Analysis
- max time kernel
129s - max time network
139s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system - submitted
16/08/2024, 12:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
- Size 68KB
- Sample240816-pm43raycrm
- SHA256 dfecb46078038bcfa9d0b8db18bdc0646f33bad55ee7dd5ee46e61c6cf399620
- MD5 9e5c89c84cdbf460fc6857c4e32dafdf
- SHA1 ee0a95846ce48c59261eda0fdd6b38dfc83d9f4d
- SHA512 6da517ae5159ebcb0ac138b34215924fb21adae619c3c15ede6863866648e445633f482b2beaddbe74de66b48e18d106dbde3253ee2d3ce86da667f7f8494cd8
- SSDEEP 1536:7ufJPTAoUei1obcxtZbW3BqlIS2IyUY4h2wEsOolJT+y9v:7upTAneif03BqarUY4l
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Path
-
C:\Users\Admin\AppData\DECRYPT-SEJClZ-decrypt.hta
Ransom Note
- <!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>SEJClZ Decrypt</title><style type="text/css">body { text-align: center; background: rgb(192, 176, 176); color: black; font-family: Arial, Helvetica, sans-serif; font-size: 14pt;}a { cursor: pointer; color: rgb(68, 68, 68);}textarea { width: 90%; height: 200px; background: black; color: white; border: 1px solid black; font-size: 12pt; font-weight: bold;}</style></head><body><h1>SEJClZ Decrypt</h1><h3>All your data has been encrypted with Exorcist 2.0 Ransomware.</h3><h3>Do not worry: you have some hours to contact us and decrypt your data by paying a ransom.</h3><h3>If you don't pay in time, price will be increased. Then, if the payment is still not received, your keys will be destroyed.</h3><h3>To do this, install Tor Browser (here: <a href='https://www.torproject.org/download/'>https://www.torproject.org/download/</a>) and follow instructions on this web site: <a href='http://7iulpt5i6whht6zo2r52f7vptxtjxs3vfcdxxazllikrtqpupn4epnqd.onion/'>http://7iulpt5i6whht6zo2r52f7vptxtjxs3vfcdxxazllikrtqpupn4epnqd.onion/</a></h3><h3>IMPORTANT: Do not modify this file, otherwise you will not be able to recover your data!</h3><hr><h2>Your authorization key:</h2><textarea readonly>Ob/5QaalAbbFYQYmEI5JzkNq0qmhX+E3KCLeF/Nz5ETf3evhBFxNQVdPvFCaV/bV ymjcd+65++IMGcgYK0Gv5jwAPCtts5Snggu2EvNJSj78eHu0m/CS3F7oB6vas+1q aKhnKeVM0evUPKI7HEo1cAGOauZ1LXnW0qSxat7EsRafPeueKpNpGRr/oHGmtK3I AhrXbu20KDAmPiPC3DEXXWQP2SdvxipZOVtXETcTGufGxZWKOfCrL2DiRsAkY8gg E0FZ88V9ltLa4OSp9vPpWN5Y7q/qg3540GafFclisu7zTZIx75+y3it8nOt4hd/x zVXH7PiTxbIUGSxosWk63US20BFtb5kmEc/FkAtMW0NtYEYdjTjB8aHO2bOajGgl qiSsUlSnxiAB7Rf+Nx4qEV9KFclJar9TgfHf85i84HKSXeeFLaxPSltxtsAMc3EV qbXzqWVhdK1yes3ykJwuu0cdC79z01FuWP93URIah3hn0OzR1hn6+a3+Dps8UKYg 1D8qUm0p11cWHkxNATS+C7aFq5201EMMsXnVM5oV6MvnulxZzRTprNSUpwfXVmq9 UCG83BrI1PUABBRFe0o1C8iGYWo3D8efFbX5ZD7enwFDobg01L4cxwVDevoJ32Uj uUq7JqioGDiBh0x/ue72pF69NUTSo7mkvN+7Mgkw4/C5w4St5Er5B1OHXuxj9puE PCV7chgCz7UsuapxXLP8irq937akkH53rl1smxik+BcxA0hA2iX1651CLZzgVDjy RKygIMqexn49cCXAkY1wTgYcu55D8ronIwv+ZAEqfSfIJkpwzYGPZlaVdvIJDTtw oeG5+sdVzul+xznn5FoCXqfK0zDMs26wAm50pM31BuV1wEiBThB45UjSZrj5d84d 9FeLqQDbrnB5+lJS55uUsdUmSh6qLs3KSDdFNuql9oTeLXwTX0rwI02WAJ8LppHo iZirJFGOjibEuJBaNEbYGN+YVxcc2DdQMCQbnx2XYQE+4CgB9Gbr75A60XMxknhK 4F9nsFAJUXF3JdrzJ9ICy/8DThMtnT3TTOV2IUrBCd7X1FnMjU3V6psHFSl5flQ7 JWKDWz7GVEKVztSBYRce1ketqTr4JV2NxYNahPd8ANX9BayHR2C52VKX9xns6B59 iYZiHOJS7Bvs0Jhar0Wb/hkQUFl9/kTO9DgJ5YIbQSyjg+9bT6Ev/p4wIPSy8SZL ZeQtyjbrYE8foabhAPbkDbFhzBzWoe6IrEJGPI0im5UlweFAXaBfiHh7Y+mNLfsD JaoKAgo3sEOd/bcKTH2BF2p4HwUef/EzEF68SXCV4pY6ZUhElzoyIq+bcbn8LczH DojA0w9DWDtbTdi1VPbD/fvQl1JIntQgLNVhrqgDXWUVIjOqEntbwAM3eqPvyMgL M6AAcm/MnawfguZb/ccrTwpsEF+Ta/IYjZdppy3DE/jGSIoVGROPcG80yASQQNO2 zlAFjWxMBjfx6U1PAZcmRxgzHaXS51f4H/OKApD9LYp/uKyhlR1QLvjtBkiNxr+r EuPW+g9Sy0JjTAQP4Jn6lYmawTbv4doA7FdGEnmYvx0wbszT2wA5w5KGwXqSsy2l 7ZhxqHr6sst11uB5/fC6rQH8ifIlSjJblhoP3ijaYx5vGyt9roNIdHEyaUcPeKrs HAowwdp0xq2nFAg1t3SUJV5KGQJTQshH//L843DEHkUNoPIp42ERWWZc1pEYV/9j JqEva/274uqj35JbhJxA+rCVPkyQofNBnaS3ex4orZBA+De2/FbswN21CotaGVxR QFElFFPbJU/6zTJbrCdBrH2mqFe2tCrJM4xlr8L2h99KJnM99+qteoOP+ki/CVmQ fCoo4LXct1op6mTzp1l4VGNn5lr4qK0D16bN8uFgbFeAH2sN0zhNFaTw7kYMvgI5 XM1wsEGn9JmrvJ0FoeB/QFRHbRhHqjeCw7TQRY+96qE0GpZu9LSmfZBwT2LYUd8U p2/jVtzqYFXjUx2XvCnFCitTukC8Zu2IXzq3WxZ9ql43xQFy0dy5KuDmiOI+0xnV npcJmuTZY9g5oNxdyZdOHYHPCaJqDxioOMlNPOcO0ADJNyPiTZ9k6B+pq7q4Bxd7 GwuUerpIfgowBL+RG0+p2+tiSM/a/Rp7LS+VhbW8nDpNW+xiO/+Up74DNwuF1+56 rIfWNO0WVz5pqATz2pglq17U7HyaqSNTCw034cc58xynygQKjExZOtJTb9ySiFq1 ETdE0uqrtHJVBpws5BBkEGcEHlIzWRPV10DJBGFPbp/+99qyoYcdlBMJycqT8WLP odrlvfjTDHOE6/X7Ek8VFAOj7pKWi3oLAz3QV3UdoIpgZxd4wvUp2BAYyIdR7M54 ZU7kmNEO+16bcHcBN0JMCOiwBWH1AXlVvc6qtWzd4SG5StYbZeG8BQwVErsGlsKf oNEZAqdVwa/ooXySxbz/NK3kikkW5f2+mbcPxGrF3J7s9DiY+Kn/XP0OqF5Ak/BD AI9gsy7nU2ZMA7i3sRW0a9ksK5BpRJAmaIlndmAenSUT9i+5vVO7fIuD84IEdsCk 1LEBD5xdryGbyT81CIjxl8+fJ8tqMTmjh6Jd+PuGLIQIliABULo4itaHO/yyDUhV brufrSmuOxe1PzaY8HUlYI/yV09hmQpesO8Jo3Z1VyNUPjBrMo9DDwYo6ZnZRJvs llHfEvoDijDvEPRAm3E2AbhhyK6F8CT+xe8aSaqvgQY657hiwilTtZOqxd2nyBKl l5FSeISh6maIi0PRpCCQ5UbK08v/DrBsH8V8mcSh0uHxa+HR/hDTvKQGphu34Ogv B+XO9cYZogektNTxi7jM+UeJq08eDurGDdti/85Ef0lTYpTzV6mHUC56e/59c6NY cUCuHoC0+NaJzoP2Onm+OIcKWTbK27B/OFFW+gXX9+ww9P1MRAGmCQg1FoO3TPcZ FyGZQlYdzgNf+YTMnOAyhjHSxOpxv0b8fByiDUX4r1H1xHlklR+j6s5C0HQQ5Jcz oPomHmmzU+w1qZOMCPHCNJtA/TiMplsGiT4patUyRwxOGKrLRDMtxcQ3C54GixCX G5ow+VW3n/2iE997XSguIoFpg7e2mCYGIYViw0itG1Sd5cuzT/+sgRcW/uEeOyIC Fi9iOK6rKlyGNjme5XRQN7/Nx0K5oUSoFypPH8m4AjPJNj0NmYwz/w1IAlHB1FuJ vfH7fbuj8RcOw968GA1q29leJVjGMEPw+Nxy3NW3MR9UQXtUVbfiIC6RUMsZ+Jtg mDr4clCjT+xJP6lQE8CeiWILqq1hfy98qrjwg8HiSuzvWSJbb4AP5fAwrt2Pfg2X d/XjGhlZxFrOilKRHLYk9gL1Rik0wquyzLYwe1gYntx4InZ+Yv4a1bJaEiDmm7bY ZGJt12B/nAwVmi2NgoN8SF7VSrL1TXD24eOIREx+AGjGrjKts8XVFHAcvW329jVD yDqI+jUMwpSvQrArD/12CAHMVEyZPB0nKJ9muZx5UsRYF2zH1KriCqxQ3FlLAxTk YkBFskDtYkseeWsdY5b+HNHR6s7/4XAycFzV5+YFIFl2JuSxBZ5WlLlV9HNODRX6 MoE8OkhLH9nBYDpi3Dgokfx2RPu5rQuPQWELPpU1/ABdeazLYFbwGDXAnOf/HF/L QT29QdON4gli9E32h0wNIEoX65cOhgUtDnsTqik5VL/0L9PHalUWvKSXQLFzo3Lu Time9BUrtM1AKHOP2LvWuEkrHv3lghNQCBSd+aVbjhd4fkMfxkXi615qmObcVhH+ big4v6STNdG6yqcle31ca1LBHFk0XGd0lWx8ywgVcvqGhjR066caz48nbEin9++P PjKKfML4RAdoc+KUVBe90epfBMttNi8/vW2KhfiPuRLRQJmINfIoBETFnRzFSRDM x8nEqOzmD+AWFgVaBiYG4xa2YDQ3FDm/nqvXhxuxEoIU7Ksen2jPA22eeKTp7Dz4 FGfxtyl+V+8zZjjs95WKM1rJRczzjd4S+V35YA2cWWlXsQ71PNQ0tSkb9tkZMjke lpVeE7oDFtt9vk6kxa9KJrTR1EZKMpoE04VBdt0zi7IotUyEixNT3FhOeQLhBZVJ VV/U41Kllp/CZap6UjE9UEtPKYLEuIt4TBtsbtccr0HDem1zAAZ5YluprQW+JI95 ikakrDjcajbA+b6XO8ISHtdu+AloWnhKSjjxez4lXTBIZBRbwOBrMGJAj2UuP1zt OVg3Kn44dqILKJWF4b74htY50T5fEqkKQsVX3n6iJwKHwjAZNKs7UtbOs7Sx1Vqo jNcMIH7eyeRhtDHDLbGquXyLYhXaZsfiAHxtOAfldnc9WBvmFETyzU5ssUgw+prD 8LjjTLhGXYcly/Fuui/wNVUSg6X1ST1+pN83wr+gjCWZ5rQ3HVqLouFSxTzs2QBw yRT0HkO1yr7mE9a2gvmlCzB0fHwDJPdaP/ddfjOO+U2f/XdL3N+5d+XBXNWJ7l63 KZmpdc/y+7JeiTYZUfPsAgrCw560eOcTbqRC1TIhIavI3Tgr8l6s3hB08okC9KaF ij8obJx/CC65BtAF2PAsAmxeiBg8+gQ4qtxo0gqufspoeco45tZ32nZCLcKr26EA jI948khqSPeH46THeluBIyggHeVJSrurTM0dfxgGhCH804Vum4XPdv5D0Wf5I5Rb q5ucQgMExNkFf0JwtW5qW7dQKudUIgFRQq+/GBFJT5T2uRh4KPeah3nrZMkgPJuV 2hmffaM2AGUCUS4AC5QzXp5tB1FUxd0cLEOzPWmyWpeHXXUSzSA1X8PKqQDfCnm/ 6uagr1pIR3x80ao1AIG1zzkfofOEOoqBW6KscdXMr28ucUI3tgR/WFr32dx3yAc8 AOsiN63cackgYonIzKSe+3OBooDV2/J4rNWwhhJIH02l8hZuUq8usGGmrUKY03V7 aJYgsfl65oK1Qj7MfSgkSU3zO+ZnBSG7XCPUyWcSZT/crdNw+l2tE6xIlXacOdDg ShNC/UkQ8abI2fPyD7+MgwwRAfrNlRU9ZOO9gPm0eQwAVC4qGx44qR96ROwouDCe </textarea></body></html>
Signatures
- Exorcist Ransomware
Ransomware-as-a-service which avoids infecting machines in CIS nations. First seen in mid-2020.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (193) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-18\desktop.ini 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-18\desktop.ini 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe - Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\V: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\P: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\L: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\K: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\J: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\T: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\R: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\O: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\F: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\B: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\S: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\E: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\X: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\U: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\N: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\I: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\D: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\Z: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\M: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\Y: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\W: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\H: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\G: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File opened (read-only) \??\A: 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2040 vssadmin.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = e4ccf7a8271fdc989f37cf0f72e20dd1176fae3ea6b1ba7cc642cda61994d08c 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004d0075007300690063005c0045007800700061006e0064005300770069007400630068002e006f006700670000000000 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 5701400dfd50809f52f162c890a7a8fe16a1f86af08f918ac169b2dc22cc7b31 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = a784f52781b74e0885a9de97ff651aaa515c1ee2a393c6b6ed2354a6f62aca1c 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004400650073006b0074006f0070005c0043006f006e007600650072007400460072006f006d0050007500730068002e0072006d0000000000 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = f2cc20c1597d222d1fe277766e92d778e100733262804835373b0793b97e8f92 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c00500069006300740075007200650073005c004c006f0063006b005300770069007400630068002e0062006d00700000000000 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = c996837be3432945cdb22e9b9bb9c2451de194d53e3483d6bba798ca62af4311 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 88c3918d26cea629c71746eb2380705774bb5bf3bdb1047713c094a65339d62c 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 303b3575ca7d63d6f5177912e8eb8403d091f74b0198307afa60897c0c3ba6a0 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = fd95d8337edf5173e5c07f50a448728b0845df6984700ef8f934ead89f38a7aa 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f00630075006d0065006e00740073005c0043006f006e007600650072007400460072006f006d0055006e00720065006700690073007400650072002e007600730073006d0000000000 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = b2b19fa55f37baba2c9f8a53ef5b61a7819c9aea4edebd0877f225fb3dd5ff8d 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = ed42d0a9d2ec689d7494f41c9c16c64dd00ef5d1aee6e56ccd8a0e85b1066684 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 591ff16b586d622876295710e763bce7ccf6712b12d622a8e86cf8ed3f4752bc 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 6d43a6ff484388940f28b6f7019dce6decee8c6e7faca9eef1c86d0a753887b9 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A0377A8-FF70-4A7F-BEE6-0CA71D73BEB1}\WpadDecisionReason = "1" 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = f1093660b9c66fcdc64c4b73c607ad5f9fc31b421700be8986457cfa3a4ff786 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 0d6ccc5b1e5e784109bb1e55f54562736edb4f61cbdd7f2cb9f1778b883f675f 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = ebe6aaaed66830c65d7b39e0de52a9443229ce234e1213c0148251fe9c0726e9 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 219674e40729f57b350455b34d8705be9933b3df672341178f2839ea815e9359 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 31141683da297113e26acf4b4729d897515146968c223077dd5338cc71906640 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 01a0e2077452ca8fdd80446116987754985ec78a42646ec6b2a79d733e5ef5f4 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 47a14ccb6622150f81b9e076b56b1ec6b29b23fdd2215ec0b19ddc5f8c5cb123 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 0ae005b2f66480ce04a41ddf794b885d553211b19e4709167da2ba31d8f953c3 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = fff50131c59c1e4e7d626cd4c97eb03676ec63033be275752d504cfce6b77aae 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = d339adc4f0295527a1098380559ddefafd477d7226ec3aa3159b56fabaf7d883 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 3c3c80809a1820a190f8432696db6b3909ef83d77d5da0b282129515c0e73792 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = c2463037d02f6c3a31e3cc6a225cf0fed629db170207ccf13ce22efeabc9754a 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 29335d25c7c3b1766cd514b14e4f03ffeefdc91cfa8f42c7f57423df7004d043 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = c5d4f3ac5980279465153d000a989dc0f71d177a87994278d6760600ed1108ef 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A0377A8-FF70-4A7F-BEE6-0CA71D73BEB1}\WpadNetworkName = "Network 3" 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004400650073006b0074006f0070005c00470072006f007500700049006d0070006f00720074002e00740069006600660000000000 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 816a316a3e03e4929daf2e2ddd77fce55bb89870c3e72969023b724ed0d7acd4 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f00630075006d0065006e00740073005c0043006f006d00700072006500730073005300770069007400630068002e0064006f007400780000000000 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f0077006e006c006f006100640073005c005200650073006f006c0076006500520065006d006f00760065002e00680074006d006c0000000000 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004600610076006f00720069007400650073005c004d006900630072006f0073006f00660074002000570065006200730069007400650073005c004d006900630072006f0073006f00660074002000530074006f00720065002e00750072006c0000000000 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = fd153086b6b18949cf31a3527b69cda486624c9589b759af1df4438caffa55a6 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0043006f006e00740061006300740073005c00410064006d0069006e002e0063006f006e00740061006300740000000000 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = c2435a1ef2d77ae2557b91444c2f0578cbb1e0ada96254c44c0403a6f9ee92fc 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 7fba8c4ea10f6af3ade8f526692f63c34eeb9228abc4f4c622dc06fb4c5928a2 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 6e6d591ac95b836c59b6fee61c288f409f9d71a5890229a0ce44bb65fa2fbc08 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f00630075006d0065006e00740073005c0054007200610063006500440069007300610062006c0065002e007000700074006d0000000000 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 6085569227d5c336dc3ea3747adade15198b9866f008b177fa264a8ca05fd38e 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 5df4cc8c0ca62ad7edec9feb329c1054e87a269ab7b182e9fc9b13b02af203ad 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = d94cc3a06be93070457ba6d8fc9ccc402aea1d70633dc583538279098b415250 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = b0a61d201c6a85e66cefcaee93976b6a299adf3ec17731f1f877e383d740aec1 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = e7027f4f554249af3b4f8709bfcb64f8ef518d284fc3d8b76ca88cf37480c0a9 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 4d9834de570d96e669b67b99970d70ef492b314a42764adb05dc693d2b3633e1 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c00500069006300740075007200650073005c0045006e00610062006c00650044006900730063006f006e006e006500630074002e0067006900660000000000 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 222c0e491569a8eca56a71594693722a0aff4dbb56035ed361cbedac035efbaf 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c005000750062006c00690063005c00500069006300740075007200650073005c00530061006d0070006c0065002000500069006300740075007200650073005c00540075006c006900700073002e006a007000670000000000 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = ab3b479e0f2ceeabce2f1efce01e187eaebb62a42176d14420dc4e0e3d9aeb61 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = eb8388a9dd20380bb8dce32bc120c0b57c2860c15c06f33f26d7b10777e91337 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Sequence = "1" 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = db90e918ac9b8a2eb215badd18d54e30ff4c7ff47aa814d4f0e7db72d6f5b3c9 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 74320764202bb1bdf7e345d498ee92d3cadaf29b8ac659e9fcc1bc25a7c5d580 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = c9fed7eb806cb1d1468d8f115f63c5776f58009c076daf40c6d737b5d49064e2 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = d891162626d83bde00a54f519b8a7af4d5ee17c9655b45eda6ec09ff6273cd81 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 9b024730b12957a65d0757b6891256fa15484491005ba71bc39a4142def0e776 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004400650073006b0074006f0070005c004200610063006b007500700043006f006e006e006500630074002e0070006300780000000000 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 16262190ccd9052f31d35a0928b31ec8b0a5054b82d7d15e17024f3fca61b1f1 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 3ecba859a0c8fe095c9eb2fb9bb214839a17fd3bcff5d55b34995428f7743144 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 638d8515d107856e4b6f5605e9220931467b3cbe5136ad7bf09cd0066b4c7315 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe - NTFS ADS 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\nbp1aQ\windows.sys:dhpkxqkdun 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File created C:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\hWs9P3\windows.sys:qvqhfjkvnrdtqgtt 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File created C:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\nbp1aQ\windows.sys:dhpkxqkdun 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe File created C:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\MR8cZJ\windows.sys:qxoyhxveerelbnrwg 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe - Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeDebugPrivilege 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Token: SeRestorePrivilege 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Token: SeDebugPrivilege 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Token: SeSecurityPrivilege 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Token: SeRestorePrivilege 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Token: SeDebugPrivilege 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe Token: SeBackupPrivilege 1968 vssvc.exe Token: SeRestorePrivilege 1968 vssvc.exe Token: SeAuditPrivilege 1968 vssvc.exe Token: SeIncreaseQuotaPrivilege 2756 WMIC.exe Token: SeSecurityPrivilege 2756 WMIC.exe Token: SeTakeOwnershipPrivilege 2756 WMIC.exe Token: SeLoadDriverPrivilege 2756 WMIC.exe Token: SeSystemProfilePrivilege 2756 WMIC.exe Token: SeSystemtimePrivilege 2756 WMIC.exe Token: SeProfSingleProcessPrivilege 2756 WMIC.exe Token: SeIncBasePriorityPrivilege 2756 WMIC.exe Token: SeCreatePagefilePrivilege 2756 WMIC.exe Token: SeBackupPrivilege 2756 WMIC.exe Token: SeRestorePrivilege 2756 WMIC.exe Token: SeShutdownPrivilege 2756 WMIC.exe Token: SeDebugPrivilege 2756 WMIC.exe Token: SeSystemEnvironmentPrivilege 2756 WMIC.exe Token: SeRemoteShutdownPrivilege 2756 WMIC.exe Token: SeUndockPrivilege 2756 WMIC.exe Token: SeManageVolumePrivilege 2756 WMIC.exe Token: 33 2756 WMIC.exe Token: 34 2756 WMIC.exe Token: 35 2756 WMIC.exe - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2540 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 30 PID 1732 wrote to memory of 2540 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 30 PID 1732 wrote to memory of 2540 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 30 PID 1732 wrote to memory of 2540 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 30 PID 2540 wrote to memory of 2040 2540 cmd.exe 32 PID 2540 wrote to memory of 2040 2540 cmd.exe 32 PID 2540 wrote to memory of 2040 2540 cmd.exe 32 PID 2540 wrote to memory of 2040 2540 cmd.exe 32 PID 1732 wrote to memory of 2696 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 34 PID 1732 wrote to memory of 2696 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 34 PID 1732 wrote to memory of 2696 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 34 PID 1732 wrote to memory of 2696 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 34 PID 1732 wrote to memory of 2564 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 36 PID 1732 wrote to memory of 2564 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 36 PID 1732 wrote to memory of 2564 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 36 PID 1732 wrote to memory of 2564 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 36 PID 1732 wrote to memory of 2744 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 38 PID 1732 wrote to memory of 2744 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 38 PID 1732 wrote to memory of 2744 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 38 PID 1732 wrote to memory of 2744 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 38 PID 1732 wrote to memory of 2828 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 40 PID 1732 wrote to memory of 2828 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 40 PID 1732 wrote to memory of 2828 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 40 PID 1732 wrote to memory of 2828 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 40 PID 1732 wrote to memory of 2912 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 42 PID 1732 wrote to memory of 2912 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 42 PID 1732 wrote to memory of 2912 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 42 PID 1732 wrote to memory of 2912 1732 9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe 42 PID 2912 wrote to memory of 2756 2912 cmd.exe 44 PID 2912 wrote to memory of 2756 2912 cmd.exe 44 PID 2912 wrote to memory of 2756 2912 cmd.exe 44 PID 2912 wrote to memory of 2756 2912 cmd.exe 44 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\cmd.execmd /C vssadmin Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:2040
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C bcdedit /set {default} recoveryenabled No2⤵
- System Location Discovery: System Language Discovery
PID:2696
-
-
C:\Windows\SysWOW64\cmd.execmd /C bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- System Location Discovery: System Language Discovery
PID:2564
-
-
C:\Windows\SysWOW64\cmd.execmd /C wbadmin DELETE SYSTEMSTATEBACKUP2⤵
- System Location Discovery: System Language Discovery
PID:2744
-
-
C:\Windows\SysWOW64\cmd.execmd /C wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest2⤵
- System Location Discovery: System Language Discovery
PID:2828
-
-
C:\Windows\SysWOW64\cmd.execmd /C wmic SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic SHADOWCOPY /nointeractive3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\DECRYPT-SEJClZ-decrypt.hta
- Size 6KB
- SHA256 bbcd37e8e059f37642182c415bda686e3c709298735fe9185643132809a28835
- MD5 c808f71665399239e348cabc85c0e8d9
- SHA1 9917eafda63c416f00f95bc681f39de00db25256
- SHA512 3f8f3d448f1297020edea0507d3ac186c30f618a002299fabf53c486a9d3b68a06029933c19c120a50aa4b1cb7ff627c89a93f611bb2341f53a840354dc57485
- SSDEEP 96:TmAFVzV/7jEXmjMm9Gn6n4jvcvXYac7MqXSSha3UayXQtW9rGalBbhCKZSZWj+I:6A1HSiGn6djc4qX1havx4JGIBbtZFjr
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-18\desktop.ini
- Size 129B
- SHA256 e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
- MD5 a526b9e7c716b3489d8cc062fbce4005
- SHA1 2df502a944ff721241be20a9e449d2acd07e0312
- SHA512 d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
- MD5 SHA1 SHA512