Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 02:53
Behavioral task
behavioral1
Sample
c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe
-
Size
179KB
-
MD5
c81b771a8e8762a89b54f69a0d7755af
-
SHA1
e884e59df82d2a796c2de1e1c6cbd1e491e16e30
-
SHA256
20684d3edd9d61bbe0a84559c8e197a02a123e697bc8d05bd9305cf1d3984c15
-
SHA512
f2975e6f20bda5c054ea7d4bd385bf9fd52306407a6ae0d01730a340b7bc53582a98e4af4871b01eb5a94c6edfc611014fa17b7e01d7e9150351b5827c99cf2d
-
SSDEEP
3072:LNKQ4JTBg0Q8F63VETed7/kBazzFbULC3pnXSbvYE+l:LNn4FQS63VE6F/M4qe8b4
Malware Config
Extracted
C:\Users\4s01om-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/624BDC51DD2E3936
http://decryptor.top/624BDC51DD2E3936
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\O: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\A: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\I: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\M: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\L: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\X: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\Y: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\P: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\T: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\U: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\Z: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\N: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\R: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\V: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\W: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\F: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\E: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\K: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\S: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\Q: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\D: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\B: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\H: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened (read-only) \??\J: c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xlef3.bmp" c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe -
Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification \??\c:\program files\PopBackup.pptm c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\AddRevoke.wmv c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\CloseDeny.mov c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\DismountAdd.emf c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\LimitConvert.3gpp c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\MergeImport.i64 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\MoveWatch.docx c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\NewDebug.xlsm c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\ConvertToUnprotect.tif c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\SendFormat.vst c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\CompressConvertTo.mov c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\SelectWait.html c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\WaitSelect.svg c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\ExpandSearch.ps1 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\RegisterUpdate.xsl c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\RevokeOptimize.wvx c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File created \??\c:\program files\4s01om-readme.txt c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\ConvertFromSend.tmp c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\StepConvertFrom.odp c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\SyncReceive.au c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\UpdateImport.bin c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\DisconnectProtect.midi c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\RepairPing.dll c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File created \??\c:\program files (x86)\4s01om-readme.txt c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\PopResolve.pps c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\ReceiveApprove.docx c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\SyncExit.cab c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\UpdatePop.wmv c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\ProtectInitialize.mpv2 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification \??\c:\program files\ShowMove.pptm c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.19041.1081_none_2adbc983514c73da_rasmigplugin.dll_7ee2aa40 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.19041.1_es-es_23d331484ec165c2_dsregtask.dll.mui_5e1b9353 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.19041.1_none_3500efd1cdfd0fad_85f1257.fon_77baa7cb c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-h..p-provsvc.resources_31bf3856ad364e35_10.0.19041.1_en-us_296ac06bb93cb570.manifest c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-tcpip.resources_31bf3856ad364e35_10.0.19041.1_es-es_81fee3c06ca876bd.manifest c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_b40cbfe2afd2c015_setupapi.mof_8d9de59f c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-win32kbase.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_79327b950c3ce978_win32kbase.sys.mui_07d441e9 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_10.0.19041.1266_none_4cae1618139e7579_afd.sys_084af4a8 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-n..orkconnectionbroker_31bf3856ad364e35_10.0.19041.1_none_1cf5080798a0163f.manifest c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.19041.1_ro-ro_c00d07e45f7b48b1_bootmgr.exe.mui_c434701f c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..configurationengine_31bf3856ad364e35_10.0.19041.488_none_96f4e9b1e7889a13.manifest c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_1df83464f895eec7_user32.dll.mui_14652dbb c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1_zh-cn_087844a564d298b0.manifest c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1023_sl-si_a5bc9f2cf9d4120e_comctl32.dll.mui_0da4e682 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..n-cmdline.resources_31bf3856ad364e35_10.0.19041.906_en-us_adc1f5c62c383715.manifest c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1_ko-kr_7b2bff232d678514_comctl32.dll.mui_0da4e682 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-p..ng-client-overrides_31bf3856ad364e35_10.0.19041.1266_none_8e5f726ca832e39d_power.settings.battery.ppkg_90037481 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_hid-user.