Analysis Overview
SHA256
63ba6db8c81c60dd9f1a0c7c4a4c51e2e56883f063509ed7b543ad7651fd8806
Threat Level: Known bad
The file c171bcd34151cbcd48edbce13796e0ed_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
SunCrypt Ransomware
Blocklisted process makes network request
Drops startup file
Drops desktop.ini file(s)
Enumerates connected drives
Command and Scripting Interpreter: PowerShell
System Location Discovery: System Language Discovery
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-25 19:45
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-25 19:45
Reported
2024-08-25 19:48
Platform
win7-20240708-en
Max time kernel
121s
Max time network
126s
Command Line
Signatures
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\YOUR_FILES_ARE_ENCRYPTED.HTML | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Drops desktop.ini file(s)
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\Pictures\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Saved Games\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Public\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Public\Music\Sample Music\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Public\Videos\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Favorites\Links\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Links\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Public\Recorded TV\Sample Media\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MN6S8FGK\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Contacts\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Public\Recorded TV\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\N7ZQRMOO\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Videos\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Downloads\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Favorites\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Public\Desktop\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Public\Downloads\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Music\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Public\Libraries\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Public\Pictures\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\C906A748\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZO1X14N3\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Documents\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Favorites\Links for United States\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Public\Videos\Sample Videos\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Desktop\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Searches\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Public\Documents\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Public\Music\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Public\Pictures\Sample Pictures\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Enumerates connected drives
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeAuditPrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Processes
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\c171bcd34151cbcd48edbce13796e0ed_JaffaCakes118.ps1
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\9twidpjl.cmdline"
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF02A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF029.tmp"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -file "C:\Users\Admin\AppData\Local\Temp\c171bcd34151cbcd48edbce13796e0ed_JaffaCakes118.ps1"
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r9mvnrci.cmdline"
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF603.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF602.tmp"
C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
Network
| Country | Destination | Domain | Proto |
| RU | 91.218.114.30:80 | tcp | |
| RU | 91.218.114.30:80 | tcp |
Files
memory/2808-4-0x000007FEF5ABE000-0x000007FEF5ABF000-memory.dmp
memory/2808-5-0x000000001B6C0000-0x000000001B9A2000-memory.dmp
memory/2808-6-0x0000000001E80000-0x0000000001E88000-memory.dmp
memory/2808-7-0x000007FEF5800000-0x000007FEF619D000-memory.dmp
memory/2808-8-0x000007FEF5800000-0x000007FEF619D000-memory.dmp
memory/2808-9-0x000007FEF5800000-0x000007FEF619D000-memory.dmp
memory/2808-10-0x000007FEF5800000-0x000007FEF619D000-memory.dmp
\??\c:\Users\Admin\AppData\Local\Temp\9twidpjl.cmdline
| MD5 | 9f5b42e6bf7e2a7a5e9dbf51003aac5a |
| SHA1 | cdf894d6db0b10555cbe2726307dcd494fe20f92 |
| SHA256 | 81dff002c067625c8aa80936a3684658b1e4e499a304a452868e700ea92f0fd7 |
| SHA512 | 5558635dc466864306aadad02ed23a489ea3a54a8e3253b704f283b0ead1bd150fc427862fec63ca0642d2d4415718a930d054f18917182717291be9fbd52058 |
\??\c:\Users\Admin\AppData\Local\Temp\9twidpjl.0.cs
| MD5 | caf98c9f9cc2c02cdc79eb3409a36bc5 |
| SHA1 | aae6131763eaace982ee93fb15ee0eff45a034d2 |
| SHA256 | dc072944363d6db027de28c9412f96e4655e460989789c99e3a1992daded7499 |
| SHA512 | 74845d305b1de1a0decaca325bc98de0cebaee677b6a70d492a0ba3ade21e9f9f0e145687a1f6ff89ada6657f77c47a8f140bf1d610c661738a2c64ada3a132f |
memory/3020-19-0x000007FEF5800000-0x000007FEF619D000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\RESF02A.tmp
| MD5 | a8e9ff88281daab74509deba3abf3525 |
| SHA1 | 23951689e0a64979cb01aebc4e95e6c7567c5cf8 |
| SHA256 | 2e1d32b76f9667490a3cc52da4c2b1bbe2fe4ca7c44f453e86fecfe255760d3f |
| SHA512 | c7d105f630273413c727312bbba266ca18a617c0f1a3ac60210549fea27c7126d501a3db78120c6b91d1350bda87af5c9d93db78b854f271a6038c10bcdb7be2 |
\??\c:\Users\Admin\AppData\Local\Temp\CSCF029.tmp
| MD5 | f0cb4170aa230fcc6787f104b3489f44 |
| SHA1 | 2e5023621562a7d0dab27016e02e4bc0a29298b0 |
| SHA256 | 8df4b46a01402521473b9d5010e3c934ca15f961c62d3e1d8a5c878dfc49245c |
| SHA512 | 79b45c2c050b0013bf097ec3b1323e795c26d175c45f61d46029892cff17045d7696574ba4f397cdc9d45b6a5d5f7c7168c5a27718c3f23720afbbc9f52c5be2 |
memory/2808-26-0x0000000002A00000-0x0000000002A08000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\9twidpjl.pdb
| MD5 | 23336d894bb3d56a1bed5a8a472b438e |
| SHA1 | 097f13f0401b9de1bea7305f3e4d2b4db36eaefa |
| SHA256 | f40acc652f11af1916c7112076c06cbdebc022920f857fece508efe02acb59dc |
| SHA512 | 10480e4a8f351a77d2e7f80ffdeebdc83570d75e8311f4f33cf29d53ca49973fd11fdbd52a4c2709582214896b43674cb0f982c71cf8b0aad4e1a5d8f44c562c |
C:\Users\Admin\AppData\Local\Temp\9twidpjl.dll
| MD5 | fc3c5a6c3f83b52e3f8378acff24f0b6 |
| SHA1 | b510f0f1929ab8c8010f4c0393081515729b7912 |
| SHA256 | 0812f8dc81d142d5e114ab4de98e43a05e3a3cb15d77a4bfc3416d01bd40e978 |
| SHA512 | 0d32883b07a1217cb3fa5c92bb8270bea4c9516fabd02c7bc6788e15830eb9d8e23febad0891657e28872694ef55f75c8a3521a3be4e2bf528033d4c46d39611 |
memory/3020-24-0x000007FEF5800000-0x000007FEF619D000-memory.dmp
memory/2808-29-0x000007FEF5800000-0x000007FEF619D000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0Q7OXTPJY2KH2MF061BN.temp
| MD5 | f2e6f740f9140bdd6aa3eba14b4f9468 |
| SHA1 | 764fc09d735b6b526bae0f933bb50084fddb2d5f |
| SHA256 | a379342e5957438b10523583a833461bff6a96c7bbbfc3cac3d4e2b0efcd0e99 |
| SHA512 | 34a7eff0432e537f92b1ccdecfb878236a3d477935ff44839728373ea8e853962f5bdd0daefcdc7166882e27383125e9b8a3e0caf6aa40a243230fa7716c214c |
\??\c:\Users\Admin\AppData\Local\Temp\r9mvnrci.cmdline
| MD5 | 82744ec330e6986a3879e36a85b9f8ba |
| SHA1 | 76b731cf38acff926af22f1662c6d0b3c3ed45cf |
| SHA256 | 59e6008b1805b10531fae28c51d6d7c9e4ff0746666220a13c7b038571790d06 |
| SHA512 | 3da3eb869968ab34bc15a0c20d535cc2b59750ca2bd3e77c53146e6db19e41368871c7aa45ea58774b1b506b399ae73e3172fe1ce7925153c23b8a38cbc051cb |
C:\Users\Admin\AppData\Local\Temp\r9mvnrci.pdb
| MD5 | 61110c09fa5a42c648d5b094fcf8ac11 |
| SHA1 | 829898621cb0ff1564119ea9debd7c1afd1e2841 |
| SHA256 | a01bceb607cc388c54d6bba3b6461d615fd113b3a15ebe8bbfdabfc3c20e1a6e |
| SHA512 | e57eb3ad14532530f88892519c0f5f18f2432dcb927666fd5639a053b1d34cae4e953e854474eee93a1929626f56b7b96754b48593ce02261eebb13df7debd39 |
C:\Users\Admin\AppData\Local\Temp\r9mvnrci.dll
| MD5 | 76a0066ba8b3db90e3622ca883f7cac8 |
| SHA1 | 8be25a5c314333be2f341160f8a18ced1afd2c11 |
| SHA256 | 2888a15ea4d368be21d1283ac6f7d0909d9c1cdc78dcf627798e5a3828049071 |
| SHA512 | b3e8cf9fedc952124cc30a672bd0081fdf78e4f8f9181090fbe6bd2c1f9f8d28c891aaa6d48855781563f18fe50b22eb47485c7158a5607a797876e577a8bd66 |
C:\Users\Admin\AppData\Local\Temp\RESF603.tmp
| MD5 | c8f2bf02b4520d8ba83907eb1a5bc0da |
| SHA1 | 620070f9ae931f80c53c2069255d112f2d8dae53 |
| SHA256 | 1375f2225074e8f805bb49538d3ba3cd3414cc4a201cddd20ca80fa6d7757594 |
| SHA512 | 47d04e9a0f23e28d90723455845f0942a141efaf1af5b7746c4254afb9a46b55dc97250ba321cbf30dd389c07137e41d6cbafde1ad984f5ac0e7dbed4e7698d4 |
\??\c:\Users\Admin\AppData\Local\Temp\CSCF602.tmp
| MD5 | fa439550e147698fbaf4d5578ab37b90 |
| SHA1 | 487bddf1b4c3139a3d533547e02831bab6b242ff |
| SHA256 | 3d74887f65630adc0b537bd80b6ca4d3699a64fb5b7f77b6619417c82f2b8d63 |
| SHA512 | 9ae919c11fec5a116a71553d3dc7c026cfc4bfa7951c4db6c29f9e31b887625f22469ba954bd70bbe3e0356373bd1a35f359d896a44d3d324cc7fdc1f0a2e90d |
memory/2788-47-0x00000000028A0000-0x00000000028CE000-memory.dmp
memory/2788-48-0x00000000028A0000-0x00000000028CE000-memory.dmp
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\YOUR_FILES_ARE_ENCRYPTED.HTML
| MD5 | 0194a99090f18b0bdd758a3176f53d46 |
| SHA1 | 482a6399a8fd3e2402fed108a351f308be68847b |
| SHA256 | 43997f9e6d4f10288ee0272bae74eb43ef71742b860bb1c1618d7fd09d0b26a3 |
| SHA512 | 754e49ac30976d88876edbbb433979d8c291503ba9bacd1ff0cde889a9526eda316e9d3820b4e163f55b63e4965bd0070f9b84c5a3fa07c2320667d40153ab60 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-08-25 19:45
Reported
2024-08-25 19:48
Platform
win10v2004-20240802-en
Max time kernel
96s
Max time network
141s
Command Line
Signatures
SunCrypt Ransomware
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\YOUR_FILES_ARE_ENCRYPTED.HTML | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Drops desktop.ini file(s)
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Public\Downloads\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Public\Pictures\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Music\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Public\AccountPictures\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Videos\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Public\Documents\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Public\Videos\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\3D Objects\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Pictures\Saved Pictures\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Public\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Public\Libraries\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Downloads\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Pictures\Camera Roll\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Public\Desktop\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Desktop\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Favorites\Links\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Links\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Pictures\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Public\Music\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Contacts\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Documents\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Saved Games\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Favorites\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\OneDrive\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\Searches\desktop.ini | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Enumerates connected drives
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeAuditPrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Processes
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\c171bcd34151cbcd48edbce13796e0ed_JaffaCakes118.ps1
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v5ce4nke\v5ce4nke.cmdline"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC2D3.tmp" "c:\Users\Admin\AppData\Local\Temp\v5ce4nke\CSCD47D0E97AE694601AF9668CDE0ADDFDF.TMP"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -file "C:\Users\Admin\AppData\Local\Temp\c171bcd34151cbcd48edbce13796e0ed_JaffaCakes118.ps1"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xukq50uf\xukq50uf.cmdline"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD1E6.tmp" "c:\Users\Admin\AppData\Local\Temp\xukq50uf\CSCE7A642356BDA4343B891C9AF9905057.TMP"
C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 150.171.28.10:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 138.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.28.171.150.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| RU | 91.218.114.30:80 | tcp | |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| US | 52.111.227.13:443 | tcp | |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
Files
memory/216-1-0x00007FFE8CBA0000-0x00007FFE8CE69000-memory.dmp
memory/216-0-0x00007FFE8CBA0000-0x00007FFE8CE69000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fdvananl.20m.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/216-11-0x00000244678B0000-0x00000244678D2000-memory.dmp
\??\c:\Users\Admin\AppData\Local\Temp\v5ce4nke\v5ce4nke.0.cs
| MD5 | caf98c9f9cc2c02cdc79eb3409a36bc5 |
| SHA1 | aae6131763eaace982ee93fb15ee0eff45a034d2 |
| SHA256 | dc072944363d6db027de28c9412f96e4655e460989789c99e3a1992daded7499 |
| SHA512 | 74845d305b1de1a0decaca325bc98de0cebaee677b6a70d492a0ba3ade21e9f9f0e145687a1f6ff89ada6657f77c47a8f140bf1d610c661738a2c64ada3a132f |
\??\c:\Users\Admin\AppData\Local\Temp\v5ce4nke\v5ce4nke.cmdline
| MD5 | 62b294053216e282db2e368fdd12c83f |
| SHA1 | 8424c423642982d2d21f1d24e1c4a5cd1a97210d |
| SHA256 | fec856365bc822072b7a32a0a7786bac3ec60417c99fe78af701f7f377f6542f |
| SHA512 | b3a9b209892cb4889980609e47c369bcfe588d79ca488c8acbc0290342b146927169444ca4b6ba0c0b24d4d3489ba911e1557725b660cc0ee322638e1d1c8d52 |
\??\c:\Users\Admin\AppData\Local\Temp\v5ce4nke\CSCD47D0E97AE694601AF9668CDE0ADDFDF.TMP
| MD5 | 4d74eda8cdac3a75bd7f2a6e4025ffde |
| SHA1 | 74d2aba32cc311df9bce261863f3ec475bcd74bc |
| SHA256 | 0f086d81d2e753dac4eb03748b7a02bd588929fb7e2010d5352efc1337173cbc |
| SHA512 | 8b4faac08214896b32edc38517fb32af158c4406f9b8b749ebb24347c16743f5a2f557ef26ac4883455a9d3c89d0fd54ec6648d6b61760a8e120d1ee2fa3771c |
C:\Users\Admin\AppData\Local\Temp\RESC2D3.tmp
| MD5 | 3c88b2cbb0a67a94329ff961b02e8ba9 |
| SHA1 | 2b6d9b9972fff368d48cb332fd9c5732c27cf795 |
| SHA256 | dd5969e1eaa8554605de3fafac6f1a3ccd5979ee69a1c32996694e061f1184e9 |
| SHA512 | a1f0ea01a5e2bdbc5c188ab2fc7dad0582033709b01d78fe7849df46f223dd408bb3e8e0259b066ec2b99ed7504a3373855630933903949263c25ae10fdd9297 |
C:\Users\Admin\AppData\Local\Temp\v5ce4nke\v5ce4nke.dll
| MD5 | 76b5524178c57ea5d45263f4e10d8550 |
| SHA1 | 82f2efebb3ac36cec74464436277f565cba755fb |
| SHA256 | 1701c4fa09e2d643e3c39e41bc1f6236f5a06d09941b714858fff658ec635835 |
| SHA512 | c842fe22d47b68790ddef2f65cdea71161d86e8d125d85a0403ceff30d31260a400402da27da611dde84f4e68f10ab6aa921b373c69f9975f849019a25f79500 |
memory/216-24-0x00000244678A0000-0x00000244678A8000-memory.dmp
memory/216-26-0x00007FFE8CBA0000-0x00007FFE8CE69000-memory.dmp
memory/216-29-0x00007FFE8CBA0000-0x00007FFE8CE69000-memory.dmp
memory/3016-32-0x0000000004B30000-0x0000000004B66000-memory.dmp
memory/3016-33-0x00000000051A0000-0x00000000057C8000-memory.dmp
memory/3016-34-0x00000000050C0000-0x00000000050E2000-memory.dmp
memory/3016-35-0x00000000058C0000-0x0000000005926000-memory.dmp
memory/3016-36-0x0000000005930000-0x0000000005996000-memory.dmp
memory/3016-46-0x00000000059A0000-0x0000000005CF4000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 2e4a3180819763d43e6a3e39adbab718 |
| SHA1 | 2cec2b94108074bcf7599d6fab7133b2e11f7e52 |
| SHA256 | c6ddcdc2ff8910fc6dfc6bb2ae667ab9f27ef885a1e6ae9b9bef60f485d091a2 |
| SHA512 | d62867351af1ba3076dbc1c99d610f034cc2ec9e4a0bdd27638640793a6b450321f17ca7c6147548fa341c52469a66345827afb1f0282f2f0b0304a7fa82e4cd |
memory/3016-48-0x0000000005F60000-0x0000000005F7E000-memory.dmp
memory/3016-49-0x0000000005FA0000-0x0000000005FEC000-memory.dmp
memory/3016-50-0x00000000085F0000-0x0000000008C6A000-memory.dmp
memory/3016-51-0x00000000064C0000-0x00000000064DA000-memory.dmp
\??\c:\Users\Admin\AppData\Local\Temp\xukq50uf\xukq50uf.cmdline
| MD5 | 835f838faa454ceb76b42430c4c3072a |
| SHA1 | 9b02e89f46958125603fed1a6a441e4f0e6e95ca |
| SHA256 | 2fd8de591c0fa2087cd65a01e62e81461406ad57a5573fd28914915b7ebe25b0 |
| SHA512 | c0500658224d5ce50bfe5b81101c874e7011370efcf816fea7faf4f413f298c5d0fac477d485e17edf3eda3516852d8a334f9d6b92a32f52cc4d8adb6d6a1a9d |
\??\c:\Users\Admin\AppData\Local\Temp\xukq50uf\CSCE7A642356BDA4343B891C9AF9905057.TMP
| MD5 | bf209955c6cc210f40af1b5fba3d2db6 |
| SHA1 | 836f032d9132bf2e74e62c53c14c19b14711a225 |
| SHA256 | 3b95b978013fc5935a0f2cca1330b1d7e737061a845e0a387a453b710e386b42 |
| SHA512 | 7087b32001c859ed26b0909339f85e14971177ef27fd9d9d02abe3791ffeb5fcd2fa8860cc16b87c2c8bc8ebc597a49c8e618b486ce678302e85c1d78b53d725 |
C:\Users\Admin\AppData\Local\Temp\RESD1E6.tmp
| MD5 | 5fc7cad3afb9ccf0e0a33f98ad6f3d00 |
| SHA1 | d09b7dcb828b83db2af32db9ae7d2d72dcdd976a |
| SHA256 | fc4052cbe785da0c13147e44c9751d850f079fee08e09312a68a7f716ccca7d8 |
| SHA512 | c6c29d2863badb296ce2f3cf665092e47236b6bf9b0a10d2da16adacc51edfdadf2693cea1836a49c0e996c53f5a2f633e0cbb8d6fc0af516bf819e62b39b20c |
C:\Users\Admin\AppData\Local\Temp\xukq50uf\xukq50uf.dll
| MD5 | a6f9deb734da0b394f1abbe3b0cd33f7 |
| SHA1 | 29d1c9e6c009f9e375a2f9febbfa011c1bdec511 |
| SHA256 | 4078c993ebd91e481c22a22bfe9fe8d38926cb46f74e671575a1f7748871eb1e |
| SHA512 | a5d81cb8b11e18d1988c7a69084eb3e8c9d2040d7221da83b6d005bf6fde1778c9751ca94d9e9ea0856ade06bcd65f2cf39dd29a6453774460656cfe7715220c |
memory/3016-64-0x0000000006540000-0x0000000006548000-memory.dmp
memory/3016-66-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3016-68-0x0000000000400000-0x000000000042E000-memory.dmp
C:\ProgramData\Microsoft\AppV\Setup\YOUR_FILES_ARE_ENCRYPTED.HTML
| MD5 | 0194a99090f18b0bdd758a3176f53d46 |
| SHA1 | 482a6399a8fd3e2402fed108a351f308be68847b |
| SHA256 | 43997f9e6d4f10288ee0272bae74eb43ef71742b860bb1c1618d7fd09d0b26a3 |
| SHA512 | 754e49ac30976d88876edbbb433979d8c291503ba9bacd1ff0cde889a9526eda316e9d3820b4e163f55b63e4965bd0070f9b84c5a3fa07c2320667d40153ab60 |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | 49e7d5f2a296b59afec08bc314bed998 |
| SHA1 | 7f898bf195ffd46ce2d19fad0ce33155f6e47f5f |
| SHA256 | 394832dfefa5e2e6204b60708a2ca33bb9d2f529664419bc050975f4b80faefe |
| SHA512 | f64579fdac0bfebad4c20ad575b8ea45136e295fba950da4cbf84402228a3897b2e2deb4eb4605deb5df93321b1dc15c8a878da36016d7e5e060182142fdf839 |