Analysis
- max time kernel
140s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240730-en - resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system - submitted
29/07/2024, 04:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe
Resource
win10v2004-20240730-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe
- Size 225KB
- Sample240729-e2v4aatbjl
- SHA256 baa3d81ee5a064105cd92ae3474a695324d5cd9e99d1e5d816aacfeffba62cd3
- MD5 3840a023db0a4235495fc3b3e48046c4
- SHA1 1011454d00ba23e9425dd311b18f387f7966382e
- SHA512 36c0dfee25b3ba271b460e55f77ed37491839743add831b2f85e48a599a526bb20d7db79a0c077b535e1eead24559ccb6d5e42a8cba40894cfc2c8f66ca50bd5
- SSDEEP 3072:CfLnfk1mn7UVGhRXR9cEF3KGx/CgO9PcsibcbQLOEpTR5w1BNH50Idt:CfL8c4VQcEwGxagiPSbIyPKQIb
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Path
-
F:\$RECYCLE.BIN\S-1-5-21-807826884-2440573969-3755798217-1000\RQIUMIAE-DECRYPT.txt
Ransom Note
- ---= GANDCRAB V5.0.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE WILL BE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .RQIUMIAE The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/9f4a431d9c2e6a58 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAE9ge/YqAdOR86GaoLmBGeGcjKkkL63ExkhyNJlNzwprfBAKwveF9gkjX3/re206pZxspVebhawheqHPIivaDbKJ8sWualrrWD9KkOgTNmOT9kwtukrjNIzGREkKQDTvXGx72E/mmuQj7H+nhvqqgQuYCVz8moOxFIarllFNZV38H/Ne5LTZAhlFbansw+HCEzYjCqdwf0KYYYvCjMLdGVOA54pWu8udHAAj8cxv0wF/s7WCWSAFfMhYoT8J2sB/R2Yqd/2Wzgfrzk6bvxf/oM1IWnRQgGPAcbYRRXTn2N8Hfa3nYayV4FqngoHab/HOjyw1sxiA6UUX1wvb3he2CxVMUYoHTsivr2cVZ9k3gE+yXGzfnkMYcWFzzPhg+2Icoluv+dm9E/Sptt+p96g6qTt4D0A8KavWytC/a08BxNVXQg5d4iW5ApWu6DaeCaUhN8HIVAUSkHoFDeYAIvl00NhZDUcJ42SwarFfRlukIGyE0ojmPMpHlM/e/PA400MK8h7lqsdgn07UYvD+fI3RdZ9Adi6j68HI4spkQ134//7w6TpybjuaVH61tpb23ai5oFTDibTKJkvobWUwImqfwXTVii6S16RywnAzIyWHjWL8mQhiWTkpv4WjLrFj11GSX06+s9Ahxv5378wczAG47JBMvtjjewP1VMNznSdv/2t5asJG8HqGNfLLqFTaqvq/DHjjolsvYsNgVHYC8pdEjjaGTnTl/vaZ5ihrOZeByOeD5Z+QCm6z6+vLLn1aquHVZaKB4KZYv0DeyVZm5VWhp1BcZ4Bt7+8BRzj6GB66Z/4+3jxOD49QJXo7E8ICnacul7OlsRnzmzhacm0oHIybAvRS+jgF19FsZ6TKEig049/5RzB6sY1FWxBX//12NVRN30DU9jQL391qfuTiBQqkQWzKIPEaBQ3cotFa3qey7ZRkerd7/whoT5Nt6a1UPnnD1UMFOIik2cpYF1+RogNK2z9tv7QynQ7KeJei+bLwEYvoI6d8nGM/Lq61TlJfGsdTf2Qf77La1TTh+xYI5M0cLM3z4eVadulF7miAeGwQaIOxbSdxvq8O3V0mrSnjml2XvmOCVaz/ZmwJ0xEoUmpbsTgfTtfpDxLubI7bULjE57GndL+ggemdM1uMoqJOJ9u29G6p5ZnB+W7vKd9xX7Q9tclZcjZXJinvwGXW3FA4CpacRKDWKdW2KUQAT5t/Orw1DyVJqjr7zgyAejcVs7CgzNDxiHxmKs6xsjg3EOgIfdNzwGL2gERllF81jSctiriThOoSrgdsMt2cZcmH7QHypt1+Sb5lBhBA58R+I444kgoo9vGqBnbe3K7sDlFVVwxJAZb688ThNAE0HIkadAhA1460Yq+ztsZ5P3JO6vXfJpIwGxP0DiaQhLS3M10TAtknMxM6FrBonviiRw6ftHGWLYildoglar3EFiutwZAV7vR3mOFCJdztJI+qyRuqAhzLtgJAXbGDlQBi0MnjNbCGGN9/SB4XIr9MLnl7MGm9akkVXQ/C6uCwaeRcXyrMv+p7wuPeNuoRMXuJdJ5oBRxUsKKSzDOcwTtdsyJRn2k3yKbBVHgid12r3o0y69vd25gd/1SOdJqymh9ZuRlykp4MG/+gsvxVwcqzPEc2h3p332/j7/vKh6uUQV44BVSDaEvKALYduAsElNQi6zFuOU3fo1/KJZrOUQqkcpzHe6ucQOWwF6+U1SL+Jy0voSW6UIms2jwTbXu7R3xhZkeo4XB3OEMQuUaK1pQ6AnJertKPajmoE8sf0JRN5CcicOa1sCh7MzvkehoX5aqqf1gZYrQS/pFBoQ/a0MhIl8PskJMiqpeyWDGU/OtimUlpqWP9WbIuiaMHqsg40lcdfiRCiUj6ELnuV6sZVe0pFzvZpBxbXfZK8nR+0qYz4D1DTgY3XdZigkFCXUuAelZwDmtC+rI8hMSjfFby/KQIhYX+j0eCldE6NquRJZ6GuQf5OdtaflLzFaKEg4itIbuIbn/7T89+S2m6bX+K7IJrBOye0/fuYCPnRJc1bGYpJ3QtvLEodqfwfPh8uaCkBITa2uuTltj2q8feX4MWazn7Vj4oTssEENawK7I3FCGMvuVKyfPza8likk92N38oZJx83x7jXaNWYhjTaoQjICkwdZ6DUNrSifsHn80Iv2lTZDO+xHUVzH90F7NVojqr2QmZqjN7mmmMnU+ukT2bNsST9zyttV/VnUW5QIuDBqsk5VxBdo7r9XVjpRCTkOs= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZbTphRunYG7nlWtLfTTG2Hhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXB6eLy/2I2QOsiGthYbVrXBi7t/hHUEYwbpydD4ty4M6b3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoARPLnK8+Au5ZALyfhGEwg6hrKQ3vxBFKwg70Zi7pDxFM3vTLN+av1wQZMnQVRlOKYDmn1lvgAn90mSDf7SyGQSZnn7Ivlsuw7HIKVYbpfzf2fBccdMBnP2lNhH9XQ3DC2qZAEuDtLkioBZ9MNJGhHpcOdL/YRZoP4YksV8zuv7OczMv9MHYTh4gzvuwKRb5tB/+FbmHWs+IUXo5eM9Q19EBhLFKM2u1g1mmDLQgzxwsJfjT5T2ECiWME ---END PC DATA---
URLs
-
http://gandcrabmfe6mnef.onion/9f4a431d9c2e6a58
Signatures
- Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (313) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Control Panel\International\Geo\Nation 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RQIUMIAE-DECRYPT.txt 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\9c2e6db59c2e6a59417.lock 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened (read-only) \??\P: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened (read-only) \??\R: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened (read-only) \??\S: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened (read-only) \??\Z: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened (read-only) \??\H: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened (read-only) \??\J: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened (read-only) \??\L: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened (read-only) \??\I: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened (read-only) \??\U: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened (read-only) \??\Y: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened (read-only) \??\V: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened (read-only) \??\B: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened (read-only) \??\M: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened (read-only) \??\T: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened (read-only) \??\K: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened (read-only) \??\N: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened (read-only) \??\Q: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened (read-only) \??\W: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened (read-only) \??\X: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened (read-only) \??\A: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened (read-only) \??\E: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened (read-only) \??\G: 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\pidor.bmp" 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe - Drops file in Program Files directory 39 IoCs
description ioc Process File created C:\Program Files\RQIUMIAE-DECRYPT.txt 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\BlockInvoke.DVR 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\DisconnectSend.xls 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\DismountRegister.aifc 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\FindPush.wm 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\NewAdd.htm 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\SplitConvertTo.mpeg2 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File created C:\Program Files (x86)\RQIUMIAE-DECRYPT.txt 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\BlockCopy.mpg 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\RestoreRevoke.odt 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\SubmitAdd.odt 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\UnblockLimit.TS 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\DisconnectInvoke.aif 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\ShowClose.jpg 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\SuspendUndo.png 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\UnregisterConfirm.asx 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File created C:\Program Files (x86)\9c2e6db59c2e6a59417.lock 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\DisableMount.3gp 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\FormatMount.ps1 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\MeasurePing.dxf 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\OpenResize.3gp2 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\RenameUnlock.inf 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\RestartHide.au3 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\DebugConfirm.eps 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\NewOut.mp3 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\RedoRename.mp2v 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\RenameComplete.mpe 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\RequestMove.tiff 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\ResetInitialize.rar 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File created C:\Program Files\9c2e6db59c2e6a59417.lock 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\AddRedo.wvx 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\CompressRestart.xps 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\DebugStep.pcx 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\LockDeny.mpeg 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\MergeHide.AAC 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\CompressExit.eprtx 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\GrantInstall.MTS 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\SelectUnblock.mht 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe File opened for modification C:\Program Files\WriteSkip.html 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E784A101C8265CC2DE1F16D47B440CAD90A1945\Blob = 0f0000000100000010000000824bae7c7cb3a15ce851a396760574a30b000000010000004a00000045007100750069006600610078002000530065006300750072006500200047006c006f00620061006c002000650042007500730069006e006500730073002000430041002d00310000006200000001000000200000005f0b62eab5e353ea6521651658fbb65359f443280a4afbd104d77d10f9f04c07090000000100000020000000301e06082b0601050507030306082b0601050507030406082b06010505070301140000000100000014000000bea8a07472506b44b7c923d8fba8ffb3576b686c1d0000000100000010000000d06bc27453aa4f6d586437e5d3b377986800000001000000080000000000876ace99d1010300000001000000140000007e784a101c8265cc2de1f16d47b440cad90a194520000000010000009402000030820290308201f9a003020102020101300d06092a864886f70d0101040500305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d31301e170d3939303632313034303030305a170d3230303632313034303030305a305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d3130819f300d06092a864886f70d010101050003818d0030818902818100bae717900265b134553c49c251d5dfa7d1378fd1e781734152609b9da1172678adc7b1e8269432b5de338d3a2fdbf29a7a5a7398a35ce9fb8a731b5ce7c3bf806ccda9f4d62bc0f7f999aa63a2b147020fd4e4513a123c6c8a5a548470dbc1c590cf7245cba859c0cd339d3fa396eb8533211c3e1e3e606e769c6785c5c8c3610203010001a3663064301106096086480186f8420101040403020007300f0603551d130101ff040530030101ff301f0603551d23041830168014bea8a07472506b44b7c923d8fba8ffb3576b686c301d0603551d0e04160414bea8a07472506b44b7c923d8fba8ffb3576b686c300d06092a864886f70d01010405000381810030e20151aac7ea5fdab9d0650f30d63eda0d14496e9193271431efc4f72d45f8ecc7bfa2410d23b492f9190067bd01afcde071fc5acf64c4e09698d0a340e2018aef2707f165018a442d06657552c0861020215f6c6b0f6cae091caff2a21834c475a4731cf18ddcefadf9b376b492bfdc95101ebecbc83b5a8460195694a955 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E784A101C8265CC2DE1F16D47B440CAD90A1945\Blob = 0400000001000000100000008f5d770627c4983c5b9378e7d77d9bcc0300000001000000140000007e784a101c8265cc2de1f16d47b440cad90a19456800000001000000080000000000876ace99d1011d0000000100000010000000d06bc27453aa4f6d586437e5d3b37798140000000100000014000000bea8a07472506b44b7c923d8fba8ffb3576b686c090000000100000020000000301e06082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000005f0b62eab5e353ea6521651658fbb65359f443280a4afbd104d77d10f9f04c070b000000010000004a00000045007100750069006600610078002000530065006300750072006500200047006c006f00620061006c002000650042007500730069006e006500730073002000430041002d00310000000f0000000100000010000000824bae7c7cb3a15ce851a396760574a320000000010000009402000030820290308201f9a003020102020101300d06092a864886f70d0101040500305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d31301e170d3939303632313034303030305a170d3230303632313034303030305a305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d3130819f300d06092a864886f70d010101050003818d0030818902818100bae717900265b134553c49c251d5dfa7d1378fd1e781734152609b9da1172678adc7b1e8269432b5de338d3a2fdbf29a7a5a7398a35ce9fb8a731b5ce7c3bf806ccda9f4d62bc0f7f999aa63a2b147020fd4e4513a123c6c8a5a548470dbc1c590cf7245cba859c0cd339d3fa396eb8533211c3e1e3e606e769c6785c5c8c3610203010001a3663064301106096086480186f8420101040403020007300f0603551d130101ff040530030101ff301f0603551d23041830168014bea8a07472506b44b7c923d8fba8ffb3576b686c301d0603551d0e04160414bea8a07472506b44b7c923d8fba8ffb3576b686c300d06092a864886f70d01010405000381810030e20151aac7ea5fdab9d0650f30d63eda0d14496e9193271431efc4f72d45f8ecc7bfa2410d23b492f9190067bd01afcde071fc5acf64c4e09698d0a340e2018aef2707f165018a442d06657552c0861020215f6c6b0f6cae091caff2a21834c475a4731cf18ddcefadf9b376b492bfdc95101ebecbc83b5a8460195694a955 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E784A101C8265CC2DE1F16D47B440CAD90A1945\Blob = 190000000100000010000000e559465e28a60e5499846f194087b0e50f0000000100000010000000824bae7c7cb3a15ce851a396760574a30b000000010000004a00000045007100750069006600610078002000530065006300750072006500200047006c006f00620061006c002000650042007500730069006e006500730073002000430041002d00310000006200000001000000200000005f0b62eab5e353ea6521651658fbb65359f443280a4afbd104d77d10f9f04c07090000000100000020000000301e06082b0601050507030306082b0601050507030406082b06010505070301140000000100000014000000bea8a07472506b44b7c923d8fba8ffb3576b686c1d0000000100000010000000d06bc27453aa4f6d586437e5d3b377986800000001000000080000000000876ace99d1010300000001000000140000007e784a101c8265cc2de1f16d47b440cad90a19450400000001000000100000008f5d770627c4983c5b9378e7d77d9bcc20000000010000009402000030820290308201f9a003020102020101300d06092a864886f70d0101040500305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d31301e170d3939303632313034303030305a170d3230303632313034303030305a305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d3130819f300d06092a864886f70d010101050003818d0030818902818100bae717900265b134553c49c251d5dfa7d1378fd1e781734152609b9da1172678adc7b1e8269432b5de338d3a2fdbf29a7a5a7398a35ce9fb8a731b5ce7c3bf806ccda9f4d62bc0f7f999aa63a2b147020fd4e4513a123c6c8a5a548470dbc1c590cf7245cba859c0cd339d3fa396eb8533211c3e1e3e606e769c6785c5c8c3610203010001a3663064301106096086480186f8420101040403020007300f0603551d130101ff040530030101ff301f0603551d23041830168014bea8a07472506b44b7c923d8fba8ffb3576b686c301d0603551d0e04160414bea8a07472506b44b7c923d8fba8ffb3576b686c300d06092a864886f70d01010405000381810030e20151aac7ea5fdab9d0650f30d63eda0d14496e9193271431efc4f72d45f8ecc7bfa2410d23b492f9190067bd01afcde071fc5acf64c4e09698d0a340e2018aef2707f165018a442d06657552c0861020215f6c6b0f6cae091caff2a21834c475a4731cf18ddcefadf9b376b492bfdc95101ebecbc83b5a8460195694a955 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E784A101C8265CC2DE1F16D47B440CAD90A1945\Blob = 5c0000000100000004000000000400000400000001000000100000008f5d770627c4983c5b9378e7d77d9bcc0300000001000000140000007e784a101c8265cc2de1f16d47b440cad90a19456800000001000000080000000000876ace99d1011d0000000100000010000000d06bc27453aa4f6d586437e5d3b37798140000000100000014000000bea8a07472506b44b7c923d8fba8ffb3576b686c090000000100000020000000301e06082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000005f0b62eab5e353ea6521651658fbb65359f443280a4afbd104d77d10f9f04c070b000000010000004a00000045007100750069006600610078002000530065006300750072006500200047006c006f00620061006c002000650042007500730069006e006500730073002000430041002d00310000000f0000000100000010000000824bae7c7cb3a15ce851a396760574a3190000000100000010000000e559465e28a60e5499846f194087b0e520000000010000009402000030820290308201f9a003020102020101300d06092a864886f70d0101040500305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d31301e170d3939303632313034303030305a170d3230303632313034303030305a305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d3130819f300d06092a864886f70d010101050003818d0030818902818100bae717900265b134553c49c251d5dfa7d1378fd1e781734152609b9da1172678adc7b1e8269432b5de338d3a2fdbf29a7a5a7398a35ce9fb8a731b5ce7c3bf806ccda9f4d62bc0f7f999aa63a2b147020fd4e4513a123c6c8a5a548470dbc1c590cf7245cba859c0cd339d3fa396eb8533211c3e1e3e606e769c6785c5c8c3610203010001a3663064301106096086480186f8420101040403020007300f0603551d130101ff040530030101ff301f0603551d23041830168014bea8a07472506b44b7c923d8fba8ffb3576b686c301d0603551d0e04160414bea8a07472506b44b7c923d8fba8ffb3576b686c300d06092a864886f70d01010405000381810030e20151aac7ea5fdab9d0650f30d63eda0d14496e9193271431efc4f72d45f8ecc7bfa2410d23b492f9190067bd01afcde071fc5acf64c4e09698d0a340e2018aef2707f165018a442d06657552c0861020215f6c6b0f6cae091caff2a21834c475a4731cf18ddcefadf9b376b492bfdc95101ebecbc83b5a8460195694a955 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 5c0000000100000004000000000800000b000000010000005400000053007400610072006600690065006c006400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c06200000001000000200000002ce1cb0bf9d2f9e102993fbe215152c3b2dd0cabde1c68e5319b839154dbb7f51400000001000000140000007c0c321fa7d9307fc47d68a362a8a1ceab075b271d000000010000001000000054e2cd85ba79cda018fed9e6a863aa46030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E784A101C8265CC2DE1F16D47B440CAD90A1945 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 372 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe 372 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe 372 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe 372 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2464 wmic.exe Token: SeSecurityPrivilege 2464 wmic.exe Token: SeTakeOwnershipPrivilege 2464 wmic.exe Token: SeLoadDriverPrivilege 2464 wmic.exe Token: SeSystemProfilePrivilege 2464 wmic.exe Token: SeSystemtimePrivilege 2464 wmic.exe Token: SeProfSingleProcessPrivilege 2464 wmic.exe Token: SeIncBasePriorityPrivilege 2464 wmic.exe Token: SeCreatePagefilePrivilege 2464 wmic.exe Token: SeBackupPrivilege 2464 wmic.exe Token: SeRestorePrivilege 2464 wmic.exe Token: SeShutdownPrivilege 2464 wmic.exe Token: SeDebugPrivilege 2464 wmic.exe Token: SeSystemEnvironmentPrivilege 2464 wmic.exe Token: SeRemoteShutdownPrivilege 2464 wmic.exe Token: SeUndockPrivilege 2464 wmic.exe Token: SeManageVolumePrivilege 2464 wmic.exe Token: 33 2464 wmic.exe Token: 34 2464 wmic.exe Token: 35 2464 wmic.exe Token: 36 2464 wmic.exe Token: SeIncreaseQuotaPrivilege 2464 wmic.exe Token: SeSecurityPrivilege 2464 wmic.exe Token: SeTakeOwnershipPrivilege 2464 wmic.exe Token: SeLoadDriverPrivilege 2464 wmic.exe Token: SeSystemProfilePrivilege 2464 wmic.exe Token: SeSystemtimePrivilege 2464 wmic.exe Token: SeProfSingleProcessPrivilege 2464 wmic.exe Token: SeIncBasePriorityPrivilege 2464 wmic.exe Token: SeCreatePagefilePrivilege 2464 wmic.exe Token: SeBackupPrivilege 2464 wmic.exe Token: SeRestorePrivilege 2464 wmic.exe Token: SeShutdownPrivilege 2464 wmic.exe Token: SeDebugPrivilege 2464 wmic.exe Token: SeSystemEnvironmentPrivilege 2464 wmic.exe Token: SeRemoteShutdownPrivilege 2464 wmic.exe Token: SeUndockPrivilege 2464 wmic.exe Token: SeManageVolumePrivilege 2464 wmic.exe Token: 33 2464 wmic.exe Token: 34 2464 wmic.exe Token: 35 2464 wmic.exe Token: 36 2464 wmic.exe Token: SeBackupPrivilege 2848 vssvc.exe Token: SeRestorePrivilege 2848 vssvc.exe Token: SeAuditPrivilege 2848 vssvc.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 372 wrote to memory of 2464 372 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe 85 PID 372 wrote to memory of 2464 372 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe 85 PID 372 wrote to memory of 2464 372 3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe 85 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3840a023db0a4235495fc3b3e48046c4_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\SysWOW64\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2464
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2848
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Indicator Removal
1File Deletion
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path F:\$RECYCLE.BIN\S-1-5-21-807826884-2440573969-3755798217-1000\RQIUMIAE-DECRYPT.txt
- Size 8KB
- SHA256 9388996bc4215107acbd32d67fb49d39b0aebdaf0c9603014435418f5b072f2b
- MD5 b41f04b86f36b9ab5e5e62706d420780
- SHA1 997a299d5b4a7b75c2b9031c05af92f20d8fb8a5
- SHA512 9dab7d25bb649396046791bd5eb666a6484e7a30d40b87c3c5d4028fe51e43f38f19371171b8fb2039a2db9408243d12fbf66f966d824f74c43fd2c223f4aca4
- SSDEEP 192:8bghfN/g+bteoA9S9L5LdxcxmOo9rOJWUVFjNkn:QghVJbtr9p5Loxvo9SFVFW
- MD5 SHA1 SHA512 SSDEEP