Analysis
-
max time kernel
96s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25-08-2024 19:45
Static task
static1
Behavioral task
behavioral1
Sample
c171bcd34151cbcd48edbce13796e0ed_JaffaCakes118.ps1
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c171bcd34151cbcd48edbce13796e0ed_JaffaCakes118.ps1
Resource
win10v2004-20240802-en
General
-
Target
c171bcd34151cbcd48edbce13796e0ed_JaffaCakes118.ps1
-
Size
1.6MB
-
MD5
c171bcd34151cbcd48edbce13796e0ed
-
SHA1
2770fec86275dfb1a4a05e2d56bc27a089197666
-
SHA256
63ba6db8c81c60dd9f1a0c7c4a4c51e2e56883f063509ed7b543ad7651fd8806
-
SHA512
d25cbb70dae9bcc49d32c15300734879fe4c1b7ae35cb5affab50e8a61ae7226832b278d846f76f7eedc3a1baf35e2aec4e8c364eab99cddb00c2ffeb97283da
-
SSDEEP
12288:mCPioPTJd1WR3keV2Y/eHKaetuMUDfyTEHG+oIr7zOHSh3qruJJvbW:mxYTJw3keV2Y/xSMWPpoI7vh3qV
Malware Config
Extracted
C:\ProgramData\Microsoft\AppV\Setup\YOUR_FILES_ARE_ENCRYPTED.HTML
Signatures
-
SunCrypt Ransomware
Family which threatens to leak data alongside encrypting files. Has claimed to be collaborating with the Maze ransomware group.
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 32 3016 powershell.exe -
Drops startup file 1 IoCs
Processes:
powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\YOUR_FILES_ARE_ENCRYPTED.HTML powershell.exe -
Drops desktop.ini file(s) 28 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Users\Public\Downloads\desktop.ini powershell.exe File opened for modification C:\Users\Public\Pictures\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Music\desktop.ini powershell.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini powershell.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Videos\desktop.ini powershell.exe File opened for modification C:\Users\Public\Documents\desktop.ini powershell.exe File opened for modification C:\Users\Public\Videos\desktop.ini powershell.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini powershell.exe File opened for modification C:\Users\Public\desktop.ini powershell.exe File opened for modification C:\Users\Public\Libraries\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini powershell.exe File opened for modification C:\Users\Public\Desktop\desktop.ini powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Links\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini powershell.exe File opened for modification C:\Users\Public\Music\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Documents\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini powershell.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Searches\desktop.ini powershell.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
powershell.exedescription ioc process File opened (read-only) \??\A: powershell.exe File opened (read-only) \??\G: powershell.exe File opened (read-only) \??\H: powershell.exe File opened (read-only) \??\J: powershell.exe File opened (read-only) \??\E: powershell.exe File opened (read-only) \??\T: powershell.exe File opened (read-only) \??\Y: powershell.exe File opened (read-only) \??\I: powershell.exe File opened (read-only) \??\N: powershell.exe File opened (read-only) \??\Z: powershell.exe File opened (read-only) \??\V: powershell.exe File opened (read-only) \??\P: powershell.exe File opened (read-only) \??\S: powershell.exe File opened (read-only) \??\K: powershell.exe File opened (read-only) \??\L: powershell.exe File opened (read-only) \??\X: powershell.exe File opened (read-only) \??\B: powershell.exe File opened (read-only) \??\M: powershell.exe File opened (read-only) \??\W: powershell.exe File opened (read-only) \??\R: powershell.exe File opened (read-only) \??\U: powershell.exe File opened (read-only) \??\O: powershell.exe File opened (read-only) \??\Q: powershell.exe -
