exorcist | dfecb46078038bcfa9d0b8db18bdc0646f33bad55ee7dd5ee46e61c6cf399620

Resubmissions

16-08-2024 12:27

240816-pm43raycrm 10

Analysis

max time kernel
129s
max time network
139s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16-08-2024 12:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Size

68KB
MD5

9e5c89c84cdbf460fc6857c4e32dafdf
SHA1

ee0a95846ce48c59261eda0fdd6b38dfc83d9f4d
SHA256

dfecb46078038bcfa9d0b8db18bdc0646f33bad55ee7dd5ee46e61c6cf399620
SHA512

6da517ae5159ebcb0ac138b34215924fb21adae619c3c15ede6863866648e445633f482b2beaddbe74de66b48e18d106dbde3253ee2d3ce86da667f7f8494cd8
SSDEEP

1536:7ufJPTAoUei1obcxtZbW3BqlIS2IyUY4h2wEsOolJT+y9v:7upTAneif03BqarUY4l

Score

10^/10

exorcist defense_evasion discovery execution impact ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\DECRYPT-SEJClZ-decrypt.hta

Ransom Note

<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>SEJClZ Decrypt</title><style type="text/css">body { text-align: center; background: rgb(192, 176, 176); color: black; font-family: Arial, Helvetica, sans-serif; font-size: 14pt;}a { cursor: pointer; color: rgb(68, 68, 68);}textarea { width: 90%; height: 200px; background: black; color: white; border: 1px solid black; font-size: 12pt; font-weight: bold;}</style></head><body><h1>SEJClZ Decrypt</h1><h3>All your data has been encrypted with Exorcist 2.0 Ransomware.</h3><h3>Do not worry: you have some hours to contact us and decrypt your data by paying a ransom.</h3><h3>If you don't pay in time, price will be increased. Then, if the payment is still not received, your keys will be destroyed.</h3><h3>To do this, install Tor Browser (here: <a href='https://www.torproject.org/download/'>https://www.torproject.org/download/</a>) and follow instructions on this web site: <a href='http://7iulpt5i6whht6zo2r52f7vptxtjxs3vfcdxxazllikrtqpupn4epnqd.onion/'>http://7iulpt5i6whht6zo2r52f7vptxtjxs3vfcdxxazllikrtqpupn4epnqd.onion/</a></h3><h3>IMPORTANT: Do not modify this file, otherwise you will not be able to recover your data!</h3><hr><h2>Your authorization key:</h2><textarea readonly>Ob/5QaalAbbFYQYmEI5JzkNq0qmhX+E3KCLeF/Nz5ETf3evhBFxNQVdPvFCaV/bV ymjcd+65++IMGcgYK0Gv5jwAPCtts5Snggu2EvNJSj78eHu0m/CS3F7oB6vas+1q aKhnKeVM0evUPKI7HEo1cAGOauZ1LXnW0qSxat7EsRafPeueKpNpGRr/oHGmtK3I AhrXbu20KDAmPiPC3DEXXWQP2SdvxipZOVtXETcTGufGxZWKOfCrL2DiRsAkY8gg E0FZ88V9ltLa4OSp9vPpWN5Y7q/qg3540GafFclisu7zTZIx75+y3it8nOt4hd/x zVXH7PiTxbIUGSxosWk63US20BFtb5kmEc/FkAtMW0NtYEYdjTjB8aHO2bOajGgl qiSsUlSnxiAB7Rf+Nx4qEV9KFclJar9TgfHf85i84HKSXeeFLaxPSltxtsAMc3EV qbXzqWVhdK1yes3ykJwuu0cdC79z01FuWP93URIah3hn0OzR1hn6+a3+Dps8UKYg 1D8qUm0p11cWHkxNATS+C7aFq5201EMMsXnVM5oV6MvnulxZzRTprNSUpwfXVmq9 UCG83BrI1PUABBRFe0o1C8iGYWo3D8efFbX5ZD7enwFDobg01L4cxwVDevoJ32Uj uUq7JqioGDiBh0x/ue72pF69NUTSo7mkvN+7Mgkw4/C5w4St5Er5B1OHXuxj9puE PCV7chgCz7UsuapxXLP8irq937akkH53rl1smxik+BcxA0hA2iX1651CLZzgVDjy RKygIMqexn49cCXAkY1wTgYcu55D8ronIwv+ZAEqfSfIJkpwzYGPZlaVdvIJDTtw oeG5+sdVzul+xznn5FoCXqfK0zDMs26wAm50pM31BuV1wEiBThB45UjSZrj5d84d 9FeLqQDbrnB5+lJS55uUsdUmSh6qLs3KSDdFNuql9oTeLXwTX0rwI02WAJ8LppHo iZirJFGOjibEuJBaNEbYGN+YVxcc2DdQMCQbnx2XYQE+4CgB9Gbr75A60XMxknhK 4F9nsFAJUXF3JdrzJ9ICy/8DThMtnT3TTOV2IUrBCd7X1FnMjU3V6psHFSl5flQ7 JWKDWz7GVEKVztSBYRce1ketqTr4JV2NxYNahPd8ANX9BayHR2C52VKX9xns6B59 iYZiHOJS7Bvs0Jhar0Wb/hkQUFl9/kTO9DgJ5YIbQSyjg+9bT6Ev/p4wIPSy8SZL ZeQtyjbrYE8foabhAPbkDbFhzBzWoe6IrEJGPI0im5UlweFAXaBfiHh7Y+mNLfsD JaoKAgo3sEOd/bcKTH2BF2p4HwUef/EzEF68SXCV4pY6ZUhElzoyIq+bcbn8LczH DojA0w9DWDtbTdi1VPbD/fvQl1JIntQgLNVhrqgDXWUVIjOqEntbwAM3eqPvyMgL M6AAcm/MnawfguZb/ccrTwpsEF+Ta/IYjZdppy3DE/jGSIoVGROPcG80yASQQNO2 zlAFjWxMBjfx6U1PAZcmRxgzHaXS51f4H/OKApD9LYp/uKyhlR1QLvjtBkiNxr+r EuPW+g9Sy0JjTAQP4Jn6lYmawTbv4doA7FdGEnmYvx0wbszT2wA5w5KGwXqSsy2l 7ZhxqHr6sst11uB5/fC6rQH8ifIlSjJblhoP3ijaYx5vGyt9roNIdHEyaUcPeKrs HAowwdp0xq2nFAg1t3SUJV5KGQJTQshH//L843DEHkUNoPIp42ERWWZc1pEYV/9j JqEva/274uqj35JbhJxA+rCVPkyQofNBnaS3ex4orZBA+De2/FbswN21CotaGVxR QFElFFPbJU/6zTJbrCdBrH2mqFe2tCrJM4xlr8L2h99KJnM99+qteoOP+ki/CVmQ fCoo4LXct1op6mTzp1l4VGNn5lr4qK0D16bN8uFgbFeAH2sN0zhNFaTw7kYMvgI5 XM1wsEGn9JmrvJ0FoeB/QFRHbRhHqjeCw7TQRY+96qE0GpZu9LSmfZBwT2LYUd8U p2/jVtzqYFXjUx2XvCnFCitTukC8Zu2IXzq3WxZ9ql43xQFy0dy5KuDmiOI+0xnV npcJmuTZY9g5oNxdyZdOHYHPCaJqDxioOMlNPOcO0ADJNyPiTZ9k6B+pq7q4Bxd7 GwuUerpIfgowBL+RG0+p2+tiSM/a/Rp7LS+VhbW8nDpNW+xiO/+Up74DNwuF1+56 rIfWNO0WVz5pqATz2pglq17U7HyaqSNTCw034cc58xynygQKjExZOtJTb9ySiFq1 ETdE0uqrtHJVBpws5BBkEGcEHlIzWRPV10DJBGFPbp/+99qyoYcdlBMJycqT8WLP odrlvfjTDHOE6/X7Ek8VFAOj7pKWi3oLAz3QV3UdoIpgZxd4wvUp2BAYyIdR7M54 ZU7kmNEO+16bcHcBN0JMCOiwBWH1AXlVvc6qtWzd4SG5StYbZeG8BQwVErsGlsKf oNEZAqdVwa/ooXySxbz/NK3kikkW5f2+mbcPxGrF3J7s9DiY+Kn/XP0OqF5Ak/BD AI9gsy7nU2ZMA7i3sRW0a9ksK5BpRJAmaIlndmAenSUT9i+5vVO7fIuD84IEdsCk 1LEBD5xdryGbyT81CIjxl8+fJ8tqMTmjh6Jd+PuGLIQIliABULo4itaHO/yyDUhV brufrSmuOxe1PzaY8HUlYI/yV09hmQpesO8Jo3Z1VyNUPjBrMo9DDwYo6ZnZRJvs llHfEvoDijDvEPRAm3E2AbhhyK6F8CT+xe8aSaqvgQY657hiwilTtZOqxd2nyBKl l5FSeISh6maIi0PRpCCQ5UbK08v/DrBsH8V8mcSh0uHxa+HR/hDTvKQGphu34Ogv B+XO9cYZogektNTxi7jM+UeJq08eDurGDdti/85Ef0lTYpTzV6mHUC56e/59c6NY cUCuHoC0+NaJzoP2Onm+OIcKWTbK27B/OFFW+gXX9+ww9P1MRAGmCQg1FoO3TPcZ FyGZQlYdzgNf+YTMnOAyhjHSxOpxv0b8fByiDUX4r1H1xHlklR+j6s5C0HQQ5Jcz oPomHmmzU+w1qZOMCPHCNJtA/TiMplsGiT4patUyRwxOGKrLRDMtxcQ3C54GixCX G5ow+VW3n/2iE997XSguIoFpg7e2mCYGIYViw0itG1Sd5cuzT/+sgRcW/uEeOyIC Fi9iOK6rKlyGNjme5XRQN7/Nx0K5oUSoFypPH8m4AjPJNj0NmYwz/w1IAlHB1FuJ vfH7fbuj8RcOw968GA1q29leJVjGMEPw+Nxy3NW3MR9UQXtUVbfiIC6RUMsZ+Jtg mDr4clCjT+xJP6lQE8CeiWILqq1hfy98qrjwg8HiSuzvWSJbb4AP5fAwrt2Pfg2X d/XjGhlZxFrOilKRHLYk9gL1Rik0wquyzLYwe1gYntx4InZ+Yv4a1bJaEiDmm7bY ZGJt12B/nAwVmi2NgoN8SF7VSrL1TXD24eOIREx+AGjGrjKts8XVFHAcvW329jVD yDqI+jUMwpSvQrArD/12CAHMVEyZPB0nKJ9muZx5UsRYF2zH1KriCqxQ3FlLAxTk YkBFskDtYkseeWsdY5b+HNHR6s7/4XAycFzV5+YFIFl2JuSxBZ5WlLlV9HNODRX6 MoE8OkhLH9nBYDpi3Dgokfx2RPu5rQuPQWELPpU1/ABdeazLYFbwGDXAnOf/HF/L QT29QdON4gli9E32h0wNIEoX65cOhgUtDnsTqik5VL/0L9PHalUWvKSXQLFzo3Lu Time9BUrtM1AKHOP2LvWuEkrHv3lghNQCBSd+aVbjhd4fkMfxkXi615qmObcVhH+ big4v6STNdG6yqcle31ca1LBHFk0XGd0lWx8ywgVcvqGhjR066caz48nbEin9++P PjKKfML4RAdoc+KUVBe90epfBMttNi8/vW2KhfiPuRLRQJmINfIoBETFnRzFSRDM x8nEqOzmD+AWFgVaBiYG4xa2YDQ3FDm/nqvXhxuxEoIU7Ksen2jPA22eeKTp7Dz4 FGfxtyl+V+8zZjjs95WKM1rJRczzjd4S+V35YA2cWWlXsQ71PNQ0tSkb9tkZMjke lpVeE7oDFtt9vk6kxa9KJrTR1EZKMpoE04VBdt0zi7IotUyEixNT3FhOeQLhBZVJ VV/U41Kllp/CZap6UjE9UEtPKYLEuIt4TBtsbtccr0HDem1zAAZ5YluprQW+JI95 ikakrDjcajbA+b6XO8ISHtdu+AloWnhKSjjxez4lXTBIZBRbwOBrMGJAj2UuP1zt OVg3Kn44dqILKJWF4b74htY50T5fEqkKQsVX3n6iJwKHwjAZNKs7UtbOs7Sx1Vqo jNcMIH7eyeRhtDHDLbGquXyLYhXaZsfiAHxtOAfldnc9WBvmFETyzU5ssUgw+prD 8LjjTLhGXYcly/Fuui/wNVUSg6X1ST1+pN83wr+gjCWZ5rQ3HVqLouFSxTzs2QBw yRT0HkO1yr7mE9a2gvmlCzB0fHwDJPdaP/ddfjOO+U2f/XdL3N+5d+XBXNWJ7l63 KZmpdc/y+7JeiTYZUfPsAgrCw560eOcTbqRC1TIhIavI3Tgr8l6s3hB08okC9KaF ij8obJx/CC65BtAF2PAsAmxeiBg8+gQ4qtxo0gqufspoeco45tZ32nZCLcKr26EA jI948khqSPeH46THeluBIyggHeVJSrurTM0dfxgGhCH804Vum4XPdv5D0Wf5I5Rb q5ucQgMExNkFf0JwtW5qW7dQKudUIgFRQq+/GBFJT5T2uRh4KPeah3nrZMkgPJuV 2hmffaM2AGUCUS4AC5QzXp5tB1FUxd0cLEOzPWmyWpeHXXUSzSA1X8PKqQDfCnm/ 6uagr1pIR3x80ao1AIG1zzkfofOEOoqBW6KscdXMr28ucUI3tgR/WFr32dx3yAc8 AOsiN63cackgYonIzKSe+3OBooDV2/J4rNWwhhJIH02l8hZuUq8usGGmrUKY03V7 aJYgsfl65oK1Qj7MfSgkSU3zO+ZnBSG7XCPUyWcSZT/crdNw+l2tE6xIlXacOdDg ShNC/UkQ8abI2fPyD7+MgwwRAfrNlRU9ZOO9gPm0eQwAVC4qGx44qR96ROwouDCe </textarea></body></html>

Signatures

Exorcist Ransomware
Ransomware-as-a-service which avoids infecting machines in CIS nations. First seen in mid-2020.
ransomware exorcist
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (193) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-18\desktop.ini	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened for modification	\??\Z:\$RECYCLE.BIN\S-1-5-18\desktop.ini	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\V:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\P:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\L:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\K:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\J:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\T:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\R:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\O:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\F:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\B:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\S:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\E:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\X:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\U:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\N:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\I:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\D:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\Z:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\M:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\Y:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\W:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\H:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\G:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File opened (read-only)	\??\A:	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2040	vssadmin.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = e4ccf7a8271fdc989f37cf0f72e20dd1176fae3ea6b1ba7cc642cda61994d08c	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004d0075007300690063005c0045007800700061006e0064005300770069007400630068002e006f006700670000000000	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 5701400dfd50809f52f162c890a7a8fe16a1f86af08f918ac169b2dc22cc7b31	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = a784f52781b74e0885a9de97ff651aaa515c1ee2a393c6b6ed2354a6f62aca1c	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004400650073006b0074006f0070005c0043006f006e007600650072007400460072006f006d0050007500730068002e0072006d0000000000	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = f2cc20c1597d222d1fe277766e92d778e100733262804835373b0793b97e8f92	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c00500069006300740075007200650073005c004c006f0063006b005300770069007400630068002e0062006d00700000000000	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = c996837be3432945cdb22e9b9bb9c2451de194d53e3483d6bba798ca62af4311	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 88c3918d26cea629c71746eb2380705774bb5bf3bdb1047713c094a65339d62c	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 303b3575ca7d63d6f5177912e8eb8403d091f74b0198307afa60897c0c3ba6a0	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = fd95d8337edf5173e5c07f50a448728b0845df6984700ef8f934ead89f38a7aa	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f00630075006d0065006e00740073005c0043006f006e007600650072007400460072006f006d0055006e00720065006700690073007400650072002e007600730073006d0000000000	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = b2b19fa55f37baba2c9f8a53ef5b61a7819c9aea4edebd0877f225fb3dd5ff8d	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = ed42d0a9d2ec689d7494f41c9c16c64dd00ef5d1aee6e56ccd8a0e85b1066684	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 591ff16b586d622876295710e763bce7ccf6712b12d622a8e86cf8ed3f4752bc	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 6d43a6ff484388940f28b6f7019dce6decee8c6e7faca9eef1c86d0a753887b9	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A0377A8-FF70-4A7F-BEE6-0CA71D73BEB1}\WpadDecisionReason = "1"	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = f1093660b9c66fcdc64c4b73c607ad5f9fc31b421700be8986457cfa3a4ff786	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 0d6ccc5b1e5e784109bb1e55f54562736edb4f61cbdd7f2cb9f1778b883f675f	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = ebe6aaaed66830c65d7b39e0de52a9443229ce234e1213c0148251fe9c0726e9	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 219674e40729f57b350455b34d8705be9933b3df672341178f2839ea815e9359	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 31141683da297113e26acf4b4729d897515146968c223077dd5338cc71906640	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 01a0e2077452ca8fdd80446116987754985ec78a42646ec6b2a79d733e5ef5f4	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 