c94d721527723564a9aec845adb08bd9b1a1bbd67b68c6a760f16c4897f41a7a

General

Target

104b27c316121fc5cbccb0c2279f831d_JaffaCakes118.exe
Size

335KB
MD5

104b27c316121fc5cbccb0c2279f831d
SHA1

22dca3e0db99cdbbbeb17dc0e7f578e4c5e1fdae
SHA256

c94d721527723564a9aec845adb08bd9b1a1bbd67b68c6a760f16c4897f41a7a
SHA512

f984a0682d203d40e77a0e217062e3188f35584d511f46067d23052ce3e1fab9c82c82b358862d6288086220050ff547ccb01df278406bfc0752b20e1b8c3559
SSDEEP

6144:Uu85Qrr4UA5cnswbgPxgyAPEvhPiRmwP8Uej4jGoVp:uere3wbsOykEPiRmwpFG

Score

7^/10

defense_evasion persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	104b27c316121fc5cbccb0c2279f831d_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4832	windowse.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	104b27c316121fc5cbccb0c2279f831d_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	104b27c316121fc5cbccb0c2279f831d_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	104b27c316121fc5cbccb0c2279f831d_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	104b27c316121fc5cbccb0c2279f831d_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	104b27c316121fc5cbccb0c2279f831d_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	104b27c316121fc5cbccb0c2279f831d_JaffaCakes118.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2236-0-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral2/files/0x0009000000023553-5.dat	upx
behavioral2/memory/2236-38-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral2/memory/2236-40-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral2/memory/4832-41-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral2/memory/4832-42-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral2/memory/4832-43-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral2/memory/4832-45-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral2/memory/4832-46-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral2/memory/4832-47-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral2/memory/4832-48-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral2/memory/4832-50-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral2/memory/4832-51-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral2/memory/4832-52-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral2/memory/4832-53-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral2/memory/4832-54-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral2/memory/4832-55-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral2/memory/4832-56-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral2/memory/4832-57-0x0000000000400000-0x00000000004CF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CyberEyeReg = "C:\\Windows\\windowse.exe"	windowse.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\kaurs.kaf	windowse.exe
File created	C:\Windows\kaurs.kaf	windowse.exe
File created	C:\Windows\windowse.exe	104b27c316121fc5cbccb0c2279f831d_JaffaCakes118.exe
File opened for modification	C:\Windows\windowse.exe	104b27c316121fc5cbccb0c2279f831d_JaffaCakes118.exe
File created	C:\Windows\WinMemoryAsgn343154126.exe	windowse.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b7d72a8ac39dc2e30000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b7d72a8a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900b7d72a8a000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db7d72a8a000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b7d72a8a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	104b27c316121fc5cbccb0c2279f831d_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeBackupPrivilege	960	vssvc.exe
Token: SeRestorePrivilege	960	vssvc.exe
Token: SeAuditPrivilege	960	vssvc.exe
Token: SeBackupPrivilege	1696	srtasks.exe
Token: SeRestorePrivilege	1696	srtasks.exe
Token: SeSecurityPrivilege	1696	srtasks.exe
Token: SeTakeOwnershipPrivilege	1696	srtasks.exe
Token: SeBackupPrivilege	1696	srtasks.exe
Token: SeRestorePrivilege	1696	srtasks.exe
Token: SeSecurityPrivilege	1696	srtasks.exe
Token: SeTakeOwnershipPrivilege	1696	srtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4832	windowse.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 4832	2236	104b27c316121fc5cbccb0c2279f831d_JaffaCakes118.exe	88
PID 2236 wrote to memory of 4832	2236	104b27c316121fc5cbccb0c2279f831d_JaffaCakes118.exe	88
PID 2236 wrote to memory of 4832	2236	104b27c316121fc5cbccb0c2279f831d_JaffaCakes118.exe	88

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\104b27c316121fc5cbccb0c2279f831d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\104b27c316121fc5cbccb0c2279f831d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Impair Defenses: Safe Mode Boot
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\windowse.exe
  "C:\Windows\windowse.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:4832

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4068,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:8
1⤵
PID:636

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

1

T1562

Safe Mode Boot

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\windowse.exe

Filesize
335KB

MD5
104b27c316121fc5cbccb0c2279f831d

SHA1
22dca3e0db99cdbbbeb17dc0e7f578e4c5e1fdae

SHA256
c94d721527723564a9aec845adb08bd9b1a1bbd67b68c6a760f16c4897f41a7a

SHA512
f984a0682d203d40e77a0e217062e3188f35584d511f46067d23052ce3e1fab9c82c82b358862d6288086220050ff547ccb01df278406bfc0752b20e1b8c3559

Download Submit
memory/2236-40-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2236-0-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2236-38-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/4832-46-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/4832-50-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/4832-42-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/4832-43-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/4832-44-0x00000000021A0000-0x00000000021A1000-memory.dmp

Filesize
4KB

Download
memory/4832-45-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/4832-37-0x00000000021A0000-0x00000000021A1000-memory.dmp

Filesize
4KB

Download
memory/4832-47-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/4832-48-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/4832-41-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/4832-51-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/4832-52-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/4832-53-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/4832-54-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/4832-55-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/4832-56-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/4832-57-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads