
86d3c7221fbb8da8569513a61f05183f

SHA1
81696a89194c4a1236344b50ff3fcb6cedbd2576

SHA256
e61a4c75150d915eb4f8a2a20ae3bbcbe7f26f8743351b5e7f169c825a7d67d9

SHA512
c11038f463108c7b487e4b23e42b0023d9684025110e4d6b70f9e9dae48a8b6b7f7b856a11cb09562416a2abb12894cfdf5a09ee60889467f587c00eb75f4cbe

Download Submit
memory/1556-3-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1556-1-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/1556-1531-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/1556-3482-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/1556-4649-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads