Analysis
-
max time kernel
132s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
01-11-2024 05:39
General
-
Target
84255e080413cc079085e8f879be7c66_JaffaCakes118.exe
-
Size
136KB
-
MD5
84255e080413cc079085e8f879be7c66
-
SHA1
4e163a6b5fd450392e1a4a67b67bf43eb0cc80b7
-
SHA256
f10b952d03c6c2ced1d2a0ea27a6572a38227c0c66a0d80be8e7976513270bc6
-
SHA512
3272fe2329622c262765c5c6202030533ef26ccbf90ca42c5299f3816f22cceb631ec9d4fa0b1b6bf06cb9fb410e3e36042ed06d5afe93fea78cdc74a6f31492
-
SSDEEP
3072:+zb+xJSz6iy/eRft8ttGA/Xr3E3GKinU6tIVJ7PiOKx1gwkGXPyK:+zSxonymht4rzKAUfVpiOKxV3
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.xmfhr6.win/6BB2-478D-CFC0-0063-7D5D
http://cerberhhyed5frqa.cmfhty.win/6BB2-478D-CFC0-0063-7D5D
http://cerberhhyed5frqa.dk59jg.win/6BB2-478D-CFC0-0063-7D5D
http://cerberhhyed5frqa.xmfu59.win/6BB2-478D-CFC0-0063-7D5D
http://cerberhhyed5frqa.er48rt.win/6BB2-478D-CFC0-0063-7D5D
http://cerberhhyed5frqa.onion/6BB2-478D-CFC0-0063-7D5D
Extracted
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Cerber family
-
Contacts a large (16390) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 2 IoCs
-
Modifies Control Panel 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 61 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of AdjustPrivilegeToken 47 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\84255e080413cc079085e8f879be7c66_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\84255e080413cc079085e8f879be7c66_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{03DCD65C-9679-444D-F105-BB6BAC813AA4}\bootcfg.exe"C:\Users\Admin\AppData\Roaming\{03DCD65C-9679-444D-F105-BB6BAC813AA4}\bootcfg.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:568 CREDAT:275457 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:568 CREDAT:865281 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "bootcfg.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{03DCD65C-9679-444D-F105-BB6BAC813AA4}\bootcfg.exe" > NUL3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "bootcfg.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "84255e080413cc079085e8f879be7c66_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\84255e080413cc079085e8f879be7c66_JaffaCakes118.exe" > NUL2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "84255e080413cc079085e8f879be7c66_JaffaCakes118.exe"3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD56b38ee38200fc1d846a4c5ff3670e8e1
SHA121a8be3eaae903a7b080777e51fe43a1355044e4
SHA25625ff451c530035024ed0697881377a08f0d8fd99ca105a79da3aae112c91f27c
SHA5125136b7d9f75d5199a35399e4090c6c0533733ac2075575006ddc5d8d931ebc6f13fdd4b9195680bf36831cf4a01df5efe27aefb114c8f9b0c3e0d6614014be73
-
Filesize
10KB
MD50560aa19be08be02faab16523ce86220
SHA155ccea5acd292c32095424a314a94e6e5dcdb4fa
SHA2564afe828060da6bd903cc2aa6957bc96c28da5e2bbaab1c30dbf53e9db61d7bbb
SHA5120b3b9389d83031c1b680c46c6c4557d70230906f5ddf7201d758218295685701969c80d19e083f194b5aca692a2959293ed118cf939a6cb2eccbc7b239151176
-
Filesize
85B
MD5bbccbd287eda1cf957c99039f0976606
SHA1ed38772a762089b107ab6f31f1d339965f93561d
SHA256714a12c8f26e87c608feee818c9f5075d0e7842cb12d62fb4a63e95fc8b3d064
SHA512016a095dcbe83f36ea97a15a6167c65ef6f698e1759cc5e91833864248bd06ba2494861fe9aa2ee922c7843824517b97e1c6ab81bdb7207895594078a8099669
-
Filesize
219B
MD535a3e3b45dcfc1e6c4fd4a160873a0d1
SHA1a0bcc855f2b75d82cbaae3a8710f816956e94b37
SHA2568ad5e0f423ce1ff13f45a79746813f0f1d56993d7f125ab96f3d93fb54bdc934
SHA5126d8e68b969ef67903aff526e983b0fb496678e4c819139e560a11f754a36c4b5770ac2ecf3fc1d9cb5aaa84f80363b4f55553255569503893192911b80d9d853
-
Filesize
342B
MD56440aec337724bf9d11265e298cb88ed
SHA17e5b58f4c5fc16fdc45e88835fbacb2e7eddd08b
SHA25649e43bb539aaac02354063bc7948e8dd25fa2590ac4a889b62a00daeacdbfae8
SHA512566d935316224fd190a4dd63bb813fac8cc1e44b97c9aad2875b8c8157b743ea4fa207ab0edd09cd36932ed4df531ead42782f2dd0f7638469f54fd83083fc59
-
Filesize
342B
MD56a342e9ca986ac9024b9250da5b8c8b6
SHA190e3553c2bed9ad666bde8a3501b49f0d848d315
SHA256cf2e01bd647864816027dbc2e4d75334472bb4e3807b98371d79fcf223ec278c
SHA512a8f4392a559e3b6df1f0da0290cb79075169d621f5ddd790fd17550b6d96acf35b4a6c1615192c25eb25646699bea4edbf61287a94f436cbd9a674e2c4f8361f
-
Filesize
342B
MD55c938f24bc84869abf9347a0a28c8d56
SHA1479c78e60f6171720791d552c25277be83ee2820
SHA256e6f4f64f2c49352f91f5b3d5c2ae588a6d63dc4045bb5c5b2e0f35400db00e37
SHA51207d66f51c3478bb76dbcf90b769493db682baecaa24a223524c87255bf36fd555765d65a7cc4d5033ff85c02b887b98e501356072ab28d772cab5afa3494658f
-
Filesize
342B
MD59533c223fb7b3907500d8dcb98034408
SHA1b6aba6a157206397728e4cf09182a2202435ef77
SHA25676235e3df508d204dc18bcd1237479dfd4a54a275759166ee87d9afe215f9cb1
SHA512dc8fba23390109a277d6fe355364dba9f87bc0adb949f2c3971eedac53bb7c3220ac25400b5d27bf03eb22fc2a8aea306511c3f379af33da5099a52c1d114101
-
Filesize
342B
MD5598e92dea6d88021f58260e77fe4063a
SHA1f453b182873cb1720f5d5e3375265e5bcda7e45c
SHA256aadfc1a0f598b080359515957f6c8eccb2f2641323ca8c2af049c9f2fa683479
SHA512d8e9fb16e85e564973f8fcc48c5c85be4cb6f506bc37dae3ea51752923d4c8cc02e4c36d0d5dd6ae73d0a7fb0af51e1fe7d0210db04670d65763820b10022338
-
Filesize
342B
MD501ebc1c9c783a35546de1022ce52798a
SHA12f44d05c5b2103a315d209b56a03a71b2928925f
SHA2561cc50fd69a37df1d29263d725628b993795a1fbd9b21d62463baa2a73e451374
SHA5123b488b7bdc086ff1690cf5377d9a8071d6941435b5ff8d4accae8edea6841078545087efe916f9db3db4c41a0bf78210b8293caa172609d4b362c3b2be4c9330
-
Filesize
342B
MD5fe8eabd49c597a677f5778d5fa1a5bb8
SHA1128e4b48b432258a92d7d98fb38a1e01e0d6ce02
SHA2564970b8ea39636d02bc331e4bd1066ffef162a1040d16ffea952c555fe4d695fd
SHA512d83c94aae555c7c11cd40b8ed3b15374dfe9ced8d7385b3dc25bd5a1ee2b2af5866996d5ff3dedabd1bc0838def75f195e0c42905f81e11b38bf46162c3362e6
-
Filesize
342B
MD5127b628dbe8be9ca38a03eff99543c2a
SHA177780ddc93323889ec7f429c67d3596418494e0c
SHA256641fd9ef7a9778bc8d51201aea0b3e6ee3400c1686a43b3316c86aaebbdfec2e
SHA51268d539e6ab49e5111c028158c585a5f2574c88cfa516e3aaa226aae0d38980bff6b53d63246db3ffe93c5d06a09c50476daa166791ab468efbe36d3bdb3d9fc9
-
Filesize
342B
MD5957a3b36ef2325e6aadf8a24a551b6fe
SHA1aac9438ffe7dea048cea567b0deedf84b4052d09
SHA256310dea9e805e77fad1bb9f39b7cf22759cf1fb58b914f1b967e0517b0def427c
SHA51256bbd85cace21a6034bfb03fa7bbd11f83456691a17dfa877280e88f40bcb1457a81a77505f7db37f8a643d9873206cbaa11131b1736910190ac5d568adb75e1
-
Filesize
342B
MD53005050106a719588ca09016c325c9dd
SHA1d340efab4059dca20d365502178e833a4fb1555d
SHA256df35768132d37bb346ffe4a0ce11138448dd0910183a3094c041a36f5fb9e190
SHA51248e824fd9a038dca30ee561e9c692ffd7fcde6afc86d104215637c2681734e04116f3e356e9dcca70d099dc0a56e10bd3a394841184387a70423e15831e6639d
-
Filesize
342B
MD5609595e28b46b5a789e766e0da97c957
SHA1968885acb41cf008e3a22707dc4a50ecfe57b590
SHA25610e98ce5b69e2a2dec6570840aed65949cd77fdef8ef5ea1e95524f804cbc24e
SHA512afa5fb078c259c573613ab0ec3f80c477fb317406e073fdbe8476e9aacef64ee8409b55bc9fb01c233b168ebef4b7facde9b67f17d7011f10118d2920578e99a
-
Filesize
342B
MD5f034380411778db9aef25048b9183802
SHA1fc8aa56547913cb9777f4b42697473faee8784b6
SHA256b85d16721fcb4df53b2be391554e1e9724efd274d8db20d5b5a3520a8454917b
SHA51251b94cd3d1625dbe4351faac038b6c5a6d542502f501c3ae6a0ade2e6e780c5acc7f09abae5615bc44501960922019da806099a4e04f3aa14797a008de50c070
-
Filesize
342B
MD5a388b0f6832967e98c7214f3d580e2be
SHA19470ea708d0d7a2abb49a6bcf66fa9982d5bb332
SHA2565ce1006a5f182b84648a5f068ab5280e5e759b2b0ddf355a83714821f54274ad
SHA512e0623095e5ad6e11a691d19039a24e4446ea097ae2e7d2bcaaf41bdf482081723afb76be6b9a231d4e7e0941bd71bd8695cb1a96d1228a97c3ddca6bf8c61003
-
Filesize
342B
MD52b1838a2540797425269040fdddab88d
SHA1147ed390ca88856262f806fe70cf1c5783728104
SHA2564f5e28ca53157b0bd7dfe38dffcfbd47d92216a1e025f8472476685b5a882817
SHA512d49e1f8f14ff1b27f70e3cb29f7b2ca52541de454219bae5c9672747f77ead40277039610d95da06700db95697ee6e97a19a5104eb9c620f9c9a201517c9e71d
-
Filesize
342B
MD5492b18459543cfeb89a1d22ef6a3cca6
SHA18d77c7081d75d094ae3fd104ea2e2e9e01026030
SHA256aadcb3b7149e7d47476da0243b06cbefed9d0ffe69c4ac8fe7c50ab95fa1d331
SHA512b2d1437fba8ed92af47cdcf672e1dd1ae368e3dc950e8ff44c66930a41cb1f5270794729c1f04b58f300920dc78ae269d02212f6aa178bd2fd474c2358801da4
-
Filesize
342B
MD51728d9ed81aeb8b2858143c04abb83d5
SHA174f52bec468df3c643c2b15a0eb09c2eb6c12339
SHA2562c583df4bd4247642376991d5f9f1245142ede8e6e0670f2550463dd33880ed6
SHA51295f3fdb36345b1be7785efddeae59b19147ede8868715434ba16af9f6418df52ec66b59b08af803135691bb237614553d94305c1f7a98747c46cfc3f4f6354eb
-
Filesize
342B
MD5679336c5fb24fdf107d35e5b5d1a73e5
SHA136f54c8e4c4c0af41c94d7aca186b0b6f772c3f4
SHA2561adfc51e272c420ce747bdcd513e31ab39139bcc28353c68bf0359d2e9aef452
SHA512e178f2b712cab616cc4d4a2e933f3a1037ae0d298601576fc1dd65d25156d92c069074536a2b07088e1656f6d42bfd7850f6f10bf725fde803877a510bdc3532
-
Filesize
342B
MD5727ec74d44f827455c66430972161009
SHA1a5737c2d04a94cac0219fefab391f8eaa7ae397f
SHA256d84fca854b81d1f97f5f6827752e0fafcbd950a7cb48428e26200bced0054eb5
SHA51285951bee9f9c875e8238a3cd1e2742b1b29fb0a497663b5a97144992891c63e721cf7054adb78231bc777ef6aa285d89208eac9c672d1ec6ed5c0d217729f885
-
Filesize
5KB
MD54fce1b71807abe56093991041e38330c
SHA1beb6db595c66cf85ea22fe89e30f371458af4fca
SHA256b2c96109a88b0894882356f6fd202adb0eaa92d48d0164389a1e257d82694d9e
SHA512209d124e0c68b2b9eb57d327d2372d68f49928ca9f132f8fa202e310541b909d6eeae7ecce6dcadad7a9f9721e17ef60a15dbd7afd13197d44af06d328a355f6
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD587baec3d2cd7f29c1331b26786d614a8
SHA1dd7675d40b8d2d19636c1dbf692352e69215fc46
SHA2566917ae66ce47b197a79ca544e9b4fc2891749672aca5588885aa3605ceff6810
SHA512aa5656d57e2bf56792209cbdd4ad2c13ca494a5a9eea2f06ccc328dba9c89189c1c48f895806981f8fae6165e0580625108b13b98c29ae80bfb02fac4d385d68
-
Filesize
136KB
MD584255e080413cc079085e8f879be7c66
SHA14e163a6b5fd450392e1a4a67b67bf43eb0cc80b7
SHA256f10b952d03c6c2ced1d2a0ea27a6572a38227c0c66a0d80be8e7976513270bc6
SHA5123272fe2329622c262765c5c6202030533ef26ccbf90ca42c5299f3816f22cceb631ec9d4fa0b1b6bf06cb9fb410e3e36042ed06d5afe93fea78cdc74a6f31492
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
148KB
-
Filesize
148KB