cerber | 078b158ca33a1eefb800fe63c2eebe8a85b1bf1f0c2099ab2b33a60054beb831

Analysis

max time kernel
138s
max time network
139s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-09-2024 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe
Size

266KB
MD5

ee8bca478d4c26182df5a6aebddb4474
SHA1

bebf16741938ee0e8383c0c33bc2f4baf857a6b8
SHA256

078b158ca33a1eefb800fe63c2eebe8a85b1bf1f0c2099ab2b33a60054beb831
SHA512

c069fb54eaf1ef19b109f6a377f0a8126f592061f9b39092020be3834c9a8a6ee3695c9ea358e69a605243ff269cfaedfcb5c829a8d4c7a3ae5c3b66a16645ec
SSDEEP

6144:BwHysO+JxXMjJc+8sv79YsdL5BDnrTOY2Kw:qO+JNWJXYuL5B7OYm

Score

10^/10

cerber defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\Users\Admin\Music\# DECRYPT MY FILES #.txt

Ransom Note

C_E_R_B_E_R R_A_N_S_O_M_W_A_R_E ######################################################################### Cannot you find the files you need? Is the content of the files that you looked for not readable??? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community "#Cerb3r Ransomware". ######################################################################### !!! If you are reading this message it means the software "Cerber" has !!! been removed from your computer. !!! HTML instruction ("# DECRYPT MY FILES #.html") always contains a !!! working domain of your personal page! ######################################################################### What is encryption? ------------------- Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. ######################################################################### Everything is clear for me but what should I do? ------------------------------------------------ The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !!! Any attempts to return your files with the third-party tools can !!! be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. ######################################################################### !!! There are several plain steps to restore your files but if you do !!! not follow them we will not be able to help you, and we will not try !!! since you have read this warning already. ######################################################################### For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: 1. decrypt all your files; 2. work with your documents; 3. view your photos and other media; 4. continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. ######################################################################### There is a list of temporary addresses to go on your personal page below: _______________________________________________________________________ | | 1. http://52uo5k3t73ypjije.249isv.bid/8863-51A8-6216-0046-1FD6 | | 2. http://52uo5k3t73ypjije.tc7j6w.bid/8863-51A8-6216-0046-1FD6 | | 3. http://52uo5k3t73ypjije.o8hpwj.top/8863-51A8-6216-0046-1FD6 | | 4. http://52uo5k3t73ypjije.gg4dgp.bid/8863-51A8-6216-0046-1FD6 | | 5. http://52uo5k3t73ypjije.onion.to/8863-51A8-6216-0046-1FD6 |_______________________________________________________________________ ######################################################################### What should you do with these addresses? ---------------------------------------- If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): 1. take a look at the first address (in this case it is http://52uo5k3t73ypjije.249isv.bid/8863-51A8-6216-0046-1FD6); 2. select it with the mouse cursor holding the left mouse button and moving the cursor to the right; 3. release the left mouse button and press the right one; 4. select "Copy" in the appeared menu; 5. run your Internet browser (if you do not know what it is run the Internet Explorer); 6. move the mouse cursor to the address bar of the browser (this is the place where the site address is written); 7. click the right mouse button in the field where the site address is written; 8. select the button "Insert" in the appeared menu; 9. then you will see the address http://52uo5k3t73ypjije.249isv.bid/8863-51A8-6216-0046-1FD6 appeared there; 10. press ENTER; 11. the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: 1. click the left mouse button on the first address (in this case it is http://52uo5k3t73ypjije.249isv.bid/8863-51A8-6216-0046-1FD6); 2. in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. ######################################################################### Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: 1. run your Internet browser (if you do not know what it is run the Internet Explorer); 2. enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; 3. wait for the site loading; 4. on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; 5. run Tor Browser; 6. connect with the button "Connect" (if you use the English version); 7. a normal Internet browser window will be opened after the initialization; 8. type or copy the address ________________________________________________________ | | | http://52uo5k3t73ypjije.onion/8863-51A8-6216-0046-1FD6 | |________________________________________________________| in this browser address bar; 9. press ENTER; 10. the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. ######################################################################### Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. ######################################################################### Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. ######################################################################### If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. ######################################################################### Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.

URLs

http://52uo5k3t73ypjije.249isv.bid/8863-51A8-6216-0046-1FD6

http://52uo5k3t73ypjije.tc7j6w.bid/8863-51A8-6216-0046-1FD6

http://52uo5k3t73ypjije.o8hpwj.top/8863-51A8-6216-0046-1FD6

http://52uo5k3t73ypjije.gg4dgp.bid/8863-51A8-6216-0046-1FD6

http://52uo5k3t73ypjije.onion.to/8863-51A8-6216-0046-1FD6

http://52uo5k3t73ypjije.onion/8863-51A8-6216-0046-1FD6

Extracted

Path

C:\Users\Admin\Music\# DECRYPT MY FILES #.html

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Cerber Ransomware</title> <style> a { color: #47c; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #333; font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; } hr { background-color: #e7e7e7; border: 0 none; border-bottom: 1px solid #c7c7c7; height: 5px; margin: 30px 0; } li { padding: 0 0 7px 7px; } ol { padding-left: 3em; } .container { background-color: #fff; border: 1px solid #c7c7c7; margin: 40px; padding: 40px 40px 20px 40px; } .info, .tor { background-color: #efe; border: 1px solid #bda; display: block; padding: 0px 20px; } .logo { font-size: 12px; font-weight: bold; line-height: 1; margin: 0; } .upd_on { color: red; display: block; } .upd_off { display: none; float: left; } .tor { padding: 10px 0; text-align: center; } .url { margin-right: 5px; } .warning { background-color: #f5e7e7; border: 1px solid #ebccd1; color: #a44; display: block; padding: 15px 10px; text-align: center; } </style> </head> <body> <div class="container"> <h3>C E R B E R   R A N S O M W A R E</h3> <hr> Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community "#C3rber Ransomware". <hr> If you are reading this message it means the software "Cerber" has been removed from your computer. <hr> <h3>What is encryption?</h3> Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. <hr> <h3>Everything is clear for me but what should I do?</h3> The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !Any attempts to get back your files with the third-party tools can be fatal for your encrypted files! The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files! When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. <hr> There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already. <hr> For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: <ol> <li>decrypt all your files;</li> <li>work with your documents;</li> <li>view your photos and other media;</li> <li>continue your usual and comfortable work at the computer.</li> </ol> If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. <hr> <div class="info"> There is a list of temporary addresses to go on your personal page below: <ol> <li>Please wait...<a class="url" href="http://52uo5k3t73ypjije.249isv.bid/8863-51A8-6216-0046-1FD6" id="url_1" target="_blank">http://52uo5k3t73ypjije.249isv.bid/8863-51A8-6216-0046-1FD6</a>(<a href="#updateUrl" onClick="return updateUrl();" style="color: red;">Get a NEW address!</a>)</li> <li><a href="http://52uo5k3t73ypjije.tc7j6w.bid/8863-51A8-6216-0046-1FD6" target="_blank">http://52uo5k3t73ypjije.tc7j6w.bid/8863-51A8-6216-0046-1FD6</a></li> <li><a href="http://52uo5k3t73ypjije.o8hpwj.top/8863-51A8-6216-0046-1FD6" target="_blank">http://52uo5k3t73ypjije.o8hpwj.top/8863-51A8-6216-0046-1FD6</a></li> <li><a href="http://52uo5k3t73ypjije.gg4dgp.bid/8863-51A8-6216-0046-1FD6" target="_blank">http://52uo5k3t73ypjije.gg4dgp.bid/8863-51A8-6216-0046-1FD6</a></li> <li><a href="http://52uo5k3t73ypjije.onion.to/8863-51A8-6216-0046-1FD6" target="_blank">http://52uo5k3t73ypjije.onion.to/8863-51A8-6216-0046-1FD6</a></li> </ol> </div> <hr> <h3>What should you do with these addresses?</h3> If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): <ol> <li>take a look at the first address (in this case it is Please wait...<a class="url" href="http://52uo5k3t73ypjije.249isv.bid/8863-51A8-6216-0046-1FD6" id="url_2" target="_blank">http://52uo5k3t73ypjije.249isv.bid/8863-51A8-6216-0046-1FD6</a>);</li> <li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li> <li>release the left mouse button and press the right one;</li> <li>select "Copy" in the appeared menu;</li> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li> <li>click the right mouse button in the field where the site address is written;</li> <li>select the button "Insert" in the appeared menu;</li> <li>then you will see the address Please wait...<a class="url" href="http://52uo5k3t73ypjije.249isv.bid/8863-51A8-6216-0046-1FD6" id="url_3" target="_blank">http://52uo5k3t73ypjije.249isv.bid/8863-51A8-6216-0046-1FD6</a> appeared there;</li> <li>press ENTER;</li> <li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: <ol> <li>click the left mouse button on the first address (in this case it is Please wait...<a class="url" href="http://52uo5k3t73ypjije.249isv.bid/8863-51A8-6216-0046-1FD6" id="url_4" target="_blank">http://52uo5k3t73ypjije.249isv.bid/8863-51A8-6216-0046-1FD6</a>);</li> <li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet. <hr> Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address http://52uo5k3t73ypjije.onion/8863-51A8-6216-0046-1FD6 in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. <hr> <h3>Additional information:</h3> You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. <hr> Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. <hr> If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. <hr> Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files. </div> <script> function getXMLHttpRequest() { if (window.XMLHttpRequest) { return new window.XMLHttpRequest; } else { try { return new ActiveXObject("MSXML2.XMLHTTP.3.0"); } catch(error) { return null; } } } function getUrlContent(url, callback) { var xhttp = getXMLHttpRequest(); if (xhttp) { xhttp.onreadystatechange = function() { if (xhttp.readyState == 4) { if (xhttp.status == 200) { return callback(xhttp.responseText.replace(/[\s ]+/gm, ""), null); } else { return callback(null, true); } } }; xhttp.open("GET", url + '?_=' + new Date().getTime(), true); xhttp.send(); } else { return callback(null, true); } } function server1(address, callback) { getUrlContent("http://btc.blockr.io/api/v1/address/txs/" + address, function(result, error) { if (!error) { var tx = /"tx":"([\w]+)","time_utc":"[\w-:]+","confirmations":[\d]+,"amount":-/.exec(result); if (tx) { getUrlContent("http://btc.blockr.io/api/v1/tx/info/" + tx[1], function(result, error) { if (!error) { var address = /"vouts":\[{"address":"([\w]+)"/.exec(result); if (address) { return callback(address[1], null); } else { return callback(null, true); } } else { return callback(null, true); } }); } else { return callback(null, true); } } else { return callback(null, true); } }); } function server2(address, callback) { getUrlContent("http://api.blockcypher.com/v1/btc/main/addrs/" + address, function(result, error) { if (!error) { var tx = /"tx_hash":"([\w]+)","block_height":[\d]+,"tx_input_n":[\d-]+,"tx_output_n":-/.exec(result); if (tx) { getUrlContent("http://api.blockcypher.com/v1/btc/main/txs/" + tx[1], function(result, error) { if (!error) { var address = /"outputs":\[{"value":[\d]+,"script":"[\w]+","spent_by":"[\w]+","addresses":\["([\w]+)"/.exec(result); if (address) { return callback(address[1], null); } else { return callback(null, true); } } else { return callback(null, true); } }); } else { return callback(null, true); } } else { return callback(null, true);

Signatures

Cerber 2 IoCs

Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

ransomware cerber

description	ioc	Process
Mutant opened	shell.{7730090E-AB26-FD6E-A973-AD69CA559F2E}	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe
Mutant created	shell.{7730090E-AB26-FD6E-A973-AD69CA559F2E}	bootcfg.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	bootcfg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2708	bcdedit.exe
1692	bcdedit.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7F19A57-C953-7B64-1413-296E95479BC0}\\bootcfg.exe\""	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7F19A57-C953-7B64-1413-296E95479BC0}\\bootcfg.exe\""	bootcfg.exe

Contacts a large (524) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Deletes itself 1 IoCs

pid	Process
2636	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\bootcfg.lnk	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\bootcfg.lnk	bootcfg.exe

Executes dropped EXE 2 IoCs

pid	Process
2732	bootcfg.exe
3016	bootcfg.exe

Loads dropped DLL 5 IoCs

pid	Process
3056	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe
3056	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe
2004	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe
2732	bootcfg.exe
2732	bootcfg.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bootcfg = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7F19A57-C953-7B64-1413-296E95479BC0}\\bootcfg.exe\""	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\bootcfg = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7F19A57-C953-7B64-1413-296E95479BC0}\\bootcfg.exe\""	bootcfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bootcfg = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7F19A57-C953-7B64-1413-296E95479BC0}\\bootcfg.exe\""	bootcfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\bootcfg = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7F19A57-C953-7B64-1413-296E95479BC0}\\bootcfg.exe\""	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bootcfg.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp9A3D.bmp"	bootcfg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3056 set thread context of 2004	3056	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe	30
PID 2732 set thread context of 3016	2732	bootcfg.exe	39

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE	bootcfg.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.txt	bootcfg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE	bootcfg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE	bootcfg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote-PipelineConfig.xml	bootcfg.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.vbs	bootcfg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote.ini	bootcfg.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.url	bootcfg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE	bootcfg.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.url	bootcfg.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.html	bootcfg.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.vbs	bootcfg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE	bootcfg.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.html	bootcfg.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.txt	bootcfg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\-1	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe
File opened for modification	C:\Windows\rabatos	bootcfg.exe
File opened for modification	C:\Windows\-1	bootcfg.exe
File opened for modification	C:\Windows\rabatos	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bootcfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bootcfg.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2636	cmd.exe
684	PING.EXE
580	cmd.exe
340	PING.EXE

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0005000000018708-39.dat	nsis_installer_1
behavioral1/files/0x0005000000018708-39.dat	nsis_installer_2

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2716	vssadmin.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
2132	taskkill.exe
1736	taskkill.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7F19A57-C953-7B64-1413-296E95479BC0}\\bootcfg.exe\""	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop	bootcfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7F19A57-C953-7B64-1413-296E95479BC0}\\bootcfg.exe\""	bootcfg.exe

Modifies Internet Explorer settings 1 TTPs 61 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433033184"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD649411-779F-11EF-A0B2-6AE4CEDF004B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d22770ac0bdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD5B0E91-779F-11EF-A0B2-6AE4CEDF004B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000058081b0a855976c20f79a735bb6186289bf88e86e29ff70557e11b6d30628ef3000000000e8000000002000020000000d7bfed24fadb14e4ff9b573b312f0204aa846e25ab05217c60c4bb674483831a20000000939b0e206fd0bca0ffefbeb2efe6b36bff73780d9def284eb9e596325783ca92400000007f9e1378223b8f480741a16faa6e9253de0c1b3a50515e341b64c89e5bb510794b8895da5a6bcd2ec4143af98375c45031a7c31b3dd22c3104faa204d068c19c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000008ba0bb6971706a8eae79a60f284999abfc4ca0b6496a06714358259df61fe2a6000000000e800000000200002000000051ccb06eec5c5aef5c16873c2574ca028cf753ac799ce0cb68419ba73fc7b7d6900000008584d03dbcaa2d9212f1f1567c044f2e6d5bdae6600e3a46e811d453adee6018252cbaf9e791c032563420370e1f7c85558bf39c0b63cde9a385568fc7f8ef2334ec4abbe415172ab1c790513f89d9f2815f9f2255226b371c993894f13b8905544f8428bcc9733a44a4efe75cc079f421fff24f4bce00d42452b283058dcaeb8ecadf3c85c67afad0b0592f90df9ef54000000082f50cc85e740cfc474ca31f9790265f8d5c611052a0b5f2bb872e8e13f36877685055ce078c06cc6ad61a4897763e5dccca575771797b5b74a24117127da95a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
684	PING.EXE
340	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe
3016	bootcfg.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe
Token: SeDebugPrivilege	2132	taskkill.exe
Token: SeDebugPrivilege	3016	bootcfg.exe
Token: SeBackupPrivilege	2344	vssvc.exe
Token: SeRestorePrivilege	2344	vssvc.exe
Token: SeAuditPrivilege	2344	vssvc.exe
Token: SeIncreaseQuotaPrivilege	696	wmic.exe
Token: SeSecurityPrivilege	696	wmic.exe
Token: SeTakeOwnershipPrivilege	696	wmic.exe
Token: SeLoadDriverPrivilege	696	wmic.exe
Token: SeSystemProfilePrivilege	696	wmic.exe
Token: SeSystemtimePrivilege	696	wmic.exe
Token: SeProfSingleProcessPrivilege	696	wmic.exe
Token: SeIncBasePriorityPrivilege	696	wmic.exe
Token: SeCreatePagefilePrivilege	696	wmic.exe
Token: SeBackupPrivilege	696	wmic.exe
Token: SeRestorePrivilege	696	wmic.exe
Token: SeShutdownPrivilege	696	wmic.exe
Token: SeDebugPrivilege	696	wmic.exe
Token: SeSystemEnvironmentPrivilege	696	wmic.exe
Token: SeRemoteShutdownPrivilege	696	wmic.exe
Token: SeUndockPrivilege	696	wmic.exe
Token: SeManageVolumePrivilege	696	wmic.exe
Token: 33	696	wmic.exe
Token: 34	696	wmic.exe
Token: 35	696	wmic.exe
Token: SeIncreaseQuotaPrivilege	696	wmic.exe
Token: SeSecurityPrivilege	696	wmic.exe
Token: SeTakeOwnershipPrivilege	696	wmic.exe
Token: SeLoadDriverPrivilege	696	wmic.exe
Token: SeSystemProfilePrivilege	696	wmic.exe
Token: SeSystemtimePrivilege	696	wmic.exe
Token: SeProfSingleProcessPrivilege	696	wmic.exe
Token: SeIncBasePriorityPrivilege	696	wmic.exe
Token: SeCreatePagefilePrivilege	696	wmic.exe
Token: SeBackupPrivilege	696	wmic.exe
Token: SeRestorePrivilege	696	wmic.exe
Token: SeShutdownPrivilege	696	wmic.exe
Token: SeDebugPrivilege	696	wmic.exe
Token: SeSystemEnvironmentPrivilege	696	wmic.exe
Token: SeRemoteShutdownPrivilege	696	wmic.exe
Token: SeUndockPrivilege	696	wmic.exe
Token: SeManageVolumePrivilege	696	wmic.exe
Token: 33	696	wmic.exe
Token: 34	696	wmic.exe
Token: 35	696	wmic.exe
Token: SeDebugPrivilege	1736	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2672	iexplore.exe
2964	iexplore.exe
2964	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2964	iexplore.exe
2964	iexplore.exe
2672	iexplore.exe
2672	iexplore.exe
2964	iexplore.exe
2964	iexplore.exe
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
284	IEXPLORE.EXE
284	IEXPLORE.EXE
204	IEXPLORE.EXE
204	IEXPLORE.EXE
204	IEXPLORE.EXE
204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2004	3056	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe	30
PID 3056 wrote to memory of 2004	3056	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe	30
PID 3056 wrote to memory of 2004	3056	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe	30
PID 3056 wrote to memory of 2004	3056	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe	30
PID 3056 wrote to memory of 2004	3056	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe	30
PID 3056 wrote to memory of 2004	3056	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe	30
PID 3056 wrote to memory of 2004	3056	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe	30
PID 3056 wrote to memory of 2004	3056	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe	30
PID 3056 wrote to memory of 2004	3056	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe	30
PID 3056 wrote to memory of 2004	3056	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe	30
PID 3056 wrote to memory of 2004	3056	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe	30
PID 2004 wrote to memory of 2732	2004	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe	33
PID 2004 wrote to memory of 2732	2004	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe	33
PID 2004 wrote to memory of 2732	2004	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe	33
PID 2004 wrote to memory of 2732	2004	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe	33
PID 2004 wrote to memory of 2636	2004	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe	34
PID 2004 wrote to memory of 2636	2004	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe	34
PID 2004 wrote to memory of 2636	2004	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe	34
PID 2004 wrote to memory of 2636	2004	ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe	34
PID 2636 wrote to memory of 2132	2636	cmd.exe	36
PID 2636 wrote to memory of 2132	2636	cmd.exe	36
PID 2636 wrote to memory of 2132	2636	cmd.exe	36
PID 2636 wrote to memory of 2132	2636	cmd.exe	36
PID 2636 wrote to memory of 684	2636	cmd.exe	38
PID 2636 wrote to memory of 684	2636	cmd.exe	38
PID 2636 wrote to memory of 684	2636	cmd.exe	38
PID 2636 wrote to memory of 684	2636	cmd.exe	38
PID 2732 wrote to memory of 3016	2732	bootcfg.exe	39
PID 2732 wrote to memory of 3016	2732	bootcfg.exe	39
PID 2732 wrote to memory of 3016	2732	bootcfg.exe	39
PID 2732 wrote to memory of 3016	2732	bootcfg.exe	39
PID 2732 wrote to memory of 3016	2732	bootcfg.exe	39
PID 2732 wrote to memory of 3016	2732	bootcfg.exe	39
PID 2732 wrote to memory of 3016	2732	bootcfg.exe	39
PID 2732 wrote to memory of 3016	2732	bootcfg.exe	39
PID 2732 wrote to memory of 3016	2732	bootcfg.exe	39
PID 2732 wrote to memory of 3016	2732	bootcfg.exe	39
PID 2732 wrote to memory of 3016	2732	bootcfg.exe	39
PID 3016 wrote to memory of 2716	3016	bootcfg.exe	40
PID 3016 wrote to memory of 2716	3016	bootcfg.exe	40
PID 3016 wrote to memory of 2716	3016	bootcfg.exe	40
PID 3016 wrote to memory of 2716	3016	bootcfg.exe	40
PID 3016 wrote to memory of 696	3016	bootcfg.exe	45
PID 3016 wrote to memory of 696	3016	bootcfg.exe	45
PID 3016 wrote to memory of 696	3016	bootcfg.exe	45
PID 3016 wrote to memory of 696	3016	bootcfg.exe	45
PID 3016 wrote to memory of 2708	3016	bootcfg.exe	47
PID 3016 wrote to memory of 2708	3016	bootcfg.exe	47
PID 3016 wrote to memory of 2708	3016	bootcfg.exe	47
PID 3016 wrote to memory of 2708	3016	bootcfg.exe	47
PID 3016 wrote to memory of 1692	3016	bootcfg.exe	49
PID 3016 wrote to memory of 1692	3016	bootcfg.exe	49
PID 3016 wrote to memory of 1692	3016	bootcfg.exe	49
PID 3016 wrote to memory of 1692	3016	bootcfg.exe	49
PID 3016 wrote to memory of 2964	3016	bootcfg.exe	52
PID 3016 wrote to memory of 2964	3016	bootcfg.exe	52
PID 3016 wrote to memory of 2964	3016	bootcfg.exe	52
PID 3016 wrote to memory of 2964	3016	bootcfg.exe	52
PID 3016 wrote to memory of 2608	3016	bootcfg.exe	53
PID 3016 wrote to memory of 2608	3016	bootcfg.exe	53
PID 3016 wrote to memory of 2608	3016	bootcfg.exe	53
PID 3016 wrote to memory of 2608	3016	bootcfg.exe	53
PID 2964 wrote to memory of 1216	2964	iexplore.exe	55
PID 2964 wrote to memory of 1216	2964	iexplore.exe	55

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe"
  2⤵
  - Cerber
  - Modifies visiblity of hidden/system files in Explorer
  - Adds policy Run key to start application
  - Drops startup file
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Users\Admin\AppData\Roaming\{E7F19A57-C953-7B64-1413-296E95479BC0}\bootcfg.exe
    "C:\Users\Admin\AppData\Roaming\{E7F19A57-C953-7B64-1413-296E95479BC0}\bootcfg.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Users\Admin\AppData\Roaming\{E7F19A57-C953-7B64-1413-296E95479BC0}\bootcfg.exe
      "C:\Users\Admin\AppData\Roaming\{E7F19A57-C953-7B64-1413-296E95479BC0}\bootcfg.exe"
      4⤵
      Cerber
      Modifies visiblity of hidden/system files in Explorer
      Adds policy Run key to start application
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Sets desktop wallpaper using registry
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3016
    - - C:\Windows\system32\vssadmin.exe
        
        "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:2716
    - - C:\Windows\system32\wbem\wmic.exe
        
        "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:696
    - - C:\Windows\System32\bcdedit.exe
        
        "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2708
    - - C:\Windows\System32\bcdedit.exe
        
        "C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1692
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2964
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2964 CREDAT:275457 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1216
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2964 CREDAT:537601 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:204
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
        5⤵
        
        PID:2608
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
        5⤵
        
        PID:1500
    - - C:\Windows\system32\cmd.exe
        
        /d /c taskkill /f /im "bootcfg.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{E7F19A57-C953-7B64-1413-296E95479BC0}\bootcfg.exe" > NUL
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:580
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "bootcfg.exe"
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1736
      - C:\Windows\system32\PING.EXE
        
        ping -n 1 127.0.0.1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:340
- - C:\Windows\SysWOW64\cmd.exe
    /d /c taskkill /f /im "ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe" > NUL
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "ee8bca478d4c26182df5a6aebddb4474_JaffaCakes118.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2132
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:684

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2344

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2672
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:284

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
- System Location Discovery: System Language Discovery
PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
351f07fde106064cf22c455d4544139b

SHA1
60e0f6a80f2b0027c58c4fadd32796be9ae132af

SHA256
b7e0563621b51ccc0a12b718bf79d438e0ffa6ee9d2699b136d959e166e40026

SHA512
7f11148ea71b20d1eca7f18e76f5acb160aab417a9cc92b3763b7292fd0d37165571df2d86b71008b14fc05ed0a4289ecd72f7a0e64c90dc99f46d48078522f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4068d3d9d9e31b01cf30e78ac80c014d

SHA1
22773dba8798292f3fe54729ef91bc1424d52fc8

SHA256
31e157d0d0570b42d2e48fb03476d503523ec2210f6b3e73d93c805c0e648606

SHA512
52a6393ecf1b463c04f5f008d5b7e2185a5ed33516263080880f114de43d6113127949b31f5896c4b6dc8424dd36ad9ed277d802e28751bec2e484627d160499

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd86cb3205f1044514eeb118bc6ed1a6

SHA1
cb20a5dee0e165ec2a7a88ad6dc0a85ed8b9d6a0

SHA256
b7696fb737e9bf96ec8a2bc6f797795a6718dbf3780bcca26c1254d2ce2a5733

SHA512
16ad723d7d8d02b4f824920fb1031107e7959cd9fb515c2a0ef692eb84d1f75ec31742a958676af4840e214269de5c121e4a0f2ca724fb3aa043746e6d87b49a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7714b6ddf20a83b4d83fc9627658cda0

SHA1
d3412553969db8b97093d106a76dab6755b3985d

SHA256
6dae57dbe5d1234541221e27153b2e8050e4919fc4ff27b2da00b3cc96815d4f

SHA512
880ba0317fd45a570159524f27b2dfa7ef3f88a6ea91128dda83a086e0cf2f83758bca6631dd9bc940bc1d0794114c1ca83d7f191334eebc921033a9f70418c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ccdda975c0b34bfb00e9cf0ada39935

SHA1
c983ff88a3932f127897683a1c3ce7d936ae3d46

SHA256
89bbce5e1d58c56f89933e9a8a3fad8b8d4b1a085e2f7b0f37b720259eb78756

SHA512
08c6b4a56727f6b883b0b47c81c915bc4b0d21ce597c36d75af537794982be4803f84713d6279cc640e54b11027d8c528da4946be2fd33cc4769dce6b98ec08b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa32f6400e2bcf1e5afb335a5e0f5ceb

SHA1
000f40c4307b4e64fdbefdcba3a321ebe23c5f29

SHA256
bbed22e22d13930384e416be26ddfdc44262bdf95d8d2fcb14bb013c096fb5f3

SHA512
db7785fede93d6ce7f758133a520a4bf2a6323a4c59cec99063b3dc3677a1272490bc68f3a956d831f4605b5fe34256a85648bf1d40492571284a5ba3f732752

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1fad8bf764b4161c4ec5e078653a37d

SHA1
1ca0ce0b30e02576f7e2dc066d162ac6f5d9e33d

SHA256
c4acb1081e80c45be7338749e227ca548f939a3e77fc271c1aa142f73de74c2d

SHA512
f70e85e88c431580a51b82b10902ebd30765bddc9cfe196d6c36ce0832f05657ef14789b149d727d477b78ab7d921ba87d929061efcbb3f3d1ed68b9cc220996

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9303c8dc97d0338d80ce1db5c3b290c

SHA1
251e4b580dbf88e8d13f7c8ea31bf145d3d8b031

SHA256
372deba1633242f8c2e8d6f87e4a42349d3490474b7d216c3cabedbf0619f84a

SHA512
dee9fe597f7bd3d8e0f186048d15c3821f76b689ab68fc0f1957342349e9f079863c39e15c3f0604aa4e3b454a8b8b8ed077b70e6fb6e696845c5b87618abf0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5f4e22992d692b1901717a6433aafc0

SHA1
0672d7bd3489a57eb3d0ea22dfb81b3999e39343

SHA256
f4412abfb2dbfff26064275bfaa2042654f0f6dede9ccf5ea70aaab821b4f066

SHA512
5d87c24fed132083a0c2664c10dd55d4c1622cc547fc518ce0160b559a36308fde858c7d93492c1cff490f99020045573718c3ae15825a27286a9bdf5770fac8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59e09d4a915a589f445db3964d246d52

SHA1
d716b8ca7bc500b3e2f8f1dd1e2c15418fa7085a

SHA256
511ba091613f4b2f2fad16caf63e1c94cee43822d8a1138c31f49566fce1bd0b

SHA512
296740bf96cd2ab68e6592b4685e4e3fb9bcaf0a4205fa3cbdca207e43ccacee5620b714834942207fb2e2b498153ca58de0bec601dfdc8824aa1b61794275b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45b2e101b0cad9324f0a6045f8009ed0

SHA1
5476724f0f1e4688ebb95b71dd6bccc90762cae3

SHA256
1a91b9ed27c060977c51686f87ad813284a337523026796fa395a8ca33f61a8f

SHA512
52b671f48a9b675f570c220f05e2184cf1a6ebd3ef52ff4cf6b5d1e34909ba1ec95aa1abfbaaedfc23dbe97aefd5fe516c32743fd218bef1bdc2df0879ccf0c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6dc343c9e0d4405a3245ee40f9b96c72

SHA1
7010e2d651394f4f7e3d092770c11eb53209897c

SHA256
59bcc9a4294e725bed386d851869bebad9d80434134758e622e3a85516504b5a

SHA512
3b91873dec3bbc20a22b2a2a7ffa0c3fe1d873a9aa45c2abbc7edb8dff1cd2a1526ed3aac95a5c89ea02d8c864c8133654495e3f600222668399dee0edd60f38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9883ebf75d0fc6d16eec987dff70fc2

SHA1
2530619db1f24c3b9bd91a4c949b851265da2175

SHA256
571a0b4c70ed33f24e25218476c148bf66540404b5cea61151fa01fae1f96b24

SHA512
0e8846d62dc6ba0ab7c074b5f3759d7a448b14d2304af885de7da764a3ba15492d1379d42964366f732cad37af9dcfcaf89fce333fde48ef0b933b68ec247751

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cc6474df8c3694732bc8f08b9a0976a

SHA1
aec5725d4acb7e84d3707ba7fca2fa38500c641b

SHA256
8073718fa82ed5107505b33c9b944f788c58944c0a4f9e05e6cac8b57b1f55fe

SHA512
ee8d32f3ee38b9b2e86e12371d8b627fda8a4a9ff22b4c5d371f1fada49d1bf5b4074afa92aa6a70b886dcc72e8bf97b393032d7e5a768b236650726e8244037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7d102be8115d2c9e998ade82ae25d1a

SHA1
b016ca74b58cbeaf77cd3931396745b22c6cf5db

SHA256
af19cc8a5f1bd5c57f218e70c28c462d2d710f2a460a566805b6ab3b5ddf8540

SHA512
916e7e35ef90160dd89d72cfffd971449f6f49937ebdabbc47d310ac2e43dd4bd0422176b8bc518dc4a5795c760b1b4ffd5ea6448c192aba25b14303951acb3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23f67e762752db83f5847a87accc5a59

SHA1
8316ed0a7b310a769533485688cb41d6354e2aa9

SHA256
bf6cdf98b9f8145f1d568abf4b95efdb4182494909814527505eb278a77a2d1a

SHA512
b0ff474dad71512923b13b32d4bd0ffd7bc0c72c2e920f35bfdc08d0877cb1b38257e5fa3033f03579fc96211828b2fa395e163c64c1d08713b107424b1fc9b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e39fd04885f01bf23cfb3afe9be384e

SHA1
828ed27d9ad104084d9dbac95ff6e9252ca82f86

SHA256
fa4b4d9c4fd5c66ba0cd70b6823fb521ad5aed3ca826f0c0935685b0195e1f8a

SHA512
bf28c81f7a135f10205e1fa505b11d1eb56a5642d63b3da5eb6114cbed8e04920eb42960689c8a1ba1a8e065b91ecf118ecc8e921352297f9626e39e6996d9d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3a90824566745d0f5668346515f9b24

SHA1
87353fb5da98cefc3627c3a9dfd6d858b5490363

SHA256
4d1666b792a7799895eef5be85dda3a1d43aa6d2dc424afd0a2e3bc298fa418d

SHA512
8b46171c9190d4212e20a339728b6a13bfe44eb4c8bbfacf597ad77ebfeb53ffe7799c1b9617c5246e8c7a7391e8aabd4046389c9686b1d954f75ba520ac6e13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c57380b320b95af4180db01f3e9e5ff

SHA1
ab277bfcd6c0bd69d62a647f40940d22ca44d8e3

SHA256
50d96bf273317f0f74b84c388fe804baaafa87155d9078a6e1c3950ed17864f0

SHA512
45a7d2062d22eb6c9c2b21323f5386faed356ef2a7981bb9f5e12d749f313dab895aa32c624c823d1e5f1d2f49d8013d4c540b0d8cef56fbb56f592ebf07a21c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
913776527abf887e9021626d10b81176

SHA1
0c9453ec564ea09f1d8532bb2d97f54afbf0c589

SHA256
5bb3214714628d9a999d340f0de5e80561d1f926cd64b00943f421a92cb0813d

SHA512
af14361e727288e98bfcd8a69762b580c06f5ccc8c57d54c56e15fae1e0a7e331a18d6498a695e19b023d0183f96bfd9ee45475debfc8cb12ccaa61cbfaa0155

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c98e9845c34f5e20e30b3bf875ef0eb

SHA1
7c9921f7cc27e5bbb3956560bdd7eb749449346a

SHA256
710a56aba8079250cd72539246dc751af148106e26ecd7c11cb7504319147fc7

SHA512
a69d0e2f255c078d163d4b456a8906eb1e3454b93c1907de257652fc2bf9a61b0cd8f968558d16ea78df68089b834788586a62b591d11321353c54676d2c241d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ace840327571ed7d4b12a7cad2891ebe

SHA1
18b99b14577c8470d846b7d2aeb7b1d6431ce71f

SHA256
8e1f50ce6fe51652a8df8ba7cb2ff34f9f56df8759cb8b8981fc0c7df451c0a3

SHA512
931a077748348fff83986db9095f509ab0c8b78c478fb4db94885cf520d466c0405a02c09ac2b1e689bcd6bcf0762fd4b4d589d998db46edb0272c021ddc3700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
96ecae1bfe28bf4a7b4d705c2680846a

SHA1
a0382e7f9a6521c16c17dcaa1a1d947077a7defa

SHA256
e320dcd17d8a838877bc56306bb73f438bd6d279b2ae74dbdc699169cb2d86f8

SHA512
f7f1af290b3547b3b7eadffee7eae16d5b3098c844a86ba2764fcd19c6757e65ba2b783bb85a9b83891872678248221db9660ec90e7b013f6fdd3c1ea13731b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{AD5B0E91-779F-11EF-A0B2-6AE4CEDF004B}.dat

Filesize
5KB

MD5
16922be0fb389c26694453d765b4b370

SHA1
875aa935929ff53f3b781f28cde36fdfcb760b2e

SHA256
eb1b942ec7c327771d76848181f0204d5f526a11ee3293d147dd06dea04a2c6c

SHA512
bd1e1f8217f99be92a18f58b322d5937958a2116e9a82d0f35feee4a48db05c47c6b2d885063e6e2d46c2d216991b41bc344bbcf0025a606b7da51b0025fce9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6XUZ2JLF\json[1].json

Filesize
311B

MD5
9105750f17d90587cfdb3073e3db4b41

SHA1
68299e57ccb94050710511c9fba7f144af55038d

SHA256
325bea9d40295cd711d613b7dcb0958e04a537f751b177573a9c40303a4879f9

SHA512
07fcd8e2811bc7d8a481694d32a8d220a03ec99dfd8b9f55de99ff8327d392c6afbd821358b5087e29120b5a6d706f258c723585d3c69a26c1b0c385722256de

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB85A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB8F9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\500.htm

Filesize
1KB

MD5
af35cc4818a5c71b23b3458d91951293

SHA1
91e32267493a44e0bbbaeacf7cf20e6d6095430b

SHA256
6836c2e7c6237059fb0dde27a99dcd70c25346de2357d8723cbc21be92d71e8e

SHA512
78d3db830c1fb85ec6244fe8731f9d8521c4ac0f0ad0ca9fad77941036eff634bd6cb12895653519cb2291f791dc3b9dc6e9592f7d78ddc50f4fb47665cf17ce

Download Submit
C:\Users\Admin\AppData\Roaming\Introvert.VpK

Filesize
207KB

MD5
3e25ce067f336cdc1b15641d65d5f982

SHA1
a2e2cef56bcc79503aa87563c3c9eae2283de295

SHA256
b314245f5c74897d9d0d1494ea21daa8105d3b801cbec6e51fb5099f8619c7c2

SHA512
63f9cf267fceeabd508dadab575d0880bec1bb88d9fb00178b4a9660dcb1561e31eb3fb76114589d1bda1c19296cf47cccdbad123005768cad0d4a4d0096df04

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\bootcfg.lnk

Filesize
1KB

MD5
aea06f7c5922656c91ad588efa6effbf

SHA1
5fa4b545b03f9c09112dae5938ebce87f609915b

SHA256
905f52656cad0d1d76843d134528beb987314cb328170c36147a4a205355b836

SHA512
4fca914bb39be0701bcbc6643024596c43c1571d01961bf2fca92c8a488e1b6a8b4214be788f18c89b5ddd0f53995e7ece327ba131047f2a558eb78f66f39e83

Download Submit
C:\Users\Admin\AppData\Roaming\Normalcy.Me6

Filesize
2KB

MD5
d187d95c150a09eb02bfc71373be5506

SHA1
911d1c470774792414ef2f5d2d08ef44af063ee0

SHA256
8bec67e5221c8cafeccd8c7250fad9ab4a09ee00929ba219038db7ece6d996d9

SHA512
960f591a7fc85e0eeadab4505fd79e21ee160838f1f0a26cd44a92cca9cfbd1b6648b5c623aadd1c03dda76e45debb84b0547901f9976f0ada6a7eb9d940d375

Download Submit
C:\Users\Admin\AppData\Roaming\chunkfast.xsl

Filesize
2KB

MD5
4b3b2473db1fd9f3f04044bb47d000ca

SHA1
a52a3fd19e5a1b72f9285ce4d0451650507a5dea

SHA256
d116d6e0ef1c1b5cb1512e2de16fb266e86960f636e4a608147d214fd2055a76

SHA512
2e110bc9822145b8347fe656b8021d985840a9a44c7659e9524059c94f3617c444900c248a263940f11b32ff82d3efcaa9a400e64d34303055ed9db63aaf3b80

Download Submit
C:\Users\Admin\AppData\Roaming\defaultProfilerFilter_smartdata.xml

Filesize
2KB

MD5
604fe6e21365861c0415d77222ff0612

SHA1
75499be26469ce5cb2c0e874cb2628698f9cfe70

SHA256
c53fa85419f8e767f0f8089d6c2427e768ea5c0dc527ea04e0aa06b727131904

SHA512
49b9717c80ef575b36cd35bae8c7fe98fda2a022d3fae373a9605e35d67ea4bd2071e25247c2eddf3657016a264618f5604479050dcabdd4c26a171d518b6a87

Download Submit
C:\Users\Admin\AppData\Roaming\defaultProfilerFilter_smartdata.xml

Filesize
2KB

MD5
0cbc1a64313448ac68d0d9c38a49f970

SHA1
481d84e883ef9b0a0b3e28b81b52b2b4ec6a105b

SHA256
01558af01cd183d126a97308f3ad05d290642601364f892a8d395585d97716b9

SHA512
a0c79a9918fdf338fa32ce8533b907a126ba147c73cfae08b10cc628bb5c6b4a5160626f306f1b6647305ddee48347b335f0b75bd98e899b8f52c905a8e020f0

Download Submit
C:\Users\Admin\Music\# DECRYPT MY FILES #.html

Filesize
19KB

MD5
265ffaa2c716e5ed70af75682cffb7ff

SHA1
54a26a05c7778cac86f03e6a04474f17ce24a121

SHA256
1755ca2d895b6908ec9eb07fcbda5eff7ba51618b243e6152978ceb597dd60ce

SHA512
305ea8d753f637a2d6bbf574101ed81e07710798c0c0cb700c734c84c6c878ce609973e7361264da3cb1aed1fe41cbc07337418f214c87365308f1a598d40bb2

Download Submit
C:\Users\Admin\Music\# DECRYPT MY FILES #.txt

Filesize
10KB

MD5
30ac7becaf03ef35cba5b7003d2ed4b0

SHA1
533506d86210ca26b337214cf1022776a6365108

SHA256
d27cc9902fa19f497587ac5f1caec53337bcc2aa05dca694ae87a6363116cd04

SHA512
1b43235b205b51083b2d0a208ab0e8f33fd5edc5c4fe65e1d0f19ceefebcd8b92162f4a33dfb8950b3d06ee8050a0ecac2d5b2ecff63f019ac7cbd88e6f6f8fc

Download Submit
C:\Users\Admin\Music\# DECRYPT MY FILES #.url

Filesize
90B

MD5
af7572dee9bfd82c21678788fd149df2

SHA1
d99d8849978fd50a5d03c24ae241f4404a6bfba6

SHA256
359fbac7a8d2f2ed943cf58dda6063f86f51f459e23c31b2232724e83c759a67

SHA512
c649f54ed39cad3ffd3458fdb9f2fdac7e614032cf8168d2bb40dc1cbd8738fb31c844c37764cc8e38bae35217e990fe88114d156bf2e2fdecd6a0124425d0ca

Download Submit
C:\Users\Admin\Music\# DECRYPT MY FILES #.vbs

Filesize
252B

MD5
18d46f5d8ebd3c7d6df0c7a8fd1bd64d

SHA1
aeb8407457434aabce2a4c2f95fe305c5303f929

SHA256
ceb35b75d397b07c84dfab3a28189e9431bdf80ec99ab65f9ccf01986bd4a8e9

SHA512
35fc759be0dee77eb9e39350873c24d9693cf6f370f171814e2ce6250ea814fea8a0887442ebae9077d6e9ff81ae7034faa0afcb080401a7d4ac384d2ba42d65

Download Submit
\Users\Admin\AppData\Local\Temp\nsy978F.tmp\System.dll

Filesize
11KB

MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b

SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785

SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

Download Submit
\Users\Admin\AppData\Roaming\DumpLog.dll

Filesize
100KB

MD5
44074cbeffc3e2e64a3f07749b58dd50

SHA1
a7827f6a0362a2e56bfef39967c04901389b23ce

SHA256
da1e9cd26dce1d3e49bbcc6f23b7579a8f9015f72662e4ea3db331ce21654be4

SHA512
12c5a1ba9d32e3222384565d080d7a4eb166cc0c5af5e1ff483e3d6a26c428ae44a05fc5ea98d287a549f041c1eaccc061ce067508a6876064fb8168e63ed37a

Download Submit
\Users\Admin\AppData\Roaming\{E7F19A57-C953-7B64-1413-296E95479BC0}\bootcfg.exe

Filesize
266KB

MD5
ee8bca478d4c26182df5a6aebddb4474

SHA1
bebf16741938ee0e8383c0c33bc2f4baf857a6b8

SHA256
078b158ca33a1eefb800fe63c2eebe8a85b1bf1f0c2099ab2b33a60054beb831

SHA512
c069fb54eaf1ef19b109f6a377f0a8126f592061f9b39092020be3834c9a8a6ee3695c9ea358e69a605243ff269cfaedfcb5c829a8d4c7a3ae5c3b66a16645ec

Download Submit
memory/2004-29-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2004-23-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2004-14-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2004-17-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2004-27-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2004-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2004-21-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2004-19-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2004-16-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2004-30-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2004-44-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2004-31-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2004-34-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2732-66-0x00000000004D0000-0x00000000004EA000-memory.dmp

Filesize
104KB

Download
memory/3016-94-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3016-511-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3016-93-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3016-517-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3016-83-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3016-514-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3016-84-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3016-87-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3016-90-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3016-92-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3016-508-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3056-12-0x00000000026F0000-0x000000000270A000-memory.dmp

Filesize
104KB

Download