cerber | fbdcb15aa69d2b10586e61ed558e55bfb2e5dc44dc5dc3f1cd0eecdf1d8920ca

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe
Size

293KB
MD5

2f3373e966d98b09c7de17ebf02e3e5a
SHA1

90a307047c688dd34e9ee337bb229d6eb693cdb8
SHA256

fbdcb15aa69d2b10586e61ed558e55bfb2e5dc44dc5dc3f1cd0eecdf1d8920ca
SHA512

2ea399966362e572e0e6562ae4fc7631ee56a3dedbcd4537ceeb4ea4005b6d319f5815f4b253d506d39371fea6946aca48b23ce54851c7a085b0731aef412992
SSDEEP

6144:ln/L+Xx9IroJBTRohGirODzHW+/NPpXpcgojiONSI74jOMPtGR:tEx9IsihGiO/zKg2gGQO+i

Score

10^/10

cerber defense_evasion discovery evasion execution impact ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\Users\Admin\Documents\# HELP DECRYPT #.txt

Ransom Note

C_E_R_B_E_R R_A_N_S_O_M_W_A_R_E ######################################################################### Cannot you find the files you need? Is the content of the files that you looked for not readable??? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community "#Cerb3r Ransomware". ######################################################################### !!! If you are reading this message it means the software "Cerber" has !!! been removed from your computer. !!! HTML instruction ("# DECRYPT MY FILES #.html") always contains a !!! working domain of your personal page! ######################################################################### What is encryption? ------------------- Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. ######################################################################### Everything is clear for me but what should I do? ------------------------------------------------ The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !!! Any attempts to return your files with the third-party tools can !!! be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. ######################################################################### !!! There are several plain steps to restore your files but if you do !!! not follow them we will not be able to help you, and we will not try !!! since you have read this warning already. ######################################################################### For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: 1. decrypt all your files; 2. work with your documents; 3. view your photos and other media; 4. continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. ######################################################################### There is a list of temporary addresses to go on your personal page below: _______________________________________________________________________ | | 1. http://52uo5k3t73ypjije.o8hpwj.bid/C542-0487-A54F-0042-F9EC | | 2. http://52uo5k3t73ypjije.n8niwa.bid/C542-0487-A54F-0042-F9EC | | 3. http://52uo5k3t73ypjije.ojesoa.bid/C542-0487-A54F-0042-F9EC | | 4. http://52uo5k3t73ypjije.7j6htz.bid/C542-0487-A54F-0042-F9EC | | 5. http://52uo5k3t73ypjije.onion.to/C542-0487-A54F-0042-F9EC |_______________________________________________________________________ ######################################################################### What should you do with these addresses? ---------------------------------------- If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): 1. take a look at the first address (in this case it is http://52uo5k3t73ypjije.o8hpwj.bid/C542-0487-A54F-0042-F9EC); 2. select it with the mouse cursor holding the left mouse button and moving the cursor to the right; 3. release the left mouse button and press the right one; 4. select "Copy" in the appeared menu; 5. run your Internet browser (if you do not know what it is run the Internet Explorer); 6. move the mouse cursor to the address bar of the browser (this is the place where the site address is written); 7. click the right mouse button in the field where the site address is written; 8. select the button "Insert" in the appeared menu; 9. then you will see the address http://52uo5k3t73ypjije.o8hpwj.bid/C542-0487-A54F-0042-F9EC appeared there; 10. press ENTER; 11. the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: 1. click the left mouse button on the first address (in this case it is http://52uo5k3t73ypjije.o8hpwj.bid/C542-0487-A54F-0042-F9EC); 2. in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. ######################################################################### Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: 1. run your Internet browser (if you do not know what it is run the Internet Explorer); 2. enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; 3. wait for the site loading; 4. on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; 5. run Tor Browser; 6. connect with the button "Connect" (if you use the English version); 7. a normal Internet browser window will be opened after the initialization; 8. type or copy the address ________________________________________________________ | | | http://52uo5k3t73ypjije.onion/C542-0487-A54F-0042-F9EC | |________________________________________________________| in this browser address bar; 9. press ENTER; 10. the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. ######################################################################### Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. ######################################################################### Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. ######################################################################### If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. ######################################################################### Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.

URLs

http://52uo5k3t73ypjije.o8hpwj.bid/C542-0487-A54F-0042-F9EC

http://52uo5k3t73ypjije.n8niwa.bid/C542-0487-A54F-0042-F9EC

http://52uo5k3t73ypjije.ojesoa.bid/C542-0487-A54F-0042-F9EC

http://52uo5k3t73ypjije.7j6htz.bid/C542-0487-A54F-0042-F9EC

http://52uo5k3t73ypjije.onion.to/C542-0487-A54F-0042-F9EC

http://52uo5k3t73ypjije.onion/C542-0487-A54F-0042-F9EC

Extracted

Path

C:\Users\Admin\Documents\# HELP DECRYPT #.html

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Cerber Ransomware</title> <style> a { color: #47c; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #333; font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; } hr { background-color: #e7e7e7; border: 0 none; border-bottom: 1px solid #c7c7c7; height: 5px; margin: 30px 0; } li { padding: 0 0 7px 7px; } ol { padding-left: 3em; } .container { background-color: #fff; border: 1px solid #c7c7c7; margin: 40px; padding: 40px 40px 20px 40px; } .info, .tor { background-color: #efe; border: 1px solid #bda; display: block; padding: 0px 20px; } .logo { font-size: 12px; font-weight: bold; line-height: 1; margin: 0; } .upd_on { color: red; display: block; } .upd_off { display: none; float: left; } .tor { padding: 10px 0; text-align: center; } .url { margin-right: 5px; } .warning { background-color: #f5e7e7; border: 1px solid #ebccd1; color: #a44; display: block; padding: 15px 10px; text-align: center; } </style> </head> <body> <div class="container"> <h3>C E R B E R   R A N S O M W A R E</h3> <hr> Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community "#C3rber Ransomware". <hr> If you are reading this message it means the software "Cerber" has been removed from your computer. <hr> <h3>What is encryption?</h3> Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. <hr> <h3>Everything is clear for me but what should I do?</h3> The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !Any attempts to get back your files with the third-party tools can be fatal for your encrypted files! The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files! When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. <hr> There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already. <hr> For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: <ol> <li>decrypt all your files;</li> <li>work with your documents;</li> <li>view your photos and other media;</li> <li>continue your usual and comfortable work at the computer.</li> </ol> If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. <hr> <div class="info"> There is a list of temporary addresses to go on your personal page below: <ol> <li>Please wait...<a class="url" href="http://52uo5k3t73ypjije.o8hpwj.bid/C542-0487-A54F-0042-F9EC" id="url_1" target="_blank">http://52uo5k3t73ypjije.o8hpwj.bid/C542-0487-A54F-0042-F9EC</a>(<a href="#updateUrl" onClick="return updateUrl();" style="color: red;">Get a NEW address!</a>)</li> <li><a href="http://52uo5k3t73ypjije.n8niwa.bid/C542-0487-A54F-0042-F9EC" target="_blank">http://52uo5k3t73ypjije.n8niwa.bid/C542-0487-A54F-0042-F9EC</a></li> <li><a href="http://52uo5k3t73ypjije.ojesoa.bid/C542-0487-A54F-0042-F9EC" target="_blank">http://52uo5k3t73ypjije.ojesoa.bid/C542-0487-A54F-0042-F9EC</a></li> <li><a href="http://52uo5k3t73ypjije.7j6htz.bid/C542-0487-A54F-0042-F9EC" target="_blank">http://52uo5k3t73ypjije.7j6htz.bid/C542-0487-A54F-0042-F9EC</a></li> <li><a href="http://52uo5k3t73ypjije.onion.to/C542-0487-A54F-0042-F9EC" target="_blank">http://52uo5k3t73ypjije.onion.to/C542-0487-A54F-0042-F9EC</a></li> </ol> </div> <hr> <h3>What should you do with these addresses?</h3> If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): <ol> <li>take a look at the first address (in this case it is Please wait...<a class="url" href="http://52uo5k3t73ypjije.o8hpwj.bid/C542-0487-A54F-0042-F9EC" id="url_2" target="_blank">http://52uo5k3t73ypjije.o8hpwj.bid/C542-0487-A54F-0042-F9EC</a>);</li> <li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li> <li>release the left mouse button and press the right one;</li> <li>select "Copy" in the appeared menu;</li> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li> <li>click the right mouse button in the field where the site address is written;</li> <li>select the button "Insert" in the appeared menu;</li> <li>then you will see the address Please wait...<a class="url" href="http://52uo5k3t73ypjije.o8hpwj.bid/C542-0487-A54F-0042-F9EC" id="url_3" target="_blank">http://52uo5k3t73ypjije.o8hpwj.bid/C542-0487-A54F-0042-F9EC</a> appeared there;</li> <li>press ENTER;</li> <li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: <ol> <li>click the left mouse button on the first address (in this case it is Please wait...<a class="url" href="http://52uo5k3t73ypjije.o8hpwj.bid/C542-0487-A54F-0042-F9EC" id="url_4" target="_blank">http://52uo5k3t73ypjije.o8hpwj.bid/C542-0487-A54F-0042-F9EC</a>);</li> <li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet. <hr> Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address http://52uo5k3t73ypjije.onion/C542-0487-A54F-0042-F9EC in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. <hr> <h3>Additional information:</h3> You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. <hr> Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. <hr> If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. <hr> Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files. </div> <script> function getXMLHttpRequest() { if (window.XMLHttpRequest) { return new window.XMLHttpRequest; } else { try { return new ActiveXObject("MSXML2.XMLHTTP.3.0"); } catch(error) { return null; } } } function getUrlContent(url, callback) { var xhttp = getXMLHttpRequest(); if (xhttp) { xhttp.onreadystatechange = function() { if (xhttp.readyState == 4) { if (xhttp.status == 200) { return callback(xhttp.responseText.replace(/[\s ]+/gm, ""), null); } else { return callback(null, true); } } }; xhttp.open("GET", url + '?_=' + new Date().getTime(), true); xhttp.send(); } else { return callback(null, true); } } function server1(address, callback) { getUrlContent("http://btc.blockr.io/api/v1/address/txs/" + address, function(result, error) { if (!error) { var tx = /"tx":"([\w]+)","time_utc":"[\w-:]+","confirmations":[\d]+,"amount":-/.exec(result); if (tx) { getUrlContent("http://btc.blockr.io/api/v1/tx/info/" + tx[1], function(result, error) { if (!error) { var address = /"vouts":\[{"address":"([\w]+)"/.exec(result); if (address) { return callback(address[1], null); } else { return callback(null, true); } } else { return callback(null, true); } }); } else { return callback(null, true); } } else { return callback(null, true); } }); } function server2(address, callback) { getUrlContent("http://api.blockcypher.com/v1/btc/main/addrs/" + address, function(result, error) { if (!error) { var tx = /"tx_hash":"([\w]+)","block_height":[\d]+,"tx_input_n":[\d-]+,"tx_output_n":-/.exec(result); if (tx) { getUrlContent("http://api.blockcypher.com/v1/btc/main/txs/" + tx[1], function(result, error) { if (!error) { var address = /"outputs":\[{"value":[\d]+,"script":"[\w]+","spent_by":"[\w]+","addresses":\["([\w]+)"/.exec(result); if (address) { return callback(address[1], null); } else { return callback(null, true); } } else { return callback(null, true); } }); } else { return callback(null, true); } } else { return callback(null, true);

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Contacts a large (522) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Deletes itself 1 IoCs

pid	Process
2628	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
2380	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe
2380	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpB358.bmp"	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2380 set thread context of 2732	2380	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	29

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# HELP DECRYPT #.html	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# HELP DECRYPT #.txt	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# HELP DECRYPT #.url	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2268	PING.EXE

Kills process with taskkill 1 IoCs

evasion

pid	Process
224	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 59 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0297F31-8691-11EF-B856-666B6675A85F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000000e07f3a3d4d21907870b0d8944e8f4d2f51c34c24edcc1d5d3fb7d089d1323b5000000000e80000000020000200000003556d8f3a7cc5268291fb4ec0fca927a837c0397ef7b01fddacd7fcf239c4fc2200000009ed9ba398fb310aff07b93cc70c93f018654bd80cdb2e36e455df5d3183c067a40000000af2d383c5bb08dd7d278b403ede13c05843e8c3715e03e2f60b01cb93a37d17925f249d0f0896c6401a46211d740f5899064251098f54413e7ffca07764e2a62	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0fdfab29e1adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F037C771-8691-11EF-B856-666B6675A85F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000ce8bbf86ec84f16d18dcf331ea9db961446e6ac7af69bbcbe74028ab3a922a89000000000e800000000200002000000046eb266ee31e1c05a3b29da24a132a53ebc693ce4cd49efb94669b85cf02dba490000000e28c91d48ddf1d57dd8ed3155db3c0e23c2dbc9541369ffbef930408cd5f51346a999f2e967300a543bc9dabb349f8a4d1198dfcc5dd8f26cbdab83f3885d6f326bdff573f5363b5aff0076d60083c447ccacf9ea0a3d2f316ca9c631414d283f75c526d004a41a03bbbf8a502ad081da5d6b63e43f58f3e88af2f141bc5901fe1ca81d17debd052a129e9c4432c3d264000000080fd5d3b400ae169cf7f4a25490cd61f16e1036cce2a0c4e1d4b0588ae56c45a28fccb519f635701e2feeba3019b02d4e875fd83f0a265e47264404e456e277d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2268	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2732	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe
2732	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe
2732	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe
2732	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2136	WMIC.exe
Token: SeSecurityPrivilege	2136	WMIC.exe
Token: SeTakeOwnershipPrivilege	2136	WMIC.exe
Token: SeLoadDriverPrivilege	2136	WMIC.exe
Token: SeSystemProfilePrivilege	2136	WMIC.exe
Token: SeSystemtimePrivilege	2136	WMIC.exe
Token: SeProfSingleProcessPrivilege	2136	WMIC.exe
Token: SeIncBasePriorityPrivilege	2136	WMIC.exe
Token: SeCreatePagefilePrivilege	2136	WMIC.exe
Token: SeBackupPrivilege	2136	WMIC.exe
Token: SeRestorePrivilege	2136	WMIC.exe
Token: SeShutdownPrivilege	2136	WMIC.exe
Token: SeDebugPrivilege	2136	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2136	WMIC.exe
Token: SeRemoteShutdownPrivilege	2136	WMIC.exe
Token: SeUndockPrivilege	2136	WMIC.exe
Token: SeManageVolumePrivilege	2136	WMIC.exe
Token: 33	2136	WMIC.exe
Token: 34	2136	WMIC.exe
Token: 35	2136	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2136	WMIC.exe
Token: SeSecurityPrivilege	2136	WMIC.exe
Token: SeTakeOwnershipPrivilege	2136	WMIC.exe
Token: SeLoadDriverPrivilege	2136	WMIC.exe
Token: SeSystemProfilePrivilege	2136	WMIC.exe
Token: SeSystemtimePrivilege	2136	WMIC.exe
Token: SeProfSingleProcessPrivilege	2136	WMIC.exe
Token: SeIncBasePriorityPrivilege	2136	WMIC.exe
Token: SeCreatePagefilePrivilege	2136	WMIC.exe
Token: SeBackupPrivilege	2136	WMIC.exe
Token: SeRestorePrivilege	2136	WMIC.exe
Token: SeShutdownPrivilege	2136	WMIC.exe
Token: SeDebugPrivilege	2136	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2136	WMIC.exe
Token: SeRemoteShutdownPrivilege	2136	WMIC.exe
Token: SeUndockPrivilege	2136	WMIC.exe
Token: SeManageVolumePrivilege	2136	WMIC.exe
Token: 33	2136	WMIC.exe
Token: 34	2136	WMIC.exe
Token: 35	2136	WMIC.exe
Token: SeBackupPrivilege	2688	vssvc.exe
Token: SeRestorePrivilege	2688	vssvc.exe
Token: SeAuditPrivilege	2688	vssvc.exe
Token: 33	2168	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2168	AUDIODG.EXE
Token: 33	2168	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2168	AUDIODG.EXE
Token: SeDebugPrivilege	224	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1716	iexplore.exe
112	iexplore.exe
112	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
112	iexplore.exe
112	iexplore.exe
1716	iexplore.exe
1716	iexplore.exe
112	iexplore.exe
112	iexplore.exe
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE
604	IEXPLORE.EXE
604	IEXPLORE.EXE
1740	IEXPLORE.EXE
1740	IEXPLORE.EXE
1740	IEXPLORE.EXE
1740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2732	2380	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	29
PID 2380 wrote to memory of 2732	2380	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	29
PID 2380 wrote to memory of 2732	2380	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	29
PID 2380 wrote to memory of 2732	2380	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	29
PID 2380 wrote to memory of 2732	2380	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	29
PID 2380 wrote to memory of 2732	2380	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	29
PID 2380 wrote to memory of 2732	2380	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	29
PID 2380 wrote to memory of 2732	2380	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	29
PID 2380 wrote to memory of 2732	2380	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	29
PID 2380 wrote to memory of 2732	2380	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	29
PID 2380 wrote to memory of 2732	2380	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	29
PID 2732 wrote to memory of 2756	2732	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	30
PID 2732 wrote to memory of 2756	2732	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	30
PID 2732 wrote to memory of 2756	2732	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	30
PID 2732 wrote to memory of 2756	2732	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	30
PID 2756 wrote to memory of 2136	2756	cmd.exe	32
PID 2756 wrote to memory of 2136	2756	cmd.exe	32
PID 2756 wrote to memory of 2136	2756	cmd.exe	32
PID 2732 wrote to memory of 112	2732	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	39
PID 2732 wrote to memory of 112	2732	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	39
PID 2732 wrote to memory of 112	2732	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	39
PID 2732 wrote to memory of 112	2732	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	39
PID 2732 wrote to memory of 2360	2732	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	40
PID 2732 wrote to memory of 2360	2732	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	40
PID 2732 wrote to memory of 2360	2732	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	40
PID 2732 wrote to memory of 2360	2732	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	40
PID 112 wrote to memory of 1688	112	iexplore.exe	42
PID 112 wrote to memory of 1688	112	iexplore.exe	42
PID 112 wrote to memory of 1688	112	iexplore.exe	42
PID 112 wrote to memory of 1688	112	iexplore.exe	42
PID 1716 wrote to memory of 604	1716	iexplore.exe	43
PID 1716 wrote to memory of 604	1716	iexplore.exe	43
PID 1716 wrote to memory of 604	1716	iexplore.exe	43
PID 1716 wrote to memory of 604	1716	iexplore.exe	43
PID 112 wrote to memory of 1740	112	iexplore.exe	44
PID 112 wrote to memory of 1740	112	iexplore.exe	44
PID 112 wrote to memory of 1740	112	iexplore.exe	44
PID 112 wrote to memory of 1740	112	iexplore.exe	44
PID 2732 wrote to memory of 2628	2732	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	45
PID 2732 wrote to memory of 2628	2732	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	45
PID 2732 wrote to memory of 2628	2732	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	45
PID 2732 wrote to memory of 2628	2732	2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe	45
PID 2628 wrote to memory of 224	2628	cmd.exe	47
PID 2628 wrote to memory of 224	2628	cmd.exe	47
PID 2628 wrote to memory of 224	2628	cmd.exe	47
PID 2628 wrote to memory of 2268	2628	cmd.exe	48
PID 2628 wrote to memory of 2268	2628	cmd.exe	48
PID 2628 wrote to memory of 2268	2628	cmd.exe	48

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe"
  2⤵
  - Checks whether UAC is enabled
  - Sets desktop wallpaper using registry
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2136
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# HELP DECRYPT #.html
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:112
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:112 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1688
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:112 CREDAT:406530 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1740
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# HELP DECRYPT #.txt
    3⤵
    PID:2360
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "2f3373e966d98b09c7de17ebf02e3e5a_JaffaCakes118.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:224
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2268

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
- System Location Discovery: System Language Discovery
PID:2056

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x548
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2168

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0254f3e6a9e6d998871cd1a99f7bab4a

SHA1
0b6cb3d8d8b14d2d9603efc8e75480f1f4c6a9c3

SHA256
5fbb3d7b67528b65a118d2140003337e9647ca66260e819b968739c5b70c3b24

SHA512
aa9e50b30024c39c474967c71cdd79eaba71708ad39fbdf7d9edcf134dd972d940ba022ca80da61092c2bdd46e3d73abfa63416cbef368cc2328889de27a85fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63c9ccb39a44b0b4c512f3e0a986fa37

SHA1
bd95cd0dec42a2c6704a1f60557cdcbe071ec6bf

SHA256
434f45f0a72518a683091c12a69fb1c348bc5ebd72074d89c76a24025f057298

SHA512
95d430f2d5d9aab63e82e35fe1bfbe73bca940f1cf2ed710ec72e49c9cfd43e986e87e25a917d62f4c08d176741091bdfba13606b3740487951b10d9b7da8771

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea87e97f0975a02ae6a98d119c85b236

SHA1
80fa9981291a3f93b0e77b5727cae23fc0a51b53

SHA256
b9ace45a16a47d04ed250ad80c1168f99197d105e552e5a3f328cde6f46e6203

SHA512
70223e7d9e3f22dc5f34637aa95295579aa2468d6bebd956526489b45a5a5fdad68924c21d2429b980cfbc76539649d155c35181677fc2d3b94191517f15d6c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9da555add718d868e6886d9da2c9f76

SHA1
73cab2e4765517f89bb49c0d7d5143c7b155e35a

SHA256
268ac103a0b7de84076d2db5271bda9aebc3869f7087ae213c293a943eba9baa

SHA512
a8e09d498bb17ae67d2dee32afb2a15862b46f63c6adb398912b4fa68a2150bc1749021fac78f2dc062064187ca39e3b45237e8a31031fa89e7d13d7f269174d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcb05fdfabafd2e13954b66d0524c66f

SHA1
4b670f03df4853b69644fe8bee99f6421920f9ca

SHA256
113fe04f59978e68b01ceb78a7b7fd075182c1affced7309f39d89273cddf886

SHA512
f5f0faa198f86258ea12c2f733e2538da770e5114af63c09e58fa6c419b621cde7af6f1a9fc082b787c6a7935b35193fd53c718bbef0fb7dc8baba6fcdf66728

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
669cc80ef1bd6c97bfbb1d218c404707

SHA1
ccade7112a8e90e987cded50506981dd46d2584b

SHA256
b4abee7a5d67250c5d9ce4b15af96f4409c28a30256a3963e49a4fade15efc60

SHA512
7162f3d1902c91c569de88f49edb1fb792b5bc5cdfa8edd2768e8ff262676cbfd163da11c0dc257498603e5971ded5c634e945d19ad4bbc4dcda5b1cff4d709b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e1983c4fef1ae470e7abea8ff086900

SHA1
b3df732528b7866a9e456d4e664ce38f46cf1500

SHA256
f16d38a906c797bba1d052e2c7e2fc12db72d95f04bb9babc83b9e5ab64a1901

SHA512
affac418efa2c2597d1059b7f241e994c31452c873fa855e1d38d49c53fc2475e34d822b25aba1ad7ebc1d8b2f981a8ae9bf149b76eb5114a613b79a62e51df4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef99354d2a93cfac964b374145dd95d6

SHA1
ba069c99a3ebd65c409cdfca4370e70a9c778dfd

SHA256
8cb0a810c2531c2286d488bf1135a00dcbfe9f63a766ce6e5daad09aad99f764

SHA512
81563653542f8d2d308902ec318abf2cb603f2aff08f07a8b8efa2143a5045d950a010ca07419f96bbe336b3bd1a1eeeb614e2249c7941ba5156f7bfe3e7c569

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95663d70130b46d8fa6e205e237453d2

SHA1
cba4c8812e35a2151e6388509689183efaaf9a4f

SHA256
e6a365488e387860c69182dd60fa9f4c3a343afbc431957043ba0609c4fbdff2

SHA512
a64d9cb9cff417723a4ecced5e00750738f46b7156865c9c8e5e3c969cb39b01d556f9c53ac09946c087234e4cec158a3769159e447ffc840863c683ecf7af17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8c80b07eaf431071aaf00cbd8567845

SHA1
0ecb9212576469d2128347f8f88d395f73f5d61e

SHA256
d584ee18f8c70e605134d8c0fedb8b5fa613f522283e41d89c275af16dddfc5a

SHA512
b14d65daf61268938ac57f6d60d91fee5cdc44f000f428b39eb21aeb976cc2549e9c6df38e6661d714022c755f6e51add5ac5ed9a91590067c0c5158a330bf96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1c5ad2b0db2508317229271b2a26d73

SHA1
fc5b15625aeb3a2e9ed9805211a2a43379a7baba

SHA256
ee64af78cc6609d29af6999c8fcf54971b9286cb5d9ff9cf141352fc445ce3c5

SHA512
1365c1d9de696d8f80b6694ca168cd04a6803c6384abadd4040d768a19139cd516b051a4b222bb8f03bffe5ebaa62614c08b5820469199b5d88dfbd9514c7308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F0297F31-8691-11EF-B856-666B6675A85F}.dat

Filesize
5KB

MD5
d101233a69255b39924b94ed56d29901

SHA1
2772df7902e09ee7a0cccabde96a844ea5edbda2

SHA256
e2e44aa7dfa7726c6882689de53dff4b159da7e15d4992687728ea57476191cb

SHA512
44ee2368ae90aa76ea1a5b983c1a19ccbad005dc49a64e54ecda1f4f55db5a60cf0ff188a3c5746fc565730de659ba9f6ac07034e2319533d41faa2bef738632

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4B17.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4B78.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\CTOCWidget.js

Filesize
5KB

MD5
1fd1316acfa2c03772082589ba52af8c

SHA1
66111e88d34d105a941cf4c178e3f22a4bf4bc5c

SHA256
3b4bd1f38888053533d19f9993db1f39386a9b51d14cce08fdce42c0dd719d53

SHA512
1940190e5ad0252ecc70e56924ca88e2dd19c41385f779f797c5023a62dfd8a6a90ac534cd52127c949e9ada282c2e37e9c5575a74f5218a7a6098201a2c34c4

Download Submit
C:\Users\Admin\AppData\Roaming\color_mngmt.png

Filesize
2KB

MD5
a253e59427f7f76ae99bda53f827adbc

SHA1
15ff08908dd0fc28b165302b773d8ad81ab3e5c8

SHA256
52a3be226a347763750dbd5813e994d38a0a0672176b7d44a1cc8d7cdadaa5ad

SHA512
12e4d61e8fc19aefee2385708424046beed961a4b0ded0aadd0d1c5fe68a9ffa54547b7aa99b4dbb4abeea022742ab35f366a871340cc7056120c225bab2b930

Download Submit
C:\Users\Admin\AppData\Roaming\computer_server_stack.png

Filesize
2KB

MD5
72a57432fb03b3ebb42a75670b165554

SHA1
18c6015c447d6043ea535c6709983087903d5673

SHA256
bcbe2c2a9adc284bc60c2b4753d008e399a436199dc2567b4a3489c47e014b62

SHA512
ba1a1b2c4b2c7535f379c26d5fa87785df957865075272f49c5abd9c5853c353576cac5483bcba4fa4b2ad6a39d29d252785e786bdc15411b98ca2a4f316381d

Download Submit
C:\Users\Admin\AppData\Roaming\error-2.png

Filesize
5KB

MD5
03a3af8a91ccb635179a8d04468086ea

SHA1
1b1de33660db2d178b74a59ce4f094cb2bcbb0ab

SHA256
e823a804f0ead0b63aa81841a80774fd1910d46c4ab806a6617e658e95e9c99d

SHA512
ff33eecada32f366e79e0e3712aaaf0560a09f64df6bdd9fcbad1352beffcfa1a46f43c21a663f313d9e9e51ba040db0d07d47c0d5d1e0652695ec74eec53aac

Download Submit
C:\Users\Admin\Documents\# HELP DECRYPT #.html

Filesize
19KB

MD5
363b990bc0a80e3720dfa6533d9226b5

SHA1
7b16f9a953efee3bc691b969eeb73e61c56b5ac5

SHA256
2437548ca12a78f61943629a8ccc0042bc655133c6ac435afbb153bbb8aa944a

SHA512
5504694263a1a6f9d3d35e085345087378750f563a49efb85dc19265e79b229d637c587a315dcd545cf4808ebe7631814ff5e98870ff7d999cf396a16939692f

Download Submit
C:\Users\Admin\Documents\# HELP DECRYPT #.txt

Filesize
10KB

MD5
7f173932d17d8fa01e9c8519c1d0a02c

SHA1
ae83c127481b5b6c50dd6adf2f5419f9d04b9f78

SHA256
c01879445a69fb5e6d98623493114a6381a4788b9418b60ae895871feb8f6719

SHA512
0037e533e073fd1e7a9600049be2efbc6cd58ca923e1f0c45f61e4c2c740d66977da540a532f35f06de2f818f93b797f288930e31cbe7f55a75a7b8761f98350

Download Submit
C:\Users\Admin\Documents\# HELP DECRYPT #.url

Filesize
90B

MD5
68d6615025cbbdea584a18b933a59822

SHA1
d1356f862bbb1da50e0fe7b312208f0f14bf1104

SHA256
5ab15d128a2c2bc898363c7ea5f904c96de56c57b7eed0e3cf3004e307835e0c

SHA512
ade7a426c67e40829314645e584d3e06194f8f586933dc4734c09c52cb36c7908181a077c32934a46ec838907121f3cd0e122c68a7e7b0708e0fd00b72a8da44

Download Submit
\Users\Admin\AppData\Local\Temp\nseF43F.tmp\System.dll

Filesize
11KB

MD5
a436db0c473a087eb61ff5c53c34ba27

SHA1
65ea67e424e75f5065132b539c8b2eda88aa0506

SHA256
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

SHA512
908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

Download Submit
\Users\Admin\AppData\Roaming\DumpLog.dll

Filesize
14KB

MD5
68034fc27e1c9f1cb2b6a6f60eefd893

SHA1
2ed61813ff32d7faa818ef7d9b3b18c9d3829541

SHA256
dd5f2a15d20726016da804082c1d767b0d0404e9292cf211336746bbb67109b0

SHA512
93753329f3680dca4045b9abd251f7ecd978e7b831e8fced3d75deb3de7c65c6b841824f6a7c6810e604ae3dab3dc5f7eca026c46cbbba47998b507aa1f29f6b

Download Submit
memory/2732-382-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-418-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-41-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-42-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-49-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-376-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-379-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-38-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-385-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-388-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-391-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-394-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-397-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-400-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-403-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-406-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-409-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-412-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-415-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-53-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-421-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-427-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-40-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-441-0x0000000003E60000-0x0000000003E62000-memory.dmp

Filesize
8KB

Download
memory/2732-446-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-443-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-35-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-33-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-31-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-32-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-30-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-16-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-18-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-22-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-24-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2732-28-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-20-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2732-14-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download