Processes:
powershell.exepowershell.exepid process 216 powershell.exe 3016 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
powershell.execsc.execvtres.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exepid process 216 powershell.exe 216 powershell.exe 216 powershell.exe 3016 powershell.exe 3016 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
powershell.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 216 powershell.exe Token: SeDebugPrivilege 3016 powershell.exe Token: SeBackupPrivilege 4356 vssvc.exe Token: SeRestorePrivilege 4356 vssvc.exe Token: SeAuditPrivilege 4356 vssvc.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
powershell.execsc.exepowershell.execsc.exedescription pid process target process PID 216 wrote to memory of 1360 216 powershell.exe csc.exe PID 216 wrote to memory of 1360 216 powershell.exe csc.exe PID 1360 wrote to memory of 1236 1360 csc.exe cvtres.exe PID 1360 wrote to memory of 1236 1360 csc.exe cvtres.exe PID 216 wrote to memory of 3016 216 powershell.exe powershell.exe PID 216 wrote to memory of 3016 216 powershell.exe powershell.exe PID 216 wrote to memory of 3016 216 powershell.exe powershell.exe PID 3016 wrote to memory of 2012 3016 powershell.exe csc.exe PID 3016 wrote to memory of 2012 3016 powershell.exe csc.exe PID 3016 wrote to memory of 2012 3016 powershell.exe csc.exe PID 2012 wrote to memory of 2044 2012 csc.exe cvtres.exe PID 2012 wrote to memory of 2044 2012 csc.exe cvtres.exe PID 2012 wrote to memory of 2044 2012 csc.exe cvtres.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\c171bcd34151cbcd48edbce13796e0ed_JaffaCakes118.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v5ce4nke\v5ce4nke.cmdline"2⤵
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC2D3.tmp" "c:\Users\Admin\AppData\Local\Temp\v5ce4nke\CSCD47D0E97AE694601AF9668CDE0ADDFDF.TMP"3⤵PID:1236
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -file "C:\Users\Admin\AppData\Local\Temp\c171bcd34151cbcd48edbce13796e0ed_JaffaCakes118.ps1"2⤵
- Blocklisted process makes network request
- Drops startup file
- Drops desktop.ini file(s)
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xukq50uf\xukq50uf.cmdline"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD1E6.tmp" "c:\Users\Admin\AppData\Local\Temp\xukq50uf\CSCE7A642356BDA4343B891C9AF9905057.TMP"4⤵
- System Location Discovery: System Language Discovery
PID:2044
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4356
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD50194a99090f18b0bdd758a3176f53d46
SHA1482a6399a8fd3e2402fed108a351f308be68847b
SHA25643997f9e6d4f10288ee0272bae74eb43ef71742b860bb1c1618d7fd09d0b26a3
SHA512754e49ac30976d88876edbbb433979d8c291503ba9bacd1ff0cde889a9526eda316e9d3820b4e163f55b63e4965bd0070f9b84c5a3fa07c2320667d40153ab60
-
Filesize
2KB
MD549e7d5f2a296b59afec08bc314bed998
SHA17f898bf195ffd46ce2d19fad0ce33155f6e47f5f
SHA256394832dfefa5e2e6204b60708a2ca33bb9d2f529664419bc050975f4b80faefe
SHA512f64579fdac0bfebad4c20ad575b8ea45136e295fba950da4cbf84402228a3897b2e2deb4eb4605deb5df93321b1dc15c8a878da36016d7e5e060182142fdf839
-
Filesize
1KB
MD52e4a3180819763d43e6a3e39adbab718
SHA12cec2b94108074bcf7599d6fab7133b2e11f7e52
SHA256c6ddcdc2ff8910fc6dfc6bb2ae667ab9f27ef885a1e6ae9b9bef60f485d091a2
SHA512d62867351af1ba3076dbc1c99d610f034cc2ec9e4a0bdd27638640793a6b450321f17ca7c6147548fa341c52469a66345827afb1f0282f2f0b0304a7fa82e4cd
-
Filesize
1KB
MD53c88b2cbb0a67a94329ff961b02e8ba9
SHA12b6d9b9972fff368d48cb332fd9c5732c27cf795
SHA256dd5969e1eaa8554605de3fafac6f1a3ccd5979ee69a1c32996694e061f1184e9
SHA512a1f0ea01a5e2bdbc5c188ab2fc7dad0582033709b01d78fe7849df46f223dd408bb3e8e0259b066ec2b99ed7504a3373855630933903949263c25ae10fdd9297
-
Filesize
1KB
MD55fc7cad3afb9ccf0e0a33f98ad6f3d00
SHA1d09b7dcb828b83db2af32db9ae7d2d72dcdd976a
SHA256fc4052cbe785da0c13147e44c9751d850f079fee08e09312a68a7f716ccca7d8
SHA512c6c29d2863badb296ce2f3cf665092e47236b6bf9b0a10d2da16adacc51edfdadf2693cea1836a49c0e996c53f5a2f633e0cbb8d6fc0af516bf819e62b39b20c
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3KB
MD576b5524178c57ea5d45263f4e10d8550
SHA182f2efebb3ac36cec74464436277f565cba755fb
SHA2561701c4fa09e2d643e3c39e41bc1f6236f5a06d09941b714858fff658ec635835
SHA512c842fe22d47b68790ddef2f65cdea71161d86e8d125d85a0403ceff30d31260a400402da27da611dde84f4e68f10ab6aa921b373c69f9975f849019a25f79500
-
Filesize
3KB
MD5a6f9deb734da0b394f1abbe3b0cd33f7
SHA129d1c9e6c009f9e375a2f9febbfa011c1bdec511
SHA2564078c993ebd91e481c22a22bfe9fe8d38926cb46f74e671575a1f7748871eb1e
SHA512a5d81cb8b11e18d1988c7a69084eb3e8c9d2040d7221da83b6d005bf6fde1778c9751ca94d9e9ea0856ade06bcd65f2cf39dd29a6453774460656cfe7715220c
-
Filesize
652B
MD54d74eda8cdac3a75bd7f2a6e4025ffde
SHA174d2aba32cc311df9bce261863f3ec475bcd74bc
SHA2560f086d81d2e753dac4eb03748b7a02bd588929fb7e2010d5352efc1337173cbc
SHA5128b4faac08214896b32edc38517fb32af158c4406f9b8b749ebb24347c16743f5a2f557ef26ac4883455a9d3c89d0fd54ec6648d6b61760a8e120d1ee2fa3771c
-
Filesize
468B
MD5caf98c9f9cc2c02cdc79eb3409a36bc5
SHA1aae6131763eaace982ee93fb15ee0eff45a034d2
SHA256dc072944363d6db027de28c9412f96e4655e460989789c99e3a1992daded7499
SHA51274845d305b1de1a0decaca325bc98de0cebaee677b6a70d492a0ba3ade21e9f9f0e145687a1f6ff89ada6657f77c47a8f140bf1d610c661738a2c64ada3a132f
-
Filesize
369B
MD562b294053216e282db2e368fdd12c83f
SHA18424c423642982d2d21f1d24e1c4a5cd1a97210d
SHA256fec856365bc822072b7a32a0a7786bac3ec60417c99fe78af701f7f377f6542f
SHA512b3a9b209892cb4889980609e47c369bcfe588d79ca488c8acbc0290342b146927169444ca4b6ba0c0b24d4d3489ba911e1557725b660cc0ee322638e1d1c8d52
-
Filesize
652B
MD5bf209955c6cc210f40af1b5fba3d2db6
SHA1836f032d9132bf2e74e62c53c14c19b14711a225
SHA2563b95b978013fc5935a0f2cca1330b1d7e737061a845e0a387a453b710e386b42
SHA5127087b32001c859ed26b0909339f85e14971177ef27fd9d9d02abe3791ffeb5fcd2fa8860cc16b87c2c8bc8ebc597a49c8e618b486ce678302e85c1d78b53d725
-
Filesize
369B
MD5835f838faa454ceb76b42430c4c3072a
SHA19b02e89f46958125603fed1a6a441e4f0e6e95ca
SHA2562fd8de591c0fa2087cd65a01e62e81461406ad57a5573fd28914915b7ebe25b0
SHA512c0500658224d5ce50bfe5b81101c874e7011370efcf816fea7faf4f413f298c5d0fac477d485e17edf3eda3516852d8a334f9d6b92a32f52cc4d8adb6d6a1a9d