Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
30/07/2024, 13:02
Behavioral task
behavioral1
Sample
6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
21 signatures
150 seconds
General
-
Target
6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe
-
Size
4.8MB
-
MD5
6ff1ca648505fe8bea6b4a26616b9722
-
SHA1
7020b4d9e700b697d507a61bffea12c9475a23d2
-
SHA256
7b7c16367746efe7583ae46235b2f062ce44602dda990c9a11a730d619b8d365
-
SHA512
e65d67e22807e1a539997bd763fc6063226fce207c57b3b0316ef7640471f460016fa5f58feb006ff96dd7a2cf5bcff7c17f0af763e8518431fe13ce6d8c9db2
-
SSDEEP
98304:zDAjjvoF+Cp+/bbbbp7FO1gTL9M5gmoZHOoOVsHalI:zuvAObbbbp78+VwzV0alI
Malware Config
Signatures
-
Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
-
Avaddon payload 6 IoCs
resource yara_rule behavioral1/memory/1756-0-0x0000000000DE0000-0x00000000012B7000-memory.dmp family_avaddon behavioral1/memory/1756-1-0x0000000000DE0000-0x00000000012B7000-memory.dmp family_avaddon behavioral1/memory/1756-2-0x0000000000DE0000-0x00000000012B7000-memory.dmp family_avaddon behavioral1/memory/1756-3-0x0000000000DE0000-0x00000000012B7000-memory.dmp family_avaddon behavioral1/memory/1756-26-0x0000000000DE0000-0x00000000012B7000-memory.dmp family_avaddon behavioral1/memory/1756-501-0x0000000000DE0000-0x00000000012B7000-memory.dmp family_avaddon -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe -
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe -
Renames multiple (195) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/1756-0-0x0000000000DE0000-0x00000000012B7000-memory.dmp themida behavioral1/memory/1756-1-0x0000000000DE0000-0x00000000012B7000-memory.dmp themida behavioral1/memory/1756-2-0x0000000000DE0000-0x00000000012B7000-memory.dmp themida behavioral1/memory/1756-3-0x0000000000DE0000-0x00000000012B7000-memory.dmp themida behavioral1/memory/1756-26-0x0000000000DE0000-0x00000000012B7000-memory.dmp themida behavioral1/memory/1756-501-0x0000000000DE0000-0x00000000012B7000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\I: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\R: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\U: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\E: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\M: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\O: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\T: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\W: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\G: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\J: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\L: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\N: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\Q: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\S: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\V: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\X: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\Y: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\B: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\H: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\K: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\P: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\Z: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe File opened (read-only) \??\F: 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 19 api.myip.com 18 api.myip.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe -
Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2192 vssadmin.exe 1624 vssadmin.exe 1840 vssadmin.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 320 wmic.exe Token: SeSecurityPrivilege 320 wmic.exe Token: SeTakeOwnershipPrivilege 320 wmic.exe Token: SeLoadDriverPrivilege 320 wmic.exe Token: SeSystemProfilePrivilege 320 wmic.exe Token: SeSystemtimePrivilege 320 wmic.exe Token: SeProfSingleProcessPrivilege 320 wmic.exe Token: SeIncBasePriorityPrivilege 320 wmic.exe Token: SeCreatePagefilePrivilege 320 wmic.exe Token: SeBackupPrivilege 320 wmic.exe Token: SeRestorePrivilege 320 wmic.exe Token: SeShutdownPrivilege 320 wmic.exe Token: SeDebugPrivilege 320 wmic.exe Token: SeSystemEnvironmentPrivilege 320 wmic.exe Token: SeRemoteShutdownPrivilege 320 wmic.exe Token: SeUndockPrivilege 320 wmic.exe Token: SeManageVolumePrivilege 320 wmic.exe Token: 33 320 wmic.exe Token: 34 320 wmic.exe Token: 35 320 wmic.exe Token: SeBackupPrivilege 1768 vssvc.exe Token: SeRestorePrivilege 1768 vssvc.exe Token: SeAuditPrivilege 1768 vssvc.exe Token: SeIncreaseQuotaPrivilege 3032 wmic.exe Token: SeSecurityPrivilege 3032 wmic.exe Token: SeTakeOwnershipPrivilege 3032 wmic.exe Token: SeLoadDriverPrivilege 3032 wmic.exe Token: SeSystemProfilePrivilege 3032 wmic.exe Token: SeSystemtimePrivilege 3032 wmic.exe Token: SeProfSingleProcessPrivilege 3032 wmic.exe Token: SeIncBasePriorityPrivilege 3032 wmic.exe Token: SeCreatePagefilePrivilege 3032 wmic.exe Token: SeBackupPrivilege 3032 wmic.exe Token: SeRestorePrivilege 3032 wmic.exe Token: SeShutdownPrivilege 3032 wmic.exe Token: SeDebugPrivilege 3032 wmic.exe Token: SeSystemEnvironmentPrivilege 3032 wmic.exe Token: SeRemoteShutdownPrivilege 3032 wmic.exe Token: SeUndockPrivilege 3032 wmic.exe Token: SeManageVolumePrivilege 3032 wmic.exe Token: 33 3032 wmic.exe Token: 34 3032 wmic.exe Token: 35 3032 wmic.exe Token: SeIncreaseQuotaPrivilege 2108 wmic.exe Token: SeSecurityPrivilege 2108 wmic.exe Token: SeTakeOwnershipPrivilege 2108 wmic.exe Token: SeLoadDriverPrivilege 2108 wmic.exe Token: SeSystemProfilePrivilege 2108 wmic.exe Token: SeSystemtimePrivilege 2108 wmic.exe Token: SeProfSingleProcessPrivilege 2108 wmic.exe Token: SeIncBasePriorityPrivilege 2108 wmic.exe Token: SeCreatePagefilePrivilege 2108 wmic.exe Token: SeBackupPrivilege 2108 wmic.exe Token: SeRestorePrivilege 2108 wmic.exe Token: SeShutdownPrivilege 2108 wmic.exe Token: SeDebugPrivilege 2108 wmic.exe Token: SeSystemEnvironmentPrivilege 2108 wmic.exe Token: SeRemoteShutdownPrivilege 2108 wmic.exe Token: SeUndockPrivilege 2108 wmic.exe Token: SeManageVolumePrivilege 2108 wmic.exe Token: 33 2108 wmic.exe Token: 34 2108 wmic.exe Token: 35 2108 wmic.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1756 wrote to memory of 320 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 32 PID 1756 wrote to memory of 320 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 32 PID 1756 wrote to memory of 320 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 32 PID 1756 wrote to memory of 320 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 32 PID 1756 wrote to memory of 1840 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 34 PID 1756 wrote to memory of 1840 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 34 PID 1756 wrote to memory of 1840 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 34 PID 1756 wrote to memory of 1840 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 34 PID 1756 wrote to memory of 3032 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 37 PID 1756 wrote to memory of 3032 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 37 PID 1756 wrote to memory of 3032 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 37 PID 1756 wrote to memory of 3032 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 37 PID 1756 wrote to memory of 2192 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 39 PID 1756 wrote to memory of 2192 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 39 PID 1756 wrote to memory of 2192 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 39 PID 1756 wrote to memory of 2192 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 39 PID 1756 wrote to memory of 2108 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 41 PID 1756 wrote to memory of 2108 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 41 PID 1756 wrote to memory of 2108 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 41 PID 1756 wrote to memory of 2108 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 41 PID 1756 wrote to memory of 1624 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 43 PID 1756 wrote to memory of 1624 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 43 PID 1756 wrote to memory of 1624 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 43 PID 1756 wrote to memory of 1624 1756 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe 43 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6ff1ca648505fe8bea6b4a26616b9722_JaffaCakes118.exe"1⤵
- UAC bypass
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1756 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:320
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:1840
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:2192
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2108
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:1624
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1768
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5792b2c836fc9383228793223f6d4a7f9
SHA1d2816e2a9add63e4a55a005540f7b1899ff504b3
SHA2561e730af979f8cc75e05bf3ca56fc6b58d548b28e5af7ec0c40bfc82fea4e99e2
SHA512ac1ad729b0cdbbbe4bd0299c2714363987c70dfcdf130766fe1871bba197a32afac9a75e406dc9bb2e67d99144dfe87a1553d01df0a1933e70f4e1e666fa2a9e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
16KB
MD502ded5f95df3dce958d463354a439602
SHA1691f30bff6d502c242a7b9a3e6a123ab6a99f1a0
SHA25686f5befe0793d77981157fe00d9751c3bd2a183c4ffbfcd9d1602332391353de
SHA51267a1e34aff97ac603cfc8d097d220e349802abf42a507cce06744ffb29084895deaadb518616ad8adb6fa40be0eb3618aeb58fe31dd7934782bee91a42f2def3