47a14ccb6622150f81b9e076b56b1ec6b29b23fdd2215ec0b19ddc5f8c5cb123	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 0ae005b2f66480ce04a41ddf794b885d553211b19e4709167da2ba31d8f953c3	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = fff50131c59c1e4e7d626cd4c97eb03676ec63033be275752d504cfce6b77aae	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = d339adc4f0295527a1098380559ddefafd477d7226ec3aa3159b56fabaf7d883	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 3c3c80809a1820a190f8432696db6b3909ef83d77d5da0b282129515c0e73792	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = c2463037d02f6c3a31e3cc6a225cf0fed629db170207ccf13ce22efeabc9754a	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 29335d25c7c3b1766cd514b14e4f03ffeefdc91cfa8f42c7f57423df7004d043	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = c5d4f3ac5980279465153d000a989dc0f71d177a87994278d6760600ed1108ef	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A0377A8-FF70-4A7F-BEE6-0CA71D73BEB1}\WpadNetworkName = "Network 3"	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004400650073006b0074006f0070005c00470072006f007500700049006d0070006f00720074002e00740069006600660000000000	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 816a316a3e03e4929daf2e2ddd77fce55bb89870c3e72969023b724ed0d7acd4	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f00630075006d0065006e00740073005c0043006f006d00700072006500730073005300770069007400630068002e0064006f007400780000000000	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f0077006e006c006f006100640073005c005200650073006f006c0076006500520065006d006f00760065002e00680074006d006c0000000000	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004600610076006f00720069007400650073005c004d006900630072006f0073006f00660074002000570065006200730069007400650073005c004d006900630072006f0073006f00660074002000530074006f00720065002e00750072006c0000000000	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = fd153086b6b18949cf31a3527b69cda486624c9589b759af1df4438caffa55a6	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0043006f006e00740061006300740073005c00410064006d0069006e002e0063006f006e00740061006300740000000000	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = c2435a1ef2d77ae2557b91444c2f0578cbb1e0ada96254c44c0403a6f9ee92fc	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 7fba8c4ea10f6af3ade8f526692f63c34eeb9228abc4f4c622dc06fb4c5928a2	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 6e6d591ac95b836c59b6fee61c288f409f9d71a5890229a0ce44bb65fa2fbc08	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f00630075006d0065006e00740073005c0054007200610063006500440069007300610062006c0065002e007000700074006d0000000000	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 6085569227d5c336dc3ea3747adade15198b9866f008b177fa264a8ca05fd38e	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 5df4cc8c0ca62ad7edec9feb329c1054e87a269ab7b182e9fc9b13b02af203ad	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = d94cc3a06be93070457ba6d8fc9ccc402aea1d70633dc583538279098b415250	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = b0a61d201c6a85e66cefcaee93976b6a299adf3ec17731f1f877e383d740aec1	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = e7027f4f554249af3b4f8709bfcb64f8ef518d284fc3d8b76ca88cf37480c0a9	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 4d9834de570d96e669b67b99970d70ef492b314a42764adb05dc693d2b3633e1	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c00500069006300740075007200650073005c0045006e00610062006c00650044006900730063006f006e006e006500630074002e0067006900660000000000	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 222c0e491569a8eca56a71594693722a0aff4dbb56035ed361cbedac035efbaf	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c005000750062006c00690063005c00500069006300740075007200650073005c00530061006d0070006c0065002000500069006300740075007200650073005c00540075006c006900700073002e006a007000670000000000	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = ab3b479e0f2ceeabce2f1efce01e187eaebb62a42176d14420dc4e0e3d9aeb61	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = eb8388a9dd20380bb8dce32bc120c0b57c2860c15c06f33f26d7b10777e91337	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Sequence = "1"	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = db90e918ac9b8a2eb215badd18d54e30ff4c7ff47aa814d4f0e7db72d6f5b3c9	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 74320764202bb1bdf7e345d498ee92d3cadaf29b8ac659e9fcc1bc25a7c5d580	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = c9fed7eb806cb1d1468d8f115f63c5776f58009c076daf40c6d737b5d49064e2	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = d891162626d83bde00a54f519b8a7af4d5ee17c9655b45eda6ec09ff6273cd81	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 9b024730b12957a65d0757b6891256fa15484491005ba71bc39a4142def0e776	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004400650073006b0074006f0070005c004200610063006b007500700043006f006e006e006500630074002e0070006300780000000000	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 16262190ccd9052f31d35a0928b31ec8b0a5054b82d7d15e17024f3fca61b1f1	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 3ecba859a0c8fe095c9eb2fb9bb214839a17fd3bcff5d55b34995428f7743144	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 638d8515d107856e4b6f5605e9220931467b3cbe5136ad7bf09cd0066b4c7315	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\nbp1aQ\windows.sys:dhpkxqkdun	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\hWs9P3\windows.sys:qvqhfjkvnrdtqgtt	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\nbp1aQ\windows.sys:dhpkxqkdun	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\MR8cZJ\windows.sys:qxoyhxveerelbnrwg	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Token: SeRestorePrivilege	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Token: SeDebugPrivilege	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Token: SeSecurityPrivilege	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Token: SeRestorePrivilege	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Token: SeDebugPrivilege	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
Token: SeBackupPrivilege	1968	vssvc.exe
Token: SeRestorePrivilege	1968	vssvc.exe
Token: SeAuditPrivilege	1968	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2756	WMIC.exe
Token: SeSecurityPrivilege	2756	WMIC.exe
Token: SeTakeOwnershipPrivilege	2756	WMIC.exe
Token: SeLoadDriverPrivilege	2756	WMIC.exe
Token: SeSystemProfilePrivilege	2756	WMIC.exe
Token: SeSystemtimePrivilege	2756	WMIC.exe
Token: SeProfSingleProcessPrivilege	2756	WMIC.exe
Token: SeIncBasePriorityPrivilege	2756	WMIC.exe
Token: SeCreatePagefilePrivilege	2756	WMIC.exe
Token: SeBackupPrivilege	2756	WMIC.exe
Token: SeRestorePrivilege	2756	WMIC.exe
Token: SeShutdownPrivilege	2756	WMIC.exe
Token: SeDebugPrivilege	2756	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2756	WMIC.exe
Token: SeRemoteShutdownPrivilege	2756	WMIC.exe
Token: SeUndockPrivilege	2756	WMIC.exe
Token: SeManageVolumePrivilege	2756	WMIC.exe
Token: 33	2756	WMIC.exe
Token: 34	2756	WMIC.exe
Token: 35	2756	WMIC.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2540	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	30
PID 1732 wrote to memory of 2540	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	30
PID 1732 wrote to memory of 2540	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	30
PID 1732 wrote to memory of 2540	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	30
PID 2540 wrote to memory of 2040	2540	cmd.exe	32
PID 2540 wrote to memory of 2040	2540	cmd.exe	32
PID 2540 wrote to memory of 2040	2540	cmd.exe	32
PID 2540 wrote to memory of 2040	2540	cmd.exe	32
PID 1732 wrote to memory of 2696	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	34
PID 1732 wrote to memory of 2696	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	34
PID 1732 wrote to memory of 2696	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	34
PID 1732 wrote to memory of 2696	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	34
PID 1732 wrote to memory of 2564	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	36
PID 1732 wrote to memory of 2564	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	36
PID 1732 wrote to memory of 2564	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	36
PID 1732 wrote to memory of 2564	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	36
PID 1732 wrote to memory of 2744	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	38
PID 1732 wrote to memory of 2744	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	38
PID 1732 wrote to memory of 2744	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	38
PID 1732 wrote to memory of 2744	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	38
PID 1732 wrote to memory of 2828	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	40
PID 1732 wrote to memory of 2828	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	40
PID 1732 wrote to memory of 2828	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	40
PID 1732 wrote to memory of 2828	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	40
PID 1732 wrote to memory of 2912	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	42
PID 1732 wrote to memory of 2912	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	42
PID 1732 wrote to memory of 2912	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	42
PID 1732 wrote to memory of 2912	1732	9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe	42
PID 2912 wrote to memory of 2756	2912	cmd.exe	44
PID 2912 wrote to memory of 2756	2912	cmd.exe	44
PID 2912 wrote to memory of 2756	2912	cmd.exe	44
PID 2912 wrote to memory of 2756	2912	cmd.exe	44

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9e5c89c84cdbf460fc6857c4e32dafdf_JaffaCakes118.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\cmd.exe
  cmd /C vssadmin Delete Shadows /All /Quiet
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin Delete Shadows /All /Quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:2040
- C:\Windows\SysWOW64\cmd.exe
  cmd /C bcdedit /set {default} recoveryenabled No
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2696
- C:\Windows\SysWOW64\cmd.exe
  cmd /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2564
- C:\Windows\SysWOW64\cmd.exe
  cmd /C wbadmin DELETE SYSTEMSTATEBACKUP
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2744
- C:\Windows\SysWOW64\cmd.exe
  cmd /C wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2828
- C:\Windows\SysWOW64\cmd.exe
  cmd /C wmic SHADOWCOPY /nointeractive
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic SHADOWCOPY /nointeractive
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2756

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\DECRYPT-SEJClZ-decrypt.hta

Filesize
6KB

MD5
c808f71665399239e348cabc85c0e8d9

SHA1
9917eafda63c416f00f95bc681f39de00db25256

SHA256
bbcd37e8e059f37642182c415bda686e3c709298735fe9185643132809a28835

SHA512
3f8f3d448f1297020edea0507d3ac186c30f618a002299fabf53c486a9d3b68a06029933c19c120a50aa4b1cb7ff627c89a93f611bb2341f53a840354dc57485

Download Submit
F:\$RECYCLE.BIN\S-1-5-18\desktop.ini

Filesize
129B

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit