6b805cf8583e72ac5a84f71bfb0e676d224c5c0a0149dd1d8412c919b94f037e

Analysis

max time kernel
145s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
Size

7.0MB
MD5

d99152fd1366705c54aea018a7aa2778
SHA1

1470db203a1c988bda815e29618d671a9c4fa78c
SHA256

6b805cf8583e72ac5a84f71bfb0e676d224c5c0a0149dd1d8412c919b94f037e
SHA512

aa524e519e7fa41161fa4fac6ce6816bea6558ab6ac132bc876aa91ba2776f66652d2f0bfd88c4949f03a8f8dc67a139c35ab448b2d7e2a31ae8c45857fae6fb
SSDEEP

49152:PEs1c/B8NIMI8SfpwotkzaxciB8NIrB8NIMI8Sfpwotkzaxc1OGz8S:PE2cgIMzKpXOMyIcIMzKpXOMGQS

Score

10^/10

discovery persistence ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe

Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2376	HelpMe.exe

Loads dropped DLL 2 IoCs

pid	Process
2380	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
2380	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\Z:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\J:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\I:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\H:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\K:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\N:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\Y:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\B:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\M:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\U:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\E:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\Q:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\R:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\W:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\O:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\S:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\V:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\G:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\L:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\T:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\X:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\A:	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened for modification	C:\AUTORUN.INF	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2376	2380	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe	29
PID 2380 wrote to memory of 2376	2380	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe	29
PID 2380 wrote to memory of 2376	2380	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe	29
PID 2380 wrote to memory of 2376	2380	d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d99152fd1366705c54aea018a7aa2778_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.exe

Filesize
7.0MB

MD5
2708159a1809124a70045f680d386703

SHA1
1390151b7dddf48493b8d3cf2f75e03c88e81ada

SHA256
b2e5ff50c3777b88d5ead801f4e73a760daa589c305eff887773ab8f5ce2321f

SHA512
85534ac1f6f4e94e13e2471b2dde9db02b04837e1f2a1ad6c7a3a3bd1febfcd8be85e93033d6caf9aae9c60eda016b771969679b9616ad3efd62f73097c1899d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
c533457f3a805c43bd38fab1d2ae22ef

SHA1
8ad1a193ce3ceaa0f521d1d1c1da7f7c209e0310

SHA256
2fda1b23776df693fd02cbabe1fb181867ee566231bf43724d7c7482c94475be

SHA512
af2abc4ad74ad45b6eb26107effb8486753fe1add086b59040b67a4d728ec225b7002e37cdddbb9a05d3a86d5ea2df50c4360a58c90c45efdf106b873b92b7f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
a7a9ca1a73d55e3a919c4e19e1427f77

SHA1
db10ad8e089410b391a9a51460bdb49f730c140d

SHA256
d52ad29a2151b29c7edb40532cf32a74512a994fc4994cced4f9d5e43a259d0d

SHA512
c8a42a187a0c79f9062109cb5c96c35c40847b5266f004d809d3661de7a02fbf68e09e4fa5c4f9acf62aa4e1b0b65934a7c4c930b415c0b300f4dd01bf0f1849

Download Submit
F:\AUTORUN.INF

Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
F:\AutoRun.exe

Filesize
7.0MB

MD5
d99152fd1366705c54aea018a7aa2778

SHA1
1470db203a1c988bda815e29618d671a9c4fa78c

SHA256
6b805cf8583e72ac5a84f71bfb0e676d224c5c0a0149dd1d8412c919b94f037e

SHA512
aa524e519e7fa41161fa4fac6ce6816bea6558ab6ac132bc876aa91ba2776f66652d2f0bfd88c4949f03a8f8dc67a139c35ab448b2d7e2a31ae8c45857fae6fb

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
5.7MB

MD5
9bebfc6c77fe7068d88ebcfbb22599b2

SHA1
af1d4de93f012b681d4b2fa78d6815e7371d9912

SHA256
a98201cb58c3f4c0e6b2bc71956434951681a9b9a9b163b8c6172823012e9506

SHA512
271d342f7724c2e8ad0854265ec868c3217125aa9654c9cd2bb1cbcf1590cf26358e3dcd98e6e57dc5835fdb144a1d919dfb0848d0e90fc542702146d1899257

Download Submit
memory/2376-10-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2380-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads