Analysis
- max time kernel
155s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
16/06/2024, 21:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b548a2e179907d05b6b91de5db865957_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
b548a2e179907d05b6b91de5db865957_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target b548a2e179907d05b6b91de5db865957_JaffaCakes118.exe
- Size 360KB
- Sample240616-z96j7ssfpm
- SHA256 6476dc4d4cf45ff08448309f65e1702c2770a93ef002475294c546e19bd717f0
- MD5 b548a2e179907d05b6b91de5db865957
- SHA1 c472e35f13fd7a3a5a5b2bb9cf0683bbfa6faf03
- SHA512 4318e7b12bf2cf14d190e91b30313484efbba370f166829e58a43c19d5e479f3167dfc9cbe7d0683d73f245d4b2ee752ec6007811c4a879ae51a133048bcffd9
- SSDEEP 6144:HSfBiH4YIwLseDtcixL1V02VcKUGstieOWEK0kVW:ygp1hcil1VBueNxnIW
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Path
-
C:\PerfLogs\_ReCoVeRy_+ytpvy.txt
-
teslacrypt
Ransom Note
- NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA4096 More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA4096 Key , both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1 - http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/E36DCC57BC7393AA 2 - http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/E36DCC57BC7393AA 3 - http://yyre45dbvn2nhbefbmh.begumvelic.at/E36DCC57BC7393AA If for some reasons the addresses are not available, follow these steps: 1 - Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2 - After a successful installation, run the browser 3 - Type in the address bar: xlowfznrg4wf7dli.onion/E36DCC57BC7393AA 4 - Follow the instructions on the site IMPORTANT INFORMATION Your personal pages http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/E36DCC57BC7393AA http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/E36DCC57BC7393AA http://yyre45dbvn2nhbefbmh.begumvelic.at/E36DCC57BC7393AA Your personal page Tor-Browser xlowfznrg4wf7dli.ONION/E36DCC57BC7393AA
URLs
-
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/E36DCC57BC7393AA
-
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/E36DCC57BC7393AA
-
http://yyre45dbvn2nhbefbmh.begumvelic.at/E36DCC57BC7393AA
-
http://xlowfznrg4wf7dli.ONION/E36DCC57BC7393AA
Signatures
- TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (877) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation b548a2e179907d05b6b91de5db865957_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation ixsjdoortpnw.exe - Drops startup file 6 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+ytpvy.png ixsjdoortpnw.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+ytpvy.txt ixsjdoortpnw.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+ytpvy.html ixsjdoortpnw.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+ytpvy.png ixsjdoortpnw.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+ytpvy.txt ixsjdoortpnw.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+ytpvy.html ixsjdoortpnw.exe - Executes dropped EXE 1 IoCs
pid Process 1616 ixsjdoortpnw.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\skxwcpl = "C:\\Windows\\system32\\CMD.EXE /c start C:\\Windows\\ixsjdoortpnw.exe" ixsjdoortpnw.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_ReCoVeRy_+ytpvy.txt ixsjdoortpnw.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\text_renderer\_ReCoVeRy_+ytpvy.html ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\_ReCoVeRy_+ytpvy.txt ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\_ReCoVeRy_+ytpvy.txt ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MicrosoftLogo.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_altform-unplated_contrast-white.png ixsjdoortpnw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1036\_ReCoVeRy_+ytpvy.txt ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-40.png ixsjdoortpnw.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\_ReCoVeRy_+ytpvy.html ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\_ReCoVeRy_+ytpvy.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square150x150\PaintMedTile.scale-200.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OrientationControlConeHover.png ixsjdoortpnw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f7\_ReCoVeRy_+ytpvy.html ixsjdoortpnw.exe File opened for modification C:\Program Files\Windows Media Player\uk-UA\_ReCoVeRy_+ytpvy.html ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-54_altform-unplated.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-40_altform-fullcolor.png ixsjdoortpnw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\_ReCoVeRy_+ytpvy.txt ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Content\SaturationGradient.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+ytpvy.html ixsjdoortpnw.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\_ReCoVeRy_+ytpvy.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-200_contrast-white.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteMediumTile.scale-150.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarBadge.scale-400.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailWideTile.scale-150.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-200.png ixsjdoortpnw.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\_ReCoVeRy_+ytpvy.txt ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-64.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\Office.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageMedTile.scale-100.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-48.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeWideTile.scale-125.png ixsjdoortpnw.exe File opened for modification C:\Program Files\Java\jdk-1.8\javafx-src.zip ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-400.png ixsjdoortpnw.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\_ReCoVeRy_+ytpvy.png ixsjdoortpnw.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\THMBNAIL.PNG ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_~_8wekyb3d8bbwe\_ReCoVeRy_+ytpvy.txt ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_BadgeLogo.scale-200.png ixsjdoortpnw.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt ixsjdoortpnw.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tl\_ReCoVeRy_+ytpvy.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_ReCoVeRy_+ytpvy.txt ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-48_contrast-black.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.scale-100_contrast-white.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-80_contrast-black.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\_ReCoVeRy_+ytpvy.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerSmallTile.contrast-white_scale-100.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\_ReCoVeRy_+ytpvy.txt ixsjdoortpnw.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\_ReCoVeRy_+ytpvy.txt ixsjdoortpnw.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\sd\_ReCoVeRy_+ytpvy.html ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ms-MY\_ReCoVeRy_+ytpvy.txt ixsjdoortpnw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\_ReCoVeRy_+ytpvy.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.scale-125.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Light.scale-250.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Assets\AppSplashScreen.png ixsjdoortpnw.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\_ReCoVeRy_+ytpvy.png ixsjdoortpnw.exe File opened for modification C:\Program Files\Windows Media Player\Visualizations\_ReCoVeRy_+ytpvy.txt ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+ytpvy.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\SmallTile.scale-200.png ixsjdoortpnw.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\_ReCoVeRy_+ytpvy.png ixsjdoortpnw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailBadge.scale-125.png ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_ReCoVeRy_+ytpvy.txt ixsjdoortpnw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\_ReCoVeRy_+ytpvy.png ixsjdoortpnw.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lt-LT\_ReCoVeRy_+ytpvy.png ixsjdoortpnw.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ixsjdoortpnw.exe b548a2e179907d05b6b91de5db865957_JaffaCakes118.exe File opened for modification C:\Windows\ixsjdoortpnw.exe b548a2e179907d05b6b91de5db865957_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe 1616 ixsjdoortpnw.exe - Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeDebugPrivilege 4900 b548a2e179907d05b6b91de5db865957_JaffaCakes118.exe Token: SeDebugPrivilege 1616 ixsjdoortpnw.exe Token: SeIncreaseQuotaPrivilege 1728 WMIC.exe Token: SeSecurityPrivilege 1728 WMIC.exe Token: SeTakeOwnershipPrivilege 1728 WMIC.exe Token: SeLoadDriverPrivilege 1728 WMIC.exe Token: SeSystemProfilePrivilege 1728 WMIC.exe Token: SeSystemtimePrivilege 1728 WMIC.exe Token: SeProfSingleProcessPrivilege 1728 WMIC.exe Token: SeIncBasePriorityPrivilege 1728 WMIC.exe Token: SeCreatePagefilePrivilege 1728 WMIC.exe Token: SeBackupPrivilege 1728 WMIC.exe Token: SeRestorePrivilege 1728 WMIC.exe Token: SeShutdownPrivilege 1728 WMIC.exe Token: SeDebugPrivilege 1728 WMIC.exe Token: SeSystemEnvironmentPrivilege 1728 WMIC.exe Token: SeRemoteShutdownPrivilege 1728 WMIC.exe Token: SeUndockPrivilege 1728 WMIC.exe Token: SeManageVolumePrivilege 1728 WMIC.exe Token: 33 1728 WMIC.exe Token: 34 1728 WMIC.exe Token: 35 1728 WMIC.exe Token: 36 1728 WMIC.exe Token: SeIncreaseQuotaPrivilege 1728 WMIC.exe Token: SeSecurityPrivilege 1728 WMIC.exe Token: SeTakeOwnershipPrivilege 1728 WMIC.exe Token: SeLoadDriverPrivilege 1728 WMIC.exe Token: SeSystemProfilePrivilege 1728 WMIC.exe Token: SeSystemtimePrivilege 1728 WMIC.exe Token: SeProfSingleProcessPrivilege 1728 WMIC.exe Token: SeIncBasePriorityPrivilege 1728 WMIC.exe Token: SeCreatePagefilePrivilege 1728 WMIC.exe Token: SeBackupPrivilege 1728 WMIC.exe Token: SeRestorePrivilege 1728 WMIC.exe Token: SeShutdownPrivilege 1728 WMIC.exe Token: SeDebugPrivilege 1728 WMIC.exe Token: SeSystemEnvironmentPrivilege 1728 WMIC.exe Token: SeRemoteShutdownPrivilege 1728 WMIC.exe Token: SeUndockPrivilege 1728 WMIC.exe Token: SeManageVolumePrivilege 1728 WMIC.exe Token: 33 1728 WMIC.exe Token: 34 1728 WMIC.exe Token: 35 1728 WMIC.exe Token: 36 1728 WMIC.exe Token: SeBackupPrivilege 4408 vssvc.exe Token: SeRestorePrivilege 4408 vssvc.exe Token: SeAuditPrivilege 4408 vssvc.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4900 wrote to memory of 1616 4900 b548a2e179907d05b6b91de5db865957_JaffaCakes118.exe 91 PID 4900 wrote to memory of 1616 4900 b548a2e179907d05b6b91de5db865957_JaffaCakes118.exe 91 PID 4900 wrote to memory of 1616 4900 b548a2e179907d05b6b91de5db865957_JaffaCakes118.exe 91 PID 1616 wrote to memory of 1728 1616 ixsjdoortpnw.exe 93 PID 1616 wrote to memory of 1728 1616 ixsjdoortpnw.exe 93 PID 4900 wrote to memory of 1720 4900 b548a2e179907d05b6b91de5db865957_JaffaCakes118.exe 94 PID 4900 wrote to memory of 1720 4900 b548a2e179907d05b6b91de5db865957_JaffaCakes118.exe 94 PID 4900 wrote to memory of 1720 4900 b548a2e179907d05b6b91de5db865957_JaffaCakes118.exe 94 - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ixsjdoortpnw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" ixsjdoortpnw.exe - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b548a2e179907d05b6b91de5db865957_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b548a2e179907d05b6b91de5db865957_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\ixsjdoortpnw.exeC:\Windows\ixsjdoortpnw.exe2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1616 -
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1728
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\B548A2~1.EXE2⤵PID:1720
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4408
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3612 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:81⤵PID:2960
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PerfLogs\_ReCoVeRy_+ytpvy.html
- Size 12KB
- SHA256 b0bc15638f6013426d38213e4723e6823653859bea6d49bee1567fc25c80e923
- MD5 b49e815c35c1cc2803508f5411625222
- SHA1 a1bcdb9fd9cc76acb69176155ffa902989aa4959
- SHA512 429306c684100c7afcd2fce90b083f8e68a4dea0bd682b1acb3bec3c4b6f057e752f38ec7f9f90070763bf7ee516c8cc8bdcb22d93e4edc28454fd8d5e94dcd3
- SSDEEP 192:BJm1s1xt157pfOjB8Im86a8LE82CZV/ZB9YU6y4:fys1xtrdQe0moPoz+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PerfLogs\_ReCoVeRy_+ytpvy.png
- Size 65KB
- SHA256 50b5a30c94bcb327a47f8be7d9362295b57b00d04bc6e7e2d55c390150e36b34
- MD5 1d7fe3f56af2fd5753d4035612ed9229
- SHA1 2cfd47ad324836287d911d2ecb200be652cc36e3
- SHA512 bdc1defbdd6050ecc2983d9fc69cea0813ae2bce7a3d24876dab329be09f56513da580a0a10f7218d0d19b6c13d4d5240eecb7215ee8fb396ffd33478d326cfe
- SSDEEP 1536:ObTGtGSeiq8BWcUL3naCci/25J9M2nmN0xQyX7sZEwf:0GcSKlja5LtmK6yXAZEwf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PerfLogs\_ReCoVeRy_+ytpvy.txt
- Size 1KB
- SHA256 a2a24d7eabc389d72a5b22ee26be29a27f7fd38a53b94f3362760d1e6f9c49ef
- MD5 b458b0a19d4fc25222f8ba294dd045fb
- SHA1 5bc8c4dd72fd9cf21117cc0df451a1d4a4f85357
- SHA512 47d0670d638800dd0f472b61945693d906e86a2ca50af8170c72feba48542ed6d9b699c51485fabacfb3fef93762c662348a224c5fcbfc37ccea4f66472c1d58
- MD5 SHA1 SHA512
- Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
- Size 560B
- SHA256 27342a2db5cec1268d90e31fc117462299bd291ddea59d2a84dc29a9d03ceeda
- MD5 07851057d3073507afb47a0e46205bc9
- SHA1 f103398d78e3bbe53306158810063cd135876c2f
- SHA512 37b2530d7fa5ae85323a1d8e3c476b8760210afd15af2c2e6af8f62733e6003443d5963ca0236a8a4eec9f942b4ea7ea2808d82e27c8e7fb9e952ce65f88fda2
- MD5 SHA1 SHA512
- Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
- Size 560B
- SHA256 5f910b9c10b75cb7fa3f16095400164ba81de26f5ecb714652ca9cc7bb91d64d
- MD5 32447a32c7fc54a8db546152e61ac4b5
- SHA1 ad3dfd2ac6fe7491eba7a98fad347d3a1de9ea85
- SHA512 229a453a51c40b98470f5a56c7a6427496e3ef81e2be8e017a9e7cd4e4fa18679e187e73a1c908fc6c90d869d8813793014707e3b3437ebadeb45509910dec70
- MD5 SHA1 SHA512
- Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
- Size 416B
- SHA256 48c5daa04c611baf4971c2ab29c53eeb38335df66f3f97c5f1b05ff83eea6cd1
- MD5 0ad429252ef1868b09eeeb2f06548955
- SHA1 032f157d0a0b3b29beff034fb20d248589ea785d
- SHA512 ea1ed493c74a0396898e95193b5465a35c8908b6db97922eb44dfa18a87ac1c742f1204929a37d36144add25694e60a7b8da3232d9bc37c1069f832d04bf0dd9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534305838784240.txt
- Size 77KB
- SHA256 267bb652a17baad281479275c94949a7e421aa0838107d286c1c23d7df6ac5f7
- MD5 d667d46d42e8ecb1c4c211fc89f1b512
- SHA1 d5649a6bebcc2933cae8a8f4b7d1194dfc526f5b
- SHA512 0e723412c39ae68454cc9dad2323706dffa7cece1f00f95b6c207efa66a630b3311c308c8914a35060fea4feb83a49aa5f3130f7ccef784311cae31849b91dd9
- SSDEEP 1536:/7P31g0wAcx9Ar6usMxA5xgf2l6omuXDftm+5TlBLo6aqbh6p/1YgfW:Llsx+lGd6omZ+3to9q96p/pfW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534325129811261.txt
- Size 74KB
- SHA256 cae33f1f6437580e426013cd60265772dcb32f50f9837d7dcb2246278e782c6d
- MD5 97b0161a89bd3f8156175f374830ab3e
- SHA1 57d41fdc39f2f3d03d467af6069d8c585a033f80
- SHA512 d4c5dd98b659db6b8dedada447e85e942d2e3c2d92e275964ad29687972593182073893ea4e55c004552e26ee3453abdc890146969f0ff34615e72c9e07efeec
- SSDEEP 1536:qFLN31UT90AJUsDq1D8nfiILX888ibDsB9cJp1iP6LHhoXWa:CLNlG0ATq1D8n1TddqwiibhoXWa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\ixsjdoortpnw.exe
- Size 360KB
- SHA256 6476dc4d4cf45ff08448309f65e1702c2770a93ef002475294c546e19bd717f0
- MD5 b548a2e179907d05b6b91de5db865957
- SHA1 c472e35f13fd7a3a5a5b2bb9cf0683bbfa6faf03
- SHA512 4318e7b12bf2cf14d190e91b30313484efbba370f166829e58a43c19d5e479f3167dfc9cbe7d0683d73f245d4b2ee752ec6007811c4a879ae51a133048bcffd9
- SSDEEP 6144:HSfBiH4YIwLseDtcixL1V02VcKUGstieOWEK0kVW:ygp1hcil1VBueNxnIW
- MD5 SHA1 SHA512 SSDEEP