Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 01:22
Static task
static1
Behavioral task
behavioral1
Sample
ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe
Resource
win10v2004-20240910-en
General
-
Target
ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe
-
Size
335KB
-
MD5
ea54ac4b573864a58e912bc1296e6b3d
-
SHA1
cb0b48ec0e1c0da1b46e35c7fc7e498b6439a9ca
-
SHA256
82cc54a2d2620e98de7729569627dc794b4d53096f74e5b6fae2fdb227d63d1d
-
SHA512
712e6c66cd158ba9b112f3f00e612ea921b94c664f07a3124b45517d24a7eb6b75f9d0f4c3bc9f8c38af810f1659cefeec6af4dd4bcd3feba512848ed369e3ab
-
SSDEEP
6144:TFivQEpm5xeolcek45QUw4wQOe6Xs6TdNnWCrmLTwqYXHNQkAyktjq25B+lr:T8vQEpM/m3Re6c6RJWmmL8XHakAhZY
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (310) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe = "C:\\Windows\\System32\\ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe" ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\Videos\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\CW1M20CU\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Public\Desktop\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Public\Videos\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\Documents\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PG1T8SOQ\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N5RJMVSE\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Public\Documents\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Public\Libraries\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Public\Music\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DFSC7KT7\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\Links\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\Music\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\Searches\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Public\Pictures\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\691RDNCS\desktop.ini ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File created C:\Windows\System32\Info.hta ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2224 set thread context of 2684 2224 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 31 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00076_.WMF.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099192.GIF.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\RMNSQUE.ELM ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\CAGCAT10.DLL.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0186002.WMF.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\America\Thule.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00687_.WMF.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libvoc_plugin.dll ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Media Player\de-DE\WMPDMCCore.dll.mui ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15018_.GIF ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\STOPICON.JPG.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02738U.BMP ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Module.zip ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-math-l1-1-0.dll ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART9.BDR ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00336_.WMF ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\MENU.DPV ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\REVERSE.DLL.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00168_.WMF.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00768_.WMF ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AssemblyInfo.zip.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_zh_CN.jar.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00726_.WMF ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\PROOF\MSLID.DLL.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02829J.JPG.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Slipstream.xml ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\settings.css ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libdvbsub_plugin.dll ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0212601.WMF.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Sofia.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Menominee.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipBand.dll.mui ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\SwitchInitialize.pub.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0251301.WMF.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02187_.GIF ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0157995.WMF.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\gadget.xml ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_ja.jar.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CharSetTable.chr ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-api.jar.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\00_musicbrainz.luac ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRdIF.dll.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yellowknife.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_ja_4.4.0.v20140623020002.jar ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR44F.GIF.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsPrintTemplate.html ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\vlc.mo.id-6219851C.[[email protected]].combo ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1516 vssadmin.exe 896 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2224 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2988 vssvc.exe Token: SeRestorePrivilege 2988 vssvc.exe Token: SeAuditPrivilege 2988 vssvc.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 2224 wrote to memory of 2236 2224 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 30 PID 2224 wrote to memory of 2236 2224 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 30 PID 2224 wrote to memory of 2236 2224 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 30 PID 2224 wrote to memory of 2236 2224 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 30 PID 2224 wrote to memory of 2684 2224 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 31 PID 2224 wrote to memory of 2684 2224 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 31 PID 2224 wrote to memory of 2684 2224 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 31 PID 2224 wrote to memory of 2684 2224 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 31 PID 2224 wrote to memory of 2684 2224 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 31 PID 2224 wrote to memory of 2684 2224 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 31 PID 2224 wrote to memory of 2684 2224 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 31 PID 2224 wrote to memory of 2684 2224 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 31 PID 2224 wrote to memory of 2684 2224 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 31 PID 2684 wrote to memory of 2400 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 32 PID 2684 wrote to memory of 2400 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 32 PID 2684 wrote to memory of 2400 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 32 PID 2684 wrote to memory of 2400 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 32 PID 2400 wrote to memory of 2860 2400 cmd.exe 34 PID 2400 wrote to memory of 2860 2400 cmd.exe 34 PID 2400 wrote to memory of 2860 2400 cmd.exe 34 PID 2400 wrote to memory of 1516 2400 cmd.exe 35 PID 2400 wrote to memory of 1516 2400 cmd.exe 35 PID 2400 wrote to memory of 1516 2400 cmd.exe 35 PID 2684 wrote to memory of 1096 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 39 PID 2684 wrote to memory of 1096 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 39 PID 2684 wrote to memory of 1096 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 39 PID 2684 wrote to memory of 1096 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 39 PID 1096 wrote to memory of 1300 1096 cmd.exe 41 PID 1096 wrote to memory of 1300 1096 cmd.exe 41 PID 1096 wrote to memory of 1300 1096 cmd.exe 41 PID 1096 wrote to memory of 896 1096 cmd.exe 42 PID 1096 wrote to memory of 896 1096 cmd.exe 42 PID 1096 wrote to memory of 896 1096 cmd.exe 42 PID 2684 wrote to memory of 5088 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 43 PID 2684 wrote to memory of 5088 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 43 PID 2684 wrote to memory of 5088 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 43 PID 2684 wrote to memory of 5088 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 43 PID 2684 wrote to memory of 3188 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 44 PID 2684 wrote to memory of 3188 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 44 PID 2684 wrote to memory of 3188 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 44 PID 2684 wrote to memory of 3188 2684 ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe 44 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe"2⤵PID:2236
-
-
C:\Users\Admin\AppData\Local\Temp\ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea54ac4b573864a58e912bc1296e6b3d_JaffaCakes118.exe"2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\system32\mode.commode con cp select=12514⤵PID:2860
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:1516
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\system32\mode.commode con cp select=12514⤵PID:1300
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:896
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
- Modifies Internet Explorer settings
PID:5088
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
- Modifies Internet Explorer settings
PID:3188
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2988
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.id-6219851C.[[email protected]].combo
Filesize6.3MB
MD53367f2d195f5e365b4f87f002604bbbc
SHA10381ae3a29f293dcf2c6c279765c4e35cc6e0317
SHA2569a0cfb188b40ed4e45c4d1d2c21fdbbc0a09aee4508ece1cf7c2aa1c11d0f0ff
SHA512c7cc8771fdfa5aeb827a1dce73ac22e23ff996768f985d983755cf6f745f8dc4b140bde8e51c1c4326487d54f9558ff820c3d9d3ec2f53c0dd7639b825c9a5fc
-
Filesize
13KB
MD5b743a0db056aec6fe162079957d03632
SHA1dcf4f48864b4629ab11dcb5fe8e8b61233ce303d
SHA25648951890f19ec76ec9a251040c0956fb17f356fa608b970e76b23986f5e6d307
SHA5125aec0d62af0399c853fac81310087fed4845384fa0b9a29e9ea8458d72f7934bf26e36e3b2a3993473831dfc0840cf3d8262354e23c6a7987bf6e2ea5397ca86