Analysis
-
max time kernel
132s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
27-08-2024 20:53
General
-
Target
c5b93ade217bd9a818c90976e3acc87b_JaffaCakes118.exe
-
Size
286KB
-
MD5
c5b93ade217bd9a818c90976e3acc87b
-
SHA1
f1dd3f84c3b8f0782367ce8a38dc1da0aab64854
-
SHA256
3a2bb3e07800debe1877d52353ed905524625dd4fd40bb375ddce9e9cc7d2a7f
-
SHA512
4e3213abaab8b1495f78b55a90882c12c70da2cd686683800bfd211e472a4a7126d2366624cc85177638e9670ce8ea1e9cb13d493ed8b9bdf6dc04e0dc90713c
-
SSDEEP
3072:lhdf2HTrKylxOq/UlIbEEphx7+CWM/Ns7a9x4s:LUzuylsHlVEnJ+8ZZ
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.xmfhr6.win/AE41-AC06-3AF3-0063-7414
http://cerberhhyed5frqa.cmfhty.win/AE41-AC06-3AF3-0063-7414
http://cerberhhyed5frqa.dk59jg.win/AE41-AC06-3AF3-0063-7414
http://cerberhhyed5frqa.xmfu59.win/AE41-AC06-3AF3-0063-7414
http://cerberhhyed5frqa.er48rt.win/AE41-AC06-3AF3-0063-7414
http://cerberhhyed5frqa.onion/AE41-AC06-3AF3-0063-7414
Extracted
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16390) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 2 IoCs
-
Modifies Control Panel 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 61 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of AdjustPrivilegeToken 51 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5b93ade217bd9a818c90976e3acc87b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c5b93ade217bd9a818c90976e3acc87b_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{7950FA1F-A216-74FE-80F8-918F1AE2C65E}\xwizard.exe"C:\Users\Admin\AppData\Roaming\{7950FA1F-A216-74FE-80F8-918F1AE2C65E}\xwizard.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:275457 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:406530 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "xwizard.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{7950FA1F-A216-74FE-80F8-918F1AE2C65E}\xwizard.exe" > NUL3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "xwizard.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "c5b93ade217bd9a818c90976e3acc87b_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\c5b93ade217bd9a818c90976e3acc87b_JaffaCakes118.exe" > NUL2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "c5b93ade217bd9a818c90976e3acc87b_JaffaCakes118.exe"3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:212 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4a81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD54078f60651b3a32c8f829caea62c2903
SHA19a47b68f646f90061b15e075091bb36fcc37ff65
SHA2561d404d616f1421c484913b147aad3f57be7ba439a7d35acf5f827cb771fad957
SHA5128435253f96aaa546e7c5e0fea9909d9d69b6b679791131b86866f0ddb6cf218bc1e50cb9c1d39f264c13ed5a8fa39b4f93725731d8f8b96ba217d3db2941b1ef
-
Filesize
10KB
MD5296bbb14778f597f8785cf07c9934d39
SHA1fca702418006f622e9908f27fd84c01f65c9b6e5
SHA2561cfc723288c793fbaa9071bf4cb31f7fdf8e6aa52b03f2bf7d1f5858487f6dbf
SHA51232c396854065199874952c931b81972f0d80333ddba46dc4d2a37982263a796cb9e69dc7ed56f41ec5210a224f9bc3d913fad0fa42a7ca9aa3d06bd140d8c5c4
-
Filesize
85B
MD5ade4ba8977217d03e5044a837380b284
SHA1202de9a302a3b6036be3a925cfa1ee8549f04aed
SHA256e32e4d075fc7f88317ca10b55f91a6d675686d0aebe8e3b578e55557fa20beae
SHA512c0de0c39e1998f0f209cae3e7a596e08d633ceb4d022f1e54c2ccc88df1498a0aefe9569f8a862db076995d1b30dad9fe3034069b03741ec6746b451e3450adf
-
Filesize
219B
MD535a3e3b45dcfc1e6c4fd4a160873a0d1
SHA1a0bcc855f2b75d82cbaae3a8710f816956e94b37
SHA2568ad5e0f423ce1ff13f45a79746813f0f1d56993d7f125ab96f3d93fb54bdc934
SHA5126d8e68b969ef67903aff526e983b0fb496678e4c819139e560a11f754a36c4b5770ac2ecf3fc1d9cb5aaa84f80363b4f55553255569503893192911b80d9d853
-
Filesize
342B
MD5d578ddbf70af2ad5c81a53a2f204c80b
SHA1bc89c51e2223b811513296473b71bc716e9c3059
SHA25672c305af655bea9346d693a486f4a87376a5461df3c76caa5d6e38ff2d0e79a7
SHA51291bb213568b83ebf60c84dc75408929935028a5be8040f85032efd5b84462a9a98d0527bc96a43507715210cbf0949be05cb020277cc1a20804c2b30849fdbd8
-
Filesize
342B
MD55a964e950d50c64d45b641e06e0e40de
SHA11f41a9cf692c65d7fc6c9c96eb56e4823e208dfd
SHA25608929ae013fc30de7f38828f3a0d6d377c2f5209286362865591fa197624ebd0
SHA5126ad0547d34e6828ae48f89b305447adf1a490ae7f546d4d14772b1f3329182ab1001a1c7675a21677d98eb37c803ffd7e1ea55460b924833af66963219baf6a5
-
Filesize
342B
MD5ab8c8ae6862f603279e2535bcc05c6fd
SHA1bbba2803be88662bd4277f6288f70d40b36f37fa
SHA25605467027966e53f2804bc99fa0807033eeb588c241c5250d87b5083dd70c6ae3
SHA51288326b8fc735fd0f4c170e1deb3e37a1baefc1732418ec3b8cce77c62fc44f888b86a9303fe102e97f029e26bb83c7822fadfee350b801813780db4608d593a5
-
Filesize
342B
MD56c938d246720902bd1d01b5c26fa2076
SHA1af6e98a037e1d298a5dbe6da1eb71cca03c862ae
SHA256c02e4a186cdee3daf3020a55d88a43d2d0968935c0cb4f02a64526a4e3f86bb5
SHA512b9e414a2128a3630c606215a993c9d6ddf73e24f0682702ae379812a8eaae1cf7c55139209c39967e157e7463857c9b8baea7800964f4ea78b712b268b693599
-
Filesize
342B
MD5ec7ce781805d66978b9dafeb1452aa27
SHA1440416362ade49e6667dd01423190de623e0ac89
SHA25658008e55f9b49f7a943475c5df6155ecbc2df4792e255bb2d3716600c597244b
SHA512f26958d1fa868b66a9e22cffc0c7c5350682caa2c87b2c1e9d995b4d6883519a1b43ab0ca600d82d85982451729f4e6ecbc97b0e2e30586c6ec45a48873f9f76
-
Filesize
342B
MD5d9c4aad7fbd8829d692a0ea656fd9e7e
SHA1619c012b93250f4f0761662473442df20072593a
SHA2565b839f37b0c9a630563d708845cd5af3f971088746358821e7946a75d78a4b34
SHA5124c8be66ad84817ca5f106561c022307518f03f762771af4b6afed303a98f5ed19eb4140adfa8fe00d71ffe27ed070618cf8da829e0f1471932f5ba0786ca6aa8
-
Filesize
342B
MD524bf3ac94b8de885cfd80de617730725
SHA14269cfd6e716207eba3459037df3e90abd291483
SHA256a149adae1187cafd9e3de361e1dfe9e29b16e7ebd2e113114343853a94a3602d
SHA512e5cf77d894ce0777fed77f7b2d4ae3ecbd550f3ff956843233e896cb45831b0e2f0c50c225f5ea17fc191e20256cdca0ada1090e336255f988ff5748fb495d38
-
Filesize
342B
MD5f6acd831be2a0e57febef70eea049044
SHA10c4049adf383a1b95c462414c365aee482638583
SHA256a8df371cf98252bb0fe1502302765c58775ab5e3a2a9eb5b954192e690c5b702
SHA5122a56b1d144a661527a0d6b259bf40db5fde92888031502b77b8206daac3e044927fdae28aa63126b1bc3b177e411b4995454a10fb35bad963bc8831bc0505814
-
Filesize
342B
MD59d9b59dd9260cbd60f6a302efae5d5ec
SHA10fdcfb40050938148d0d76a0bd4e30057b58229e
SHA256b41c708a0deeb145a5e2b8084f02adafc258f82b64adf184f5115d75b2b3bebb
SHA5125c4ad2e25f2aa1493de4d154e5c22cbf11eb417bdd18e23ea139fdcf71f1a81c47a7fb54101631462d7b1e9bb98086dd633cd025af309fbac02f0bd4fbfb178d
-
Filesize
342B
MD554c9b1f5735a265f232df6d2a44d1d02
SHA11fd4c7e6f6e14ea7c21546fee26bd8d656b7a3bc
SHA25611c7b4a299ef09c2ab1aa9943d4670871da2a2b3125fe23d1ebe06c118f4ccc1
SHA51286daa1d6a3235dbf6dd5f8ddc8f616ecac047ab926ad8f052a3d3ea296c27437a532907e7ccc8832727f3b62e380071da73bd0b42e360b751e335e93af491c5f
-
Filesize
342B
MD56c98b85a36a38216060bbe564d2071f6
SHA1453e367f071ac6d669fea1033818af673fa13f23
SHA256e3e285e969f60d2c206a195fd8c8d0e50607c6fdece2c1c715025fac91910c05
SHA5122a934326e3045fdd5f512abadcf20bc88bcfefdabeec45e02a49cdf93e5eea61f7b44fa3ddf9ed498debfc71ca679065b19bffd2ca1feed4443a34a950487f57
-
Filesize
342B
MD54d0f439709bac5c1ec87c5e87b99bed4
SHA1aabbf8e24450a4446b1b674331ef6a700578998f
SHA256d8a9fbbcf830d1a8a75fcefcc5d67168882d748dc046fff9fffcd2614dbeb450
SHA51236e297f4827c48d53c48a00c939ae3ccd659011d0b9d05045accea9548bb12785205d25503667928ea6386919cb66b0fd94216b86ad085207ae3aee9d90115ff
-
Filesize
342B
MD596fe3d9994981ab7c6ca96504f337368
SHA12fc9e40f400030e5140849bb30e2aeaa1be6cbfc
SHA25687311367064a95dba22f928ddd43f2bdb1c6376cf6fae8df7886e08b01bbee36
SHA5127c2792b0dce55fa29b91c7d2c6869d0027b9358871fe7d2a938cb92984ea0da9f536bdb79ab317bac20124acbd91228912c2edd41aa6e702e653ae8fc0d78ba2
-
Filesize
342B
MD59a05fd13d55bc80ff11366246127c94c
SHA10a3977e53c331a268e8b950e22ec32c1edef6d54
SHA2561f09d3eea2eecaa3cb8e0a31efb3557b59ebaae0f4bb025ebe6d1f127bcd8b12
SHA512b865618c0b3a714855bf636b1b3429a3d33a72d7b089c54530e95953c7b1e11515b4009064c81b5b330f66d4742da840390ba5bbc9465dbc72d2b53a71a3757d
-
Filesize
342B
MD566798dcb3ea7cb1471d7185e963343b5
SHA177dee7356dad9c59c92329cde55b3ea9a0e50032
SHA256a6075d7b23fc9542454860ed827dfe2668279dc3312f282ee546af3986e0ec86
SHA51258b45a0acbef78184ec770a07e90ba878cac9911086045fec956f417b935925eb700782ff074d3a436507f6dc3fcd7ba7bca172c622ec06d11eda20e77e2a864
-
Filesize
342B
MD5c7ac474d37ad2fd454ee11379d38e485
SHA1eec5be91bcf0f20f45f44f3ce63f96769dcd32c6
SHA2565ca25cd5c3ef422a183de314bb6c0222195eb9f748407264e9def08268202a70
SHA51221c37babaf3b4e870819f83941a7e393ff4d6011c60f0ca966b2dea6ae4b651222b134bb981524340f10b9cb671985581cba3d0d56f34823ea4b8b2d08893be0
-
Filesize
342B
MD5724cd0351d556923c76f417c4cbe42ae
SHA1d4c5a7b66a7d57a4ac5203afdda26460eec7ae92
SHA256cd720700186d7889795f0a50ca02cfbba67405ec49e147e47ebe2f0d6aa2227b
SHA5123281a3f2952e74c7806218cc431c50078b32acafb33a63c89b5f41bfcf3fedcde11b2254d6a148084a1a890cfb3744383c237744bfd87660ed961e2246dbb68a
-
Filesize
6KB
MD5f66ac1c2a411bc10daecf17cc580f56e
SHA1ae2207de157d255464e73c1ceaf36ef6ab9c8064
SHA25621def7211d554472c3a3ade8e7a27e0399d3e731902eb165de9f3cf1e71177a3
SHA51258190a9d67ca0b465c87c7f8bb7d638cea6c7a727398504264863517152f28ae159c46f4ee742da1e005273684917c181c9e319490d317985ea8732707706168
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD5d1835b2abb14870c1415bf800f64c6a9
SHA130f497ed5133d2f8d48439fb80531537e9dd292b
SHA256216075dfafe12d7114f16a3eb4e513f173da18750ddaae4c212d97069943f2a4
SHA51257c6ca5bdd2a11133fd3c3c1268ceaae8028d57effaeb240a5c888bd690e2a9a983d2a0484ab0ba126a8306058c6a3a2d3ca5418bff689b1783ad491835e1345
-
Filesize
286KB
MD5c5b93ade217bd9a818c90976e3acc87b
SHA1f1dd3f84c3b8f0782367ce8a38dc1da0aab64854
SHA2563a2bb3e07800debe1877d52353ed905524625dd4fd40bb375ddce9e9cc7d2a7f
SHA5124e3213abaab8b1495f78b55a90882c12c70da2cd686683800bfd211e472a4a7126d2366624cc85177638e9670ce8ea1e9cb13d493ed8b9bdf6dc04e0dc90713c
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
8KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
120KB