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_be1670627d88fc7f.manifest c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_10.0.19041.1_de-de_c57ff3a9ee2818ec_combase.dll.mui_6db10b33 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_10.0.19041.1_de-de_d3e4be20082aef2b.manifest c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_1ea3d2b20faf7de3_atmlib.dll_fe5ca5c9 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-directui-resources19h1_31bf3856ad364e35_10.0.19041.1_none_a747a941ec33876b.manifest c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..r-webclnt.resources_31bf3856ad364e35_10.0.19041.1_es-es_f5275ef67022cea8_webclnt.dll.mui_e8f04040 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-ole-automation_31bf3856ad364e35_10.0.19041.264_none_a53675c28ebc4d59.manifest c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appidcore.resources_31bf3856ad364e35_10.0.19041.1_de-de_6658fa03f9254450_srpapi.dll.mui_2693a558 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.19041.1_none_3500efd1cdfd0fad_c8514fix.fon_9cff44b7 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.19041.1_de-de_70c254192b5ba65d_dsregtask.dll.mui_5e1b9353 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1023_zh-cn_eebdbe6a380cfa05_comctl32.dll.mui_0da4e682 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-ntasn1-dll_31bf3856ad364e35_10.0.19041.1_none_7024fd8a6432413d.manifest c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..-netlogon.resources_31bf3856ad364e35_10.0.19041.1_it-it_725f5b9788589dd0_netlogon.dll.mui_ecbeb9bd c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.964_lt-lt_ce47d201c53c798b.manifest c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.19041.1_et-ee_72df6430111dde0e_bootmgr.exe.mui_c434701f c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..-netlogon.resources_31bf3856ad364e35_10.0.19041.1_en-us_e5b4926dbe2db04b_netlogon.dll.mui_ecbeb9bd c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_el-gr_76d466d05f01bb94_memtest.exe.mui_77b8cbcc c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.19041.1_zh-tw_984baa246cdd2b6c_bootmgr.efi.mui_be5d0075 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-f..etype-lucidaconsole_31bf3856ad364e35_10.0.19041.1_none_b537ffbd18185517_lucon.ttf_76ed00f1 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.19041.1_none_3947da6a963cb0d8_8514syst.fon_d6a29820 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-m..ntmanager.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_9581112fd19d980d_mountmgr.sys.mui_71b54a25 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-grouppolicy-base_31bf3856ad364e35_10.0.19041.1151_none_9cf376ee9c2c46c1.manifest c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasauto-mui.resources_31bf3856ad364e35_10.0.19041.1_en-us_7d22aa39e59cfe75_rasauto.dll.mui_12fa2c50 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-win32kbase.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_057ff0e8d689e0d1.manifest c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_it-it_580bf62c3d55fd5e_comctl32.dll.mui_0da4e682 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_10.0.19041.1_de-de_115701fa8eb2a3ae.manifest c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-winlogon-sysntfy_31bf3856ad364e35_10.0.19041.1_none_0b6400a5af10cbc9_sysntfy.dll_6c0b60ae c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.19041.1_sk-sk_6190581d530ffdab.manifest c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasbase.resources_31bf3856ad364e35_10.0.19041.1_de-de_6b17c8d06620d760_rasdiag.dll.mui_15cb4ec4 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1_lv-lv_1fc499a81f0d91a1.manifest c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmpdui.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d2104853b0241561_wmpdui.dll.mui_92411657 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1023_bg-bg_88616845ca1cafcb_comctl32.dll.mui_0da4e682 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-directmanipulation_31bf3856ad364e35_10.0.19041.84_none_44bf3519cfab87ee.manifest c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-directui-resourcesth_31bf3856ad364e35_10.0.19041.1_none_855a8e9fccc3545c.manifest c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-msfs_31bf3856ad364e35_10.0.19041.1_none_5c614dbebc49ed16_msfs.sys_ea96697c c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-winsock-core.resources_31bf3856ad364e35_10.0.19041.1_de-de_58e8f7e62ee6159d_afd.sys.mui_ff192075 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..ndactivitymoderator_31bf3856ad364e35_10.0.19041.1_none_8b4593ccb753f4e5_bamsettingsclient.dll_db7ec840 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.19041.1_none_ca60666860ba12d7_app775.fon_dec57409 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_th-th_558750deac9dd31c.manifest c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.19041.264_none_53476533f18dc602.manifest c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..entication-usermode_31bf3856ad364e35_10.0.19041.546_none_181b0a33d323b695.manifest c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-bcrypt-primitives-dll_31bf3856ad364e35_10.0.19041.1202_none_914650a100a16672_bcryptprimitives.dll_5dcb347c c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-rasbase_31bf3856ad364e35_10.0.19041.746_none_f62e5d000d9f4bd9_rasctrnm.h_17610c72 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-userenv_31bf3856ad364e35_10.0.19041.572_none_7869ead9de8ed48b_userenv.dll_1a3a70b6 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_nb-no_862dd322fb07020b_comctl32.dll.mui_0da4e682 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-sxssrv_31bf3856ad364e35_10.0.19041.207_none_3eab5ab615eaf290_sxssrv.dll_4cd0c747 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.19041.1_none_b3552a6f4dc424b4_j8514oem.fon_cf1af1d6 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4244 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe 4244 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4244 wrote to memory of 1988 4244 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe 94 PID 4244 wrote to memory of 1988 4244 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe 94 PID 4244 wrote to memory of 1988 4244 c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- System Location Discovery: System Language Discovery
PID:1988
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:4068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD552e07fbf317418ea9c715e411ce6c946
SHA15e15b848962cf6d03695f0a1a659530db6849c32
SHA2560cc621f4d6fc416b79b085e8764e8cae06cf9328ca72443bfd28663977d20b88
SHA51260035e2bb821e33b28f12549aaa6968b6e83279ecab9fbbcf7f82ddc4adbf9426cd03ea6fc3d6ef3ac15c68b12a00f53586f5702e845dfc8cb2f060839ecb852