Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
19-09-2024 08:32
General
-
Target
eaf34a7d9a24baf248e4b5da247a384e_JaffaCakes118.exe
-
Size
211KB
-
MD5
eaf34a7d9a24baf248e4b5da247a384e
-
SHA1
ff4ccb35e4311fefdd7f0a7251570c51ab9ab224
-
SHA256
66a05692cf2ff6b0abcd97a5d4b37b61700a21fb93eee4338d87b4ebe79e32b0
-
SHA512
a50b36fff27c74c7049be98e4e2f312c825fae52f9aa9161e830e0703e476e7cb4a2947466fda1ebca0244b2e5d6e3b086fc1e884e22b468416416ebb11637b3
-
SSDEEP
6144:z8dNXSE4z6Jl8TKkPrX81t1YVIgZDWENiEDpwjALIlhT:4fJl8TfPrX81t1RoWZfl
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.azlto5.win/2B69-2253-60F6-0063-7BFA
http://cerberhhyed5frqa.xzcfr4.win/2B69-2253-60F6-0063-7BFA
http://cerberhhyed5frqa.asxce4.win/2B69-2253-60F6-0063-7BFA
http://cerberhhyed5frqa.45kgok.win/2B69-2253-60F6-0063-7BFA
http://cerberhhyed5frqa.ad34ft.win/2B69-2253-60F6-0063-7BFA
http://cerberhhyed5frqa.onion/2B69-2253-60F6-0063-7BFA
Extracted
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16389) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 8 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
NSIS installer 2 IoCs
-
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 2 IoCs
-
Modifies Control Panel 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 59 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of AdjustPrivilegeToken 52 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\eaf34a7d9a24baf248e4b5da247a384e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eaf34a7d9a24baf248e4b5da247a384e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\eaf34a7d9a24baf248e4b5da247a384e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eaf34a7d9a24baf248e4b5da247a384e_JaffaCakes118.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{6017E6B0-989C-669C-F2CA-0F60A68A98B2}\rdrleakdiag.exe"C:\Users\Admin\AppData\Roaming\{6017E6B0-989C-669C-F2CA-0F60A68A98B2}\rdrleakdiag.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{6017E6B0-989C-669C-F2CA-0F60A68A98B2}\rdrleakdiag.exe"C:\Users\Admin\AppData\Roaming\{6017E6B0-989C-669C-F2CA-0F60A68A98B2}\rdrleakdiag.exe"4⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no5⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures5⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1460 CREDAT:275457 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1460 CREDAT:996353 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt5⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"5⤵
-
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "rdrleakdiag.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{6017E6B0-989C-669C-F2CA-0F60A68A98B2}\rdrleakdiag.exe" > NUL5⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "rdrleakdiag.exe"6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "eaf34a7d9a24baf248e4b5da247a384e_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\eaf34a7d9a24baf248e4b5da247a384e_JaffaCakes118.exe" > NUL3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "eaf34a7d9a24baf248e4b5da247a384e_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {72FF3D04-EE00-475D-BF58-1C26BDB70954} S-1-5-21-3434294380-2554721341-1919518612-1000:ELZYPTFV\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{6017E6B0-989C-669C-F2CA-0F60A68A98B2}\rdrleakdiag.exeC:\Users\Admin\AppData\Roaming\{6017E6B0-989C-669C-F2CA-0F60A68A98B2}\rdrleakdiag.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{6017E6B0-989C-669C-F2CA-0F60A68A98B2}\rdrleakdiag.exeC:\Users\Admin\AppData\Roaming\{6017E6B0-989C-669C-F2CA-0F60A68A98B2}\rdrleakdiag.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1500 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3041⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD548a5961fd49dfbc1b827c38d0efc4132
SHA1bb4b47f8bb027ec6d52120c62ca3822352d4d06c
SHA256572ddc973cb5168b04435e99f677f735454069260d87c4f3aa31d3ebf4a944c7
SHA5122dd8c325c5bd17d4f1bfa357f28d65803ee8f1c63febeecad743f6c4906b84d825935dec3592fd276ce884645763b3428e89b226b6a6af059f8c6a9256263bb3
-
Filesize
10KB
MD54e16d33df720ab2341046bdff0a32113
SHA12c863da8a220c85e67b4811bc70c81c94cc95d90
SHA256e7e481b1c4d606033033fbe36fddbd94dae29cc3cb8c78b62430016dd5b75785
SHA5128902881922ebd23a0c5169a0d66cbfabd4fa8661e519fb5c05ae7e49b572776dae2d15edc2208b2f65ab95b60630683cb7fc1fb62e6643867395067d0c3b6e92
-
Filesize
85B
MD530c4e191e3f8e1496b14de11d6cf4b48
SHA10c5606356414065c0b53482a302887eae5876634
SHA256613002c8c874681f94366bd07d2ebcb248502f55b3f88851f31adfb00ff28aa4
SHA512e6cd969a81b1e93b8432786fda3d1479abcaa09d296c26337878985709161d4c1a216364ae6ca69916cb760ea11b9d300d84bde45603816ec87e293c1b4ea911
-
Filesize
216B
MD548ac29422570636cae371b68c858b988
SHA1ff86dea198c93a8ae49ee52c6eb919fcbd259aab
SHA2563926b08f205999c2f1a24121117ecfeed31557bf6f0529416f3432321292c6b0
SHA51275019e6fd4b53528aab1af668149540e1bc372e58e4786eda1da75e7c9718dbc274cbf3f37cd38fbe7e618ea9c1b24c2534d18aecfcc3264ec55f83f206faaa3
-
Filesize
342B
MD58f506c7bf7b5fecf039b217aaa87d429
SHA1b67b0cbf383f4a2005c3db57c0de74cf88b5992c
SHA256b942e9db3aff1478ebebbc5e1e8dee0657df092694d158d6420f860ab0b823fa
SHA512c41fa272c3bf827ea580eaf53cadb4f4c6866253121ad90d08ef693283c2529aa0601141c9add129af8d232b851de55bade3c4e9c79ecfb0fb9f41d1cb3d3c41
-
Filesize
342B
MD5e45e4b0887ea9b0335fbb0c3d503d574
SHA111c50f9eb930ef110758c5d5d55cbaeae552fdc6
SHA25626d1b7b1f5db3f56d505bfa82e5d0b98b1ab3dd51f62f70641958461a9a9172c
SHA512282ddbc400c8dd039ebdd497f2bf1fbba687f97b26a0bade645ad1de93c92e1caf435fdd52971d616d688411e1d287261313f2f7514de4be3bcbf82add07bf7b
-
Filesize
342B
MD5966e0b1e5929297b031ad74494ba227d
SHA15fa534cd86f25793be891cacaf67e7772e0ac67e
SHA256cbe70f91706a94ea26459e6a73fe0c6ac3ee1e0b65ace01bb8eaca73b0281510
SHA512e5b47a4d7c1f49eda049f3cded4a8b21d7a24bf912c1fc736d24797424b49bbf5ddbffe5982cb798fd6a1f3bdc30a169b6cb77f24af19189cc45bd0eab5add0c
-
Filesize
342B
MD53dd5fb69c6e9d81168cd95d91a22e8bb
SHA1abb0c999bdbfef5ad9c91bb20d6a0840467b8026
SHA2561e6606b4cfb0a2c138896c7af0b2f570afd3ae046056a5201cb791c9e9252c3d
SHA5120d6975061fc27c7a26f203b5f616c962c36c483c499ec2d0ab220c55383651bd0bf8ebfefb86571dd29c3f8cdd7b6b61e0e8ee37a32c517fc6388be3b206fa49
-
Filesize
342B
MD52c38a28008801ecaa03a65103b9d65c7
SHA1f124b3453e9ed2a0b6c2c2c2c0e1e2c95c50cb2a
SHA25611927236a371180fedc9cab2771bbde570c0f86e9a66f842395da80806e75376
SHA5124b4f6938c6fc8b9cf7276fe23a05512d072e6d5b161e41aa5cad0464ca8c9c3a92900c9da10a356807d2a4e24d2e32abab34b5d10122647780815f45a705832d
-
Filesize
342B
MD58803525b2f6638d77dc22f8a3238bc80
SHA199de976b77f46a99b00d27e2bd41f7ea2a462e6f
SHA25601da7e779b39d1e89aa71ec38fa47c3d22837b9fb1924e172b90b5ded2fc7c84
SHA512162005d4b24b357949c56d4cf3940b7b3f23cb76f759d69ace2b90d2d577fe5da395b6593de5c194d1791c633487fc727b0fa3fd505f7eb89ea486b475d69466
-
Filesize
342B
MD500fc09a2fc076cfd02a759115e996ec8
SHA1b9e3b6995b19e5951b02716c9dd415b4d2c8d68d
SHA2560fc590adc947aca5732d024441c6909e853f5c90252c54b3f563b2597e75009d
SHA512af1720ca6ec1cf92a7254e1939a64ea978cebdf5094e45e69492c5700864510ad34fcfa7bcfb1ee4eb30d46b77bb9e560f58b490623deada1fe9422967d96409
-
Filesize
342B
MD52832e157496f2b2cae08a77ce751d840
SHA123fbd5ab3b11fc39c8edfabd5142618f702599bf
SHA256a62d4172924468734711940b773b4464d8223b455516db125356d2a2e010604f
SHA5120eac10b4d5318e1d787b3c10338619695f6e65936aae2b396f52240898690457e69ce47af2f5d736261cccb5746041a2f9fdb62c2de6bd2e99469aa953e90126
-
Filesize
342B
MD57f4c5ec5ca61479b31ea7a01f8a9fa31
SHA142843f98e5e1f63afea318b58441411f9cb50561
SHA2564299d7ec65ca9691bcc8952359e42f24e46baeb7e59c0fe1bd9746ca1d05b1bf
SHA512b15c0bde9f36a9fac7dd8c2f23f931a0180fa7aaccafa8a5bd78aec622d49850d07254af538333c3d91929301f8ca5e33e847253622408f89b7396fd12c4d7e9
-
Filesize
5KB
MD5076d6cc767afa24153d142b901d92bc9
SHA1302b0abe829942a1be1a0182c7c5c216ae39418f
SHA25646dee8cef11361beb3eaa2fce386d172600adf5ea1146c6c97ee70708ec73f78
SHA512e188c870c0bbfeda419a3d9f9ad089c4c260f99db97b3cd5c294e76682c8c8d092873e1c533e115e905093746784d062fa80540927646c3c34905d4c8bd72b0b
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
36KB
MD5725b04bb5645e70d9ae2ee72a8b23e82
SHA111a6403b90e9430f9fdc3b22344d1c5d2cbddd94
SHA25627a0c5b9f60c6dede610dea56dc6cc009c7d0ac312031272547c546ffc39c80e
SHA512a2e301456036785b040a1ff4d6e143c09c762089bd12fd26d3b3172820e37e70b3a51d74bfcebf0ef267f0b289c5622f5f6a3b7455c0639f2a35ecfe41c37493
-
Filesize
1KB
MD5147d5f86e3625c63e660991a70583a13
SHA1cdbba2212580403e6409cb00fef582eeaec21d56
SHA2567a07772b8afb941d3643faca17a040e98c73dc51962bea1a0b0062127f50b1de
SHA512939104557445a2a0eec101feba4a6a6212c895a7cee263a0da9da5b20f34ffbbb78adfffe7befa6f4f4663e2eedb33bde12912bdd043a447769319977921dfd8
-
Filesize
11KB
MD5883eff06ac96966270731e4e22817e11
SHA1523c87c98236cbc04430e87ec19b977595092ac8
SHA25644e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82
SHA51260333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390
-
Filesize
90KB
MD505fc8bccccdabed0243488f3d7a30a75
SHA1dfafc4da35a1182e7e1f5d4f32e6d600482b8a13
SHA256ff553449b2d4b769a25b8b6c639d8b5d962ddce24b4601a1bff41b8fc7697376
SHA512e326ef5f312c9a3c2ff7e09fc276e4b14aebfe17563ae44e47f7184b8c0dc9ac89f78d56e785b099e897945871a7dcd04747c0cd457128bca539baeca388f968
-
Filesize
211KB
MD5eaf34a7d9a24baf248e4b5da247a384e
SHA1ff4ccb35e4311fefdd7f0a7251570c51ab9ab224
SHA25666a05692cf2ff6b0abcd97a5d4b37b61700a21fb93eee4338d87b4ebe79e32b0
SHA512a50b36fff27c74c7049be98e4e2f312c825fae52f9aa9161e830e0703e476e7cb4a2947466fda1ebca0244b2e5d6e3b086fc1e884e22b468416416ebb11637b3
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
4KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
4KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB