Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-12-2024 23:12
General
-
Target
ed28a3189aefa3589a8602d24d19f1cb_JaffaCakes118.exe
-
Size
226KB
-
MD5
ed28a3189aefa3589a8602d24d19f1cb
-
SHA1
4619f493d165ffc9893f19a32e197b7572497cd2
-
SHA256
52e15e0deb115003af9f56c7f4e66076a4c859b4e8d782e5ad1d29a95b9164bc
-
SHA512
06577460509c754a2850f69ac250132e73e2367995825632cf358cf7dd20f1774cb38a7c2a214209fe74a10ca8bac7fdf3bc84d0447fe77963a926333d3d73de
-
SSDEEP
6144:BQGB/n4ZWOeRzb2RL6nDHoEpgYH79X+9Ac:l4ZADDHofYGAc
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.xmfhr6.win/939D-5CBD-8609-0063-7DA9
http://cerberhhyed5frqa.cmfhty.win/939D-5CBD-8609-0063-7DA9
http://cerberhhyed5frqa.dk59jg.win/939D-5CBD-8609-0063-7DA9
http://cerberhhyed5frqa.xmfu59.win/939D-5CBD-8609-0063-7DA9
http://cerberhhyed5frqa.er48rt.win/939D-5CBD-8609-0063-7DA9
http://cerberhhyed5frqa.onion/939D-5CBD-8609-0063-7DA9
Extracted
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Cerber family
-
Contacts a large (16388) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 6 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
NSIS installer 2 IoCs
-
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 2 IoCs
-
Modifies Control Panel 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 59 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of AdjustPrivilegeToken 51 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed28a3189aefa3589a8602d24d19f1cb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ed28a3189aefa3589a8602d24d19f1cb_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ed28a3189aefa3589a8602d24d19f1cb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ed28a3189aefa3589a8602d24d19f1cb_JaffaCakes118.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{24904338-379E-53D6-B3B4-47BAA50F43E4}\shrpubw.exe"C:\Users\Admin\AppData\Roaming\{24904338-379E-53D6-B3B4-47BAA50F43E4}\shrpubw.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{24904338-379E-53D6-B3B4-47BAA50F43E4}\shrpubw.exe"C:\Users\Admin\AppData\Roaming\{24904338-379E-53D6-B3B4-47BAA50F43E4}\shrpubw.exe"4⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no5⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures5⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:603137 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt5⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"5⤵
-
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "shrpubw.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{24904338-379E-53D6-B3B4-47BAA50F43E4}\shrpubw.exe" > NUL5⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "shrpubw.exe"6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "ed28a3189aefa3589a8602d24d19f1cb_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\ed28a3189aefa3589a8602d24d19f1cb_JaffaCakes118.exe" > NUL3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "ed28a3189aefa3589a8602d24d19f1cb_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2900 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5981⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5768593bafcbe910755fe7f3a2e0476d0
SHA18c468e40c97831f4d2d24d8431379fce5b08ae32
SHA2569a417caaf4ea85faa1cd58a189ad467f0d17db5c6bd8932e26dc58c615b7a19a
SHA5129522c6f2deac126bc5b337f518fb54b24f38054d794fcd6e3b0e621322f73708af9ef8bda801400ffcaec877b44799920b1bd78414dab43ef2453bfb132d10cd
-
Filesize
10KB
MD57e6e73547b060f2a014dbe6fcb5ec668
SHA17be6fb9d7b91eb0b038d66ca128340cd47bc45d9
SHA2566a419cec6da1721c606b80fe651b388bade651f8d78ed15b0acf109afd787f42
SHA512f07d6a86c86c30cabd024c9a266bdac582a3f699a8c345728f22782c0fe94740dc5011e30b4f08d5c1d95425ced92d6e564fc354abd815eab88c4dad9d551a22
-
Filesize
85B
MD5a5066ecae43064ddd8af5c6221e05867
SHA17c726d3bc2e4fba1e825a301e172d4cb597ed83e
SHA2560b3e7237bb75a12133fc8f058b229c4d60ab6e7dafbfa6c5e3a0800ce421cdd8
SHA512676e44c4a34e7c3177c240c7929f5e12bd6db011566a12fd9de8088c095ac1b7bb043e7867ca8d7bc03ea2c763ec0545bcf66d1878a09ca3801e2dd66cfb8a08
-
Filesize
219B
MD535a3e3b45dcfc1e6c4fd4a160873a0d1
SHA1a0bcc855f2b75d82cbaae3a8710f816956e94b37
SHA2568ad5e0f423ce1ff13f45a79746813f0f1d56993d7f125ab96f3d93fb54bdc934
SHA5126d8e68b969ef67903aff526e983b0fb496678e4c819139e560a11f754a36c4b5770ac2ecf3fc1d9cb5aaa84f80363b4f55553255569503893192911b80d9d853
-
Filesize
342B
MD55c0ae236d641cc88d56971837afd5435
SHA11456d10eb273736f4e630e1db9de9df7a1811225
SHA2569a166c5445e461eda86f1af395596cd139a29b49608e64e3bbbdd611eda1570e
SHA512b79f7b06a4711a9194d1327e6de345c002881c05c1cf93b9c6eccdc1d047ed38acf4b2a3529eb81f7bbc10fdca09fc55bf43bd083637ccf32304f8b2e4d3dfb4
-
Filesize
342B
MD5260f2d5dd95d3eb829a3f791af8a4719
SHA12d6d56154912a0f6f80b99e38c5b8b9355c57f53
SHA256c1bfa7c1da734398fd95a54634ec2259bd79f8bf13bef7bb122483466b568bb7
SHA51207f84006e46ea56923c75adc22df92cd307df8476271c11c3caafcd65e27a6d3d8d92a6c1a583b7df2f1afa3a30ccffb737e545166a98944b30fd93c85de1532
-
Filesize
342B
MD5152613fb301bb63c1ca6dd44d929b5a4
SHA1c8885e3cf372b5bc8d344da73343a71fc3bce85f
SHA256b213bbcfbaa8467e9ac611ff4861e5a5480b950e25f0357ebad74b8e4f962067
SHA5123ae43105f276968d9795dbc0329560043f58603c55ec461ed78eea929c566de74f19091477387d6d9626096f5e54a3bec13e67879ab3845d0f469d6c0c6a5438
-
Filesize
342B
MD5b6a822fb474e813b9ad527aeb74f1969
SHA1dff4b9147c14345520b8ce3f9b54d9944d72567c
SHA2567db4abb61da08eff5075de011ffaf9e5d2cd0338ff1e91d257a5eccaa3e658c8
SHA512ae19746a80752f635834cdbcac9f0e0bea47374b7193628fdea4252db2382f8cb934563776451e2d42e336ac2c8e4724654a37fb716590d9b6e962f5496b6690
-
Filesize
342B
MD50ed1f1703b1c8cb07b05130bf9bf7873
SHA1c344629a7038f6f89b4e2bc6846c642d3473d323
SHA25696492bd9527e80e650f26b6701720aa3aa38e2d8048ca341cbb2973896b715ba
SHA512646a47dc065f94ecbde3ad702ca798c80651dd9dd716bba90d00ee2a1dd1fd7808c6df466f0143f70017679ba0eb8c744c1c025ad1c9206f4c2ebb7b210e1c5d
-
Filesize
342B
MD5d7e302d16668e042deadc55d5f7592bf
SHA178118b4f97a2833f1c140ad71c2d900692e32fac
SHA2561fa5f686c966400d7beb83fcc6de00bb0f9890384a5447636cd7e2e0c4aabf41
SHA512e173624ded7807dbd7e817e85588059c4af464b68193ff3b73fb286160f210ae4a16babb1cbc314567c92669d135732b2b638fcdd64a7476fa2cd93abfb6fdfe
-
Filesize
5KB
MD5c5eb6b66977295c1a616cd4801b46b24
SHA17fa7083c58525197044e6816dfa8daab8ec45d42
SHA2568f03831e811b10870b805d1abbb54215a52296d27f4201d5a29085d1b5adc07e
SHA512bee165eb35600c58113273c29f1d37ccbdd1e3242fcd3723cfea4a9e597f6d1d4ce2dcbd76340b2b4102f55adaca5cf447e673c04fe4afda7d58e051657c0c27
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
113KB
MD5164724978a7243bdc20d1ac77eba6418
SHA13fa0cf927cee74db40bda63a8fb51c5ab31c2366
SHA256dab48b011cd01ed12b86d8881ad3cc85913875fea9b17008a33123b40a87da78
SHA51230b09df3d90075402995b92a16d7c5c42d4c0ed8dff95af494aec430011cf07e96941c33a4af42ecf5243f2f878d3351c6f496f0d40e64da1db5f9973b0e4f21
-
Filesize
2KB
MD570c0bfe7c834d097e805787ed2f123a4
SHA1fded0dc703add894b981c6ca64a56b8c67fa1544
SHA25691d313b0cd8e40919b541b43113283d6dde03a7c663917b883a45f09ef7925ca
SHA512b68beb9eed98888bb6aebe2f8fa1642849f5ffc0c7816614615d5ed4f85e6b7c6d73baf10d0bdbaa180aa21275bf5fb3fce490267fa90213e5e5e35b1f001e20
-
Filesize
1KB
MD571d9cfd7071a666eaf2696178bc99fb7
SHA1c7ce822f1c320d9da254b889b77ee5582324e7e7
SHA256eaf1b54e7fd8be768b46d18c7e4b7159d25081e08bafc3813e4cca149add74eb
SHA5128f217b5727ac8bc151caf562cfd02cdb276d0925d459df2a6428a581b7db72461431fbd263652edc1e817a183ac4d26557b01214dacb16e7ca79e98f817057a7
-
Filesize
11KB
MD5883eff06ac96966270731e4e22817e11
SHA1523c87c98236cbc04430e87ec19b977595092ac8
SHA25644e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82
SHA51260333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390
-
Filesize
84KB
MD5f47a66f7cf15f17cc98d4cb4f0b34bc2
SHA1e6ae6734c0acf0beab835f168881c6cfa98ac515
SHA25606df7ee9794cc4db9950e0ea805add4870276a794a8756484a6ccd0a96783aa1
SHA51276afe23aae871ef77e8d03248dee2555d64e3eece66561b453f075d871cd7fa477f3715d1663f3de00c1258e53bf87cf5e955d267884874ae196605a80eea81d
-
Filesize
226KB
MD5ed28a3189aefa3589a8602d24d19f1cb
SHA14619f493d165ffc9893f19a32e197b7572497cd2
SHA25652e15e0deb115003af9f56c7f4e66076a4c859b4e8d782e5ad1d29a95b9164bc
SHA51206577460509c754a2850f69ac250132e73e2367995825632cf358cf7dd20f1774cb38a7c2a214209fe74a10ca8bac7fdf3bc84d0447fe77963a926333d3d73de
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB