Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-10-2024 15:38
Static task
static1
Behavioral task
behavioral1
Sample
6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe
-
Size
121KB
-
MD5
6fae4aed182cb0df0ed705acadee2fde
-
SHA1
4c212e5fc88686aa55a1e81f502950bdf89debfa
-
SHA256
a3003d38cb630a05180f512e9195af0148770caee1f45d340f99e79f45b9302c
-
SHA512
e39f3c279c05fbdc57828807e8de36307a685919b35f716011feb926d431f22233b34c0d8b8dcf551db07bc51bffb068bef76f1034c3e50155e6c16f987d44d7
-
SSDEEP
1536:nKAzN+LNdXRZ/65HY7zbbkGSQSuGFeUPNFR/1lykJ/qSwGlrNfHuoTNoM3dfv:3+1z/614bP2uEn1lyk12GlrNGjM3dfv
Malware Config
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 1 IoCs
Processes:
explorer.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2fddd325.exe explorer.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\2fddd325 = "C:\\Users\\Admin\\AppData\\Roaming\\2fddd325.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*fddd325 = "C:\\Users\\Admin\\AppData\\Roaming\\2fddd325.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\2fddd32 = "C:\\2fddd325\\2fddd325.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*fddd32 = "C:\\2fddd325\\2fddd325.exe" explorer.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ip-addr.es 6 myexternalip.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exedescription pid process target process PID 1076 set thread context of 2380 1076 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exeexplorer.exesvchost.exevssadmin.exe6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2756 vssadmin.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exeexplorer.exepid process 2380 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe 1792 explorer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2620 vssvc.exe Token: SeRestorePrivilege 2620 vssvc.exe Token: SeAuditPrivilege 2620 vssvc.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exeexplorer.exedescription pid process target process PID 1076 wrote to memory of 2380 1076 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe PID 1076 wrote to memory of 2380 1076 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe PID 1076 wrote to memory of 2380 1076 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe PID 1076 wrote to memory of 2380 1076 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe PID 1076 wrote to memory of 2380 1076 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe PID 1076 wrote to memory of 2380 1076 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe PID 1076 wrote to memory of 2380 1076 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe PID 1076 wrote to memory of 2380 1076 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe PID 1076 wrote to memory of 2380 1076 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe PID 1076 wrote to memory of 2380 1076 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe PID 1076 wrote to memory of 2380 1076 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe PID 2380 wrote to memory of 1792 2380 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe explorer.exe PID 2380 wrote to memory of 1792 2380 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe explorer.exe PID 2380 wrote to memory of 1792 2380 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe explorer.exe PID 2380 wrote to memory of 1792 2380 6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe explorer.exe PID 1792 wrote to memory of 1908 1792 explorer.exe svchost.exe PID 1792 wrote to memory of 1908 1792 explorer.exe svchost.exe PID 1792 wrote to memory of 1908 1792 explorer.exe svchost.exe PID 1792 wrote to memory of 1908 1792 explorer.exe svchost.exe PID 1792 wrote to memory of 2756 1792 explorer.exe vssadmin.exe PID 1792 wrote to memory of 2756 1792 explorer.exe vssadmin.exe PID 1792 wrote to memory of 2756 1792 explorer.exe vssadmin.exe PID 1792 wrote to memory of 2756 1792 explorer.exe vssadmin.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6fae4aed182cb0df0ed705acadee2fde_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\syswow64\explorer.exe"C:\Windows\syswow64\explorer.exe"3⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\syswow64\svchost.exe-k netsvcs4⤵
- System Location Discovery: System Language Discovery
PID:1908 -
C:\Windows\syswow64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:2756
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2620