Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 06:28
Behavioral task
behavioral1
Sample
JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe
-
Size
1.6MB
-
MD5
3f5808852f9a24162404b4fcff319a3f
-
SHA1
36b17224dc6008e7967cd55fcb3e673b4182f8dc
-
SHA256
7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837
-
SHA512
4e2563fef4e21de42ce192901198cc3bc9ccb95f9b6dcdeed49ba33c1c975b9a95e91aecd100b9bb9d53d9b6a7dbfebc9bb4b67923c5383c290fca8395d4e3f0
-
SSDEEP
24576:yIUuDpLjyfIY1RUqIIttF7T4KVvojxqk0+/2IaU/VsGRRkKKQBsxG0RkpXA:yIUuDdjJInttFh2wALTFBEgA
Malware Config
Extracted
C:\Users\Default\vk8j9i-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6A50A7E162ED6530
http://decryptor.top/6A50A7E162ED6530
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Renames multiple (148) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\N: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\S: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\U: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\I: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\J: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\M: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\V: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\G: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\H: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\P: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\W: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\Y: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\Z: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\K: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\O: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\E: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\Q: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\R: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\T: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\X: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\D: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\A: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\B: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened (read-only) \??\F: JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\97x.bmp" JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-profapi-onecore_31bf3856ad364e35_10.0.19041.1_none_bc0d9057164c1e84.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1_fr-fr_4b74ad1a70a9c6a5.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..ient-core.resources_31bf3856ad364e35_10.0.19041.1_it-it_59dedd2b6ac5922c_dnsapi.dll.mui_97465f8a JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.19041.1_none_ca60666860ba12d7_cga80857.fon_2e82e0e8 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..eservices.resources_31bf3856ad364e35_10.0.19041.1_en-us_8f48a1e2598394c7_sti.dll.mui_00a4f15b JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.19041.1_ru-ru_7dea1a14d94f7091.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nt-core-bootmanager_31bf3856ad364e35_10.0.19041.1_none_a1c3d9420e6939cc_bootdebuggerfiles.ini_96f52a4a JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-usermodensi.resources_31bf3856ad364e35_10.0.19041.1_es-es_f20d80907f57aa9d.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_da-dk_d112a4016e15fe6c_memtest.exe.mui_77b8cbcc JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_nb-no_cddb09fa0f832b11_comctl32.dll.mui_0da4e682 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-onecore-pnp-umpnpmgr.resources_31bf3856ad364e35_10.0.19041.1_en-us_1bd351c127f6d03f.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-a..on-authui-component_31bf3856ad364e35_10.0.19041.906_none_bafbd92e6e868958.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-branding-engine_31bf3856ad364e35_10.0.19041.1202_none_5e2a05871a9a6485_winsku.dll_6e6c7799 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_ja-jp_5416c68d7ab537ab.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-p..ng-client-overrides_31bf3856ad364e35_10.0.19041.1_none_cf8aac6a925f13ef.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_10.0.19041.1_it-it_ac991dc48f7da1c1.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..n-cmdline.resources_31bf3856ad364e35_10.0.19041.1_es-es_8559d1e56d0ddfe6.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_10.0.19041.1151_en-us_3fc8a69ab94012f6.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.19041.1_es-es_b8395d606a860c87_apphelp.dll.mui_59096153 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_es-mx_1510ae6386620e2f_comctl32.dll.mui_0da4e682 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-ntasn1-dll_31bf3856ad364e35_10.0.19041.546_none_982d370723a40539_ntasn1.dll_a6567dcf JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-win32kbase.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_057ff0e8d689e0d1.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_28f87d0444103fde_lpk.dll_ebdc1de9 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..ndowmanager-effects_31bf3856ad364e35_10.0.19041.1_none_a6f4c35bde1bc697.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-network-qos-pacer_31bf3856ad364e35_10.0.19041.546_none_cb01ee53d6697641_pacer.sys_c93de3d8 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_networking-mpssvc-svc.resources_31bf3856ad364e35_10.0.19041.1_it-it_ca048adff8009fa0_mpssvc.dll.mui_4b194b5f JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.19041.1_none_b3552a6f4dc424b4_vga852.fon_0a8e74dc JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.19041.1_es-es_197e86f61a60a3c7_userdeviceregistration.dll.mui_22ab8f29 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_sr-..-rs_58dfd3602ef5b7be.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.19041.1_fi-fi_183a9d4d0231f3a9.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.19041.1_zh-tw_984baa246cdd2b6c_bootmgr.efi.mui_be5d0075 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-r..intmapper.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_430caa488be6f8ed.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.19041.1_none_ca60666860ba12d7_cga80852.fon_2e7ddfad JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_10.0.19041.1_it-it_3661a8e887f4017f_scfilter.sys.mui_cebab716 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_es-mx_cd63778c71e5e529_comctl32.dll.mui_0da4e682 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_windows-defender-service_31bf3856ad364e35_10.0.19041.746_none_a39f6d9ab59bd8b7_mprtp.dll_0827df93 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_sl-si_fa5ca1f2ce603993.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984_comctl32.dll_9c499789 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-msasn1_31bf3856ad364e35_10.0.19041.1_none_7d4b234e44bee9a6.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasserver.resources_31bf3856ad364e35_10.0.19041.1_en-us_313221c95b98e24b_iprtrmgr.dll.mui_eb023b92 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasserver.resources_31bf3856ad364e35_10.0.19041.1_it-it_bddceaf325c3cfd0.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..geservice.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_4fe0218d9d982801_storagehealth.adml_00c6b7b3 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-twinapi-appcore_31bf3856ad364e35_10.0.19041.964_none_917daa321cc2afb4_twinapi.appcore.dll_8d6512dc JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_bc35fcf50d32ba29_userdeviceregistration.ngc.dll.mui_d2c6ca95 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_10.0.19041.1_it-it_0d9468386d9ee63a_winlogon.exe.mui_3280fc46 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wintrust-dll_31bf3856ad364e35_10.0.19041.1_none_a59f4749396e6b7e.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1_ro-ro_a7fd6f88bbbece6f_comctl32.dll.mui_0da4e682 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-cryptbase_31bf3856ad364e35_10.0.19041.546_none_4db3c6cb412a03a7.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-eventlog.resources_31bf3856ad364e35_10.0.19041.1_it-it_e0a2a6402a577815_wevtsvc.dll.mui_f41bf7b7 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.19041.1_none_3947da6a963cb0d8_vgasyse.fon_af851b69 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..-credprov.resources_31bf3856ad364e35_10.0.19041.1_en-us_9eaa18c3f00b3175.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-gdi32full_31bf3856ad364e35_10.0.19041.264_none_3e21bea4ba851175.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-sxssrv_31bf3856ad364e35_10.0.19041.207_none_3eab5ab615eaf290.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_236c71f1966d00bc_winlogon.exe.mui_3280fc46 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-basedependencies_31bf3856ad364e35_10.0.19041.546_none_e09b38c4879eb2b7.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_lv-lv_4233ec731487e2dc.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_zh-tw_2ee3d4c657bdc65b_comctl32.dll.mui_0da4e682 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.19041.1_none_b3552a6f4dc424b4_vga936.fon_11872ba5 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.19041.1_none_ca60666860ba12d7_ega80woa.fon_72a205e7 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_th-th_af6ca232f6e1fb8e.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-h..p-listsvc.resources_31bf3856ad364e35_10.0.19041.1_de-de_7802ffd5f4f46f8b_listsvc.dll.mui_27f0fc85 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-msvcp110_31bf3856ad364e35_10.0.19041.1_none_adfc02db44d455d9.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..ndactivitymoderator_31bf3856ad364e35_10.0.19041.1_none_8b4593ccb753f4e5.manifest JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4080 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe 4080 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4080 wrote to memory of 740 4080 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe 84 PID 4080 wrote to memory of 740 4080 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe 84 PID 4080 wrote to memory of 740 4080 JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c6fc2ad6eab5a3b5fce9f19f4863840680d2710447c0acfdbc338ecadf88837.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- System Location Discovery: System Language Discovery
PID:740
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5130b63034f7208d5e8ac55d66295c6af
SHA144185d2f3918955672285c5a53a34d95fb56184a
SHA256958b67faa2f6699ad58002cd874ee88ddf4fb1176faa2af27febdd545124c0f3
SHA51271ccde5b0be8c1ec685348b2f5d30a916b3626b15026f7b4d16c5fb2077ebdebaefdcb2c132d8367042f6771ebd0b6295bcfad78a4ad703d32e588e62a208017