Analysis
-
max time kernel
130s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 11:05
Behavioral task
behavioral1
Sample
JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe
-
Size
561KB
-
MD5
ea5d24b9bdfb7ea892b4ff16bc2c9d42
-
SHA1
40717d8266cf429ddc7df3a29248ef3bc8678a44
-
SHA256
6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a
-
SHA512
fef1c194135b4341da580de14d66d1cfb5b0207f5c57aa8bedb5f2f677c1dc913fb450a89de424d093da8a60c422af4aa4f189a95aa825e6e7c84e28b859f547
-
SSDEEP
12288:PIUykkZ3UdvReTV6dtXyLkzjF+4AYdvReTV6dtXyLkzjF+4AWLkzjF+4Ay:PIUWOZcLkzjF+4XZcLkzjF+4LLkzjF+s
Malware Config
Extracted
C:\Users\Default\sn6sw7p1l-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/98FE25560BD13983
http://decryptor.top/98FE25560BD13983
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (204) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\N: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\P: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\T: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\B: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\J: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\K: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\L: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\U: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\X: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\Y: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\Z: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\E: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\Q: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\R: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\D: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\G: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\O: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\V: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\W: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\F: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\A: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\H: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\I: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened (read-only) \??\S: JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\m9zuj32wm.bmp" JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\winsxs\Backup\amd64_networking-mpssvc-svc.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_145f01d8625db541.manifest JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-ldap-client.resources_31bf3856ad364e35_6.1.7600.16385_it-it_67ed08aa52859c02_wldap32.dll.mui_065dbd9c JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mlang_31bf3856ad364e35_6.1.7600.16385_none_b2d43d1ffdaf54e6_mlang.dll_211e02a3 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-newdev.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5bab695d0065bbd0_newdev.dll.mui_914efc6c JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_6.1.7601.17514_none_da3cb85562df73c9_memtest.exe_01d80391 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-c..ityclient.resources_31bf3856ad364e35_6.1.7600.16385_de-de_17c37298caa7b415_certcli.dll.mui_1b6822cf JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_lt-lt_d8a56adb99152caa_comctl32.dll.mui_0da4e682 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-ntlanman.resources_31bf3856ad364e35_6.1.7600.16385_de-de_eec5a30173304188_ntlanman.dll.mui_690e687e JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-unimodem-config_31bf3856ad364e35_6.1.7600.16385_none_50f69335385bc360_serialui.dll_bea29328 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-hbaapi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ec933d4f7ddcc091_hbaapi.mfl_4e36195e JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_6.1.7600.16385_none_63dee2821fc69fce_bridgeunattend.exe_60b7e340 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-a..core-base.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_98d212ed126c5e79_winmm.dll.mui_224f6445 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-f..ruetype-new_tai_lue_31bf3856ad364e35_6.1.7600.16385_none_325f57c8c0ee36a8_ntailu.ttf_c1891505 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_zh-tw_acac01bda1953889.manifest JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-mpr_31bf3856ad364e35_6.1.7600.16385_none_adac1f95b944e712.manifest JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-shsvcs.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_96641712ecf270b7.manifest JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_lt-lt_6302e913700e93fa.manifest JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ru-ru_23edfe3853a2f0bd.manifest JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-unimodem-config_31bf3856ad364e35_6.1.7600.16385_none_f4d7f7b17ffe522a_modemmigplugin.dll_6b9e1a82 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-shsvcs.resources_31bf3856ad364e35_6.1.7600.16385_de-de_4af06e370b1b5ceb.manifest JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-winbio.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ca81623c09da915a_winbio.dll.mui_7a8d17bd JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-a..on-authui.resources_31bf3856ad364e35_6.1.7600.16385_it-it_17fdb6bbc887fde4.manifest JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-webio.resources_31bf3856ad364e35_6.1.7601.17514_en-us_018102d196ec4984.manifest JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-advapi32.resources_31bf3856ad364e35_6.1.7600.16385_en-us_185fce5712288508_advapi32.dll.mui_28c7718f JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-legacyhwui_31bf3856ad364e35_6.1.7600.16385_none_3e69140a61f1eff5_hdwwiz.cpl_b6a1dbdc JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-msauditevtlog_31bf3856ad364e35_6.1.7600.16385_none_23376bf5921e7b63_auditpol.exe_83c870f4 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-w..eservices.resources_31bf3856ad364e35_6.1.7600.16385_it-it_65d8b3abe5a49142_wiaservc.dll.mui_54051b53 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasserver_31bf3856ad364e35_6.1.7601.17514_none_09cf3ec67e6c6b50_rasserver-repl.man_0cfe2e51 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-sens-service.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6c27642a947ac07c_sens.dll.mui_64739194 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-tcpip.resources_31bf3856ad364e35_6.1.7600.16385_it-it_58c398a5f8a28193_netiougc.exe.mui_ad7a9e4d JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-u..em-config.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c067cb47e93eb5ab.manifest JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-pshed.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ef54932792fc58dd_pshed.dll.mui_d7f9a40f JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-legacyhwui.resources_31bf3856ad364e35_6.1.7600.16385_it-it_39b4e1031d98c561_hdwwiz.exe.mui_b4acc7bc JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-sxssrv_31bf3856ad364e35_6.1.7600.16385_none_bc7acb14d0edfca2.manifest JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-d..lient-dll.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5588b35e1b8aed89_dhcpcore6.dll.mui_27872349 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_zh-tw_acac01bda1953889_msimsg.dll.mui_72e8994f JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_pt-pt_8896fee7e045b2ca_mlang.dll.mui_2904864a JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b6f780a94a52ace4_ole32.dll.mui_5035d60a JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_6.1.7600.16385_de-de_4aab526590e1172b_scfilter.sys.mui_cebab716 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-shacct.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d586284d0a31a5e5.manifest JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-verifier_31bf3856ad364e35_6.1.7600.16385_none_25fa2709e25e715f.manifest JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-truetype-utsaah_31bf3856ad364e35_6.1.7601.17514_none_8a6cbec4ba3b0202_utsaahb.ttf_0e350a56 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-u..erservice.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_93209fb7e6211ac9_umpo.dll.mui_cac12e54 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7600.16385_es-es_783d473f4a0142a2_winresume.exe.mui_ff8b5358 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f39c285e7fbf22f0_scarddlg.dll.mui_300ae9df JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-imagesp1.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ffa6d6a78501d8eb.manifest JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_6.1.7600.16385_it-it_bd67490bab84b358.manifest JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-u..em-config.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9162dff52c1fa7f0_uicom.dll.mui_4fdc61f8 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_6.1.7600.16385_it-it_466dccf2870d3c54_axinstui.exe.mui_aea34130 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-imagesp1.resources_31bf3856ad364e35_6.1.7600.16385_de-de_56b600ae9623cd26.manifest JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-e..gine-isam.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6bafe41ed67f87e5_esent.dll.mui_e30e3b90 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-winsock-helper-tcpip_31bf3856ad364e35_6.1.7600.16385_none_27a7f7694b388c01_wship6.dll_db4127c3 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_zh-hk_a74d96a66e8abfbf.manifest JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_6.1.7600.16385_en-us_30bc7fe1e159c5d3_winmgmtr.dll.mui_741bfb68 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_networking-mpssvc-svc_31bf3856ad364e35_6.1.7601.17514_none_f83a40e7de7c47da_mpsdrv.mof_778760bc JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-h..p-provsvc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a22051423878c3c6_provsvc.dll.mui_3a2926ae JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-pshed.resources_31bf3856ad364e35_6.1.7600.16385_en-us_936a9abfda77f602_pshed.dll.mui_d7f9a40f JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-htmlhelp.resources_31bf3856ad364e35_6.1.7600.16385_es-es_110e95329adfd6f5.manifest JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-themeservice.resources_31bf3856ad364e35_6.1.7600.16385_es-es_bd289c780c8805eb_themeservice.dll.mui_9e71f1ab JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-riched32_31bf3856ad364e35_6.1.7601.17514_none_9f081dc1e0ddbddb_riched32.dll_fb508ddc JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