Analysis
-
max time kernel
142s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2024, 02:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe
-
Size
364KB
-
MD5
4affa384ff6ab351df42fc3a02716670
-
SHA1
7bebae1ad50fd27c3df625dc3995256f7d8bb8c2
-
SHA256
4f1e783f68071d95e0b07e1f8b80ed49d0d94a089ae96016b197f846350cfe66
-
SHA512
802616cac860ed2facd74387475e45ecd5a9e00fb106db801cd0168659fcecb9bb0ca6afb4cfeeca592d24d20c07add685e9a65c3178c839d37850a324906070
-
SSDEEP
6144:rHDYm7R++Qhm/FxsB+lIB+0ODLawCi308Ki7B4iTK24D1sr:rHr2mwB+g03S5idVK24Zsr
Malware Config
Extracted
Path
C:\Program Files\7-Zip\Lang\+REcovER+ekeqp+.txt
Ransom Note
{}_~_~+
-$.-_+$|~~_||
=|_$.**+-~|
$+|=*.-=|
!!! IMPORTANT INFORMATION !!!!
All of your files are encrypted with RSA-4096.
More information about the RSA algorythm can be found here:
http://en.wikipedia.org/wiki/RSA_(cryptosystem)
Decrypting of your files is only possible with the private key and decrypt program, which is on our secret server.
To receive your private key follow one of the links:
1. http://88fga.ketteaero.com/E6E1AF4D163F959
2. http://2bdfb.spinakrosa.at/E6E1AF4D163F959
3. http://uj5nj.onanwhit.com/E6E1AF4D163F959
If all of the addresses are not available, follow these steps:
1. Download and install Tor Browser: https://www.torproject.org/download/download-easy.html
2. After a successful installation, run the browser and wait for initialization.
3. Type in the address bar: k7tlx3ghr3m4n2tu.onion/E6E1AF4D163F959
4. Follow the instructions on the site.
!!! Your personal identification ID: E6E1AF4D163F959 !!!
)(*=~_$~+$==-$*~=$$
__$-=-+*
URLs
http://88fga.ketteaero.com/E6E1AF4D163F959
http://2bdfb.spinakrosa.at/E6E1AF4D163F959
http://uj5nj.onanwhit.com/E6E1AF4D163F959
http://k7tlx3ghr3m4n2tu.onion/E6E1AF4D163F959
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation 4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation wtatsy.exe -
Drops startup file 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\+REcovER+ekeqp+.txt wtatsy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\+REcovER+ekeqp+.png wtatsy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\+REcovER+ekeqp+.txt wtatsy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\+REcovER+ekeqp+.png wtatsy.exe -
Executes dropped EXE 2 IoCs
pid Process 2960 wtatsy.exe 2984 wtatsy.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vssjnatlb = "C:\\Windows\\SYSTEM32\\CMD.EXE /C START \"\" \"C:\\Users\\Admin\\Documents\\wtatsy.exe\"" wtatsy.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1620 set thread context of 4704 1620 4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe 95 PID 2960 set thread context of 2984 2960 wtatsy.exe 101 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupSmallTile.scale-100.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-150.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-64.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-60_altform-unplated_contrast-white.png wtatsy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\+REcovER+ekeqp+.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\Icons_Icon_PoP_sm.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Light\Cabinet.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\loc_archives\+REcovER+ekeqp+.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailBadge.scale-400.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailLargeTile.scale-100.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-32_contrast-black.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-24.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\LargeTile.scale-200.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\+REcovER+ekeqp+.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailWideTile.scale-100.png wtatsy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES\+REcovER+ekeqp+.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageMedTile.scale-100_contrast-black.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\skype-to-phones-small.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorSplashScreen.contrast-white_scale-200.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Images\+REcovER+ekeqp+.txt wtatsy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\SystemX86\+REcovER+ekeqp+.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-80_altform-unplated.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeLargeTile.scale-125.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailWideTile.scale-150.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-256_altform-unplated_contrast-black.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-400_contrast-black.png wtatsy.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\+REcovER+ekeqp+.png wtatsy.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn\+REcovER+ekeqp+.txt wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\166.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-150_contrast-black.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.scale-150.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailWideTile.scale-400.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe805.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-48_altform-unplated.png wtatsy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\+REcovER+ekeqp+.txt wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\el-GR\View3d\+REcovER+ekeqp+.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\PeopleWideTile.scale-100.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarMediumTile.scale-100.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\+REcovER+ekeqp+.png wtatsy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt wtatsy.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\+REcovER+ekeqp+.txt wtatsy.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-200.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomSetupDisambig_DeskScale.jpg wtatsy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Office365LogoWLockup.scale-140.png wtatsy.exe File opened for modification C:\Program Files\WindowsPowerShell\Configuration\Registration\+REcovER+ekeqp+.txt wtatsy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\da\+REcovER+ekeqp+.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\LibrarySquare150x150Logo.scale-125_contrast-black.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\+REcovER+ekeqp+.txt wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\3039_20x20x32.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-60.png wtatsy.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.jpg wtatsy.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\+REcovER+ekeqp+.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\StoreLogo\+REcovER+ekeqp+.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\_Resources\+REcovER+ekeqp+.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-40_altform-unplated_contrast-black.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\+REcovER+ekeqp+.txt wtatsy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\AppxMetadata\+REcovER+ekeqp+.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Light.scale-100.png wtatsy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES\+REcovER+ekeqp+.txt wtatsy.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\+REcovER+ekeqp+.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.scale-200_contrast-black.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\dictation\+REcovER+ekeqp+.txt wtatsy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailBadge.scale-150.png wtatsy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-80_altform-unplated.png wtatsy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wtatsy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wtatsy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3480 vssadmin.exe 392 vssadmin.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Axronics wtatsy.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings wtatsy.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe 2984 wtatsy.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2984 wtatsy.exe Token: SeBackupPrivilege 1116 vssvc.exe Token: SeRestorePrivilege 1116 vssvc.exe Token: SeAuditPrivilege 1116 vssvc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1620 wrote to memory of 4704 1620 4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe 95 PID 1620 wrote to memory of 4704 1620 4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe 95 PID 1620 wrote to memory of 4704 1620 4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe 95 PID 1620 wrote to memory of 4704 1620 4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe 95 PID 1620 wrote to memory of 4704 1620 4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe 95 PID 1620 wrote to memory of 4704 1620 4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe 95 PID 1620 wrote to memory of 4704 1620 4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe 95 PID 1620 wrote to memory of 4704 1620 4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe 95 PID 1620 wrote to memory of 4704 1620 4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe 95 PID 1620 wrote to memory of 4704 1620 4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe 95 PID 4704 wrote to memory of 2960 4704 4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe 97 PID 4704 wrote to memory of 2960 4704 4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe 97 PID 4704 wrote to memory of 2960 4704 4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe 97 PID 4704 wrote to memory of 5096 4704 4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe 98 PID 4704 wrote to memory of 5096 4704 4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe 98 PID 4704 wrote to memory of 5096 4704 4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe 98 PID 2960 wrote to memory of 2984 2960 wtatsy.exe 101 PID 2960 wrote to memory of 2984 2960 wtatsy.exe 101 PID 2960 wrote to memory of 2984 2960 wtatsy.exe 101 PID 2960 wrote to memory of 2984 2960 wtatsy.exe 101 PID 2960 wrote to memory of 2984 2960 wtatsy.exe 101 PID 2960 wrote to memory of 2984 2960 wtatsy.exe 101 PID 2960 wrote to memory of 2984 2960 wtatsy.exe 101 PID 2960 wrote to memory of 2984 2960 wtatsy.exe 101 PID 2960 wrote to memory of 2984 2960 wtatsy.exe 101 PID 2960 wrote to memory of 2984 2960 wtatsy.exe 101 PID 2984 wrote to memory of 3480 2984 wtatsy.exe 102 PID 2984 wrote to memory of 3480 2984 wtatsy.exe 102 PID 2984 wrote to memory of 4120 2984 wtatsy.exe 116 PID 2984 wrote to memory of 4120 2984 wtatsy.exe 116 PID 2984 wrote to memory of 4120 2984 wtatsy.exe 116 PID 2984 wrote to memory of 392 2984 wtatsy.exe 117 PID 2984 wrote to memory of 392 2984 wtatsy.exe 117 PID 2984 wrote to memory of 1892 2984 wtatsy.exe 119 PID 2984 wrote to memory of 1892 2984 wtatsy.exe 119 PID 2984 wrote to memory of 1892 2984 wtatsy.exe 119 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wtatsy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" wtatsy.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\Documents\wtatsy.exeC:\Users\Admin\Documents\wtatsy.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\Documents\wtatsy.exeC:\Users\Admin\Documents\wtatsy.exe4⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2984 -
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" Delete Shadows /All /Quiet5⤵
- Interacts with shadow copies
PID:3480
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\+REcovER+ekeqp+.txt5⤵
- System Location Discovery: System Language Discovery
PID:4120
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" Delete Shadows /All /Quiet5⤵
- Interacts with shadow copies
PID:392
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\DOCUME~1\wtatsy.exe >> NUL5⤵
- System Location Discovery: System Language Discovery
PID:1892
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\4AFFA3~1.EXE >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:5096
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1116
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5acd90a6cbe77543b4cf7592d82141e4d
SHA1e978b5c4fe4b8c62860300cfc7001e85c32ca76a
SHA256f4f30aacaf540ba542a055c49bc5c5eef80f0d8a2f455f865b3fdee92efebceb
SHA51212948940d8da1afee482582c2892ddf05904553a388c50c7fe020795a179d3541cc1af1957ec89f1b64d33bb8bb07ddde0ff3c5b287e1b7216af660c45b02c95
-
Filesize
1KB
MD57119a52b4b9489045ee761161e6010f1
SHA1243237a7944315a63eb9ab2237d13ce31cebc96b
SHA2567c6ae46d8979dbc66b84c2aafdef0cd17a83e6c73f682970dcfd6f20aab032ad
SHA512043c2e9b5c621a901b40a15e7cdb4f4d39bfb949e4c5f444950aec5338e66df9f2ecdcbc7edb248bfd0382b6e2eb71328bc9e53e512465ce61fcd67273664b56
-
Filesize
364KB
MD54affa384ff6ab351df42fc3a02716670
SHA17bebae1ad50fd27c3df625dc3995256f7d8bb8c2
SHA2564f1e783f68071d95e0b07e1f8b80ed49d0d94a089ae96016b197f846350cfe66
SHA512802616cac860ed2facd74387475e45ecd5a9e00fb106db801cd0168659fcecb9bb0ca6afb4cfeeca592d24d20c07add685e9a65c3178c839d37850a324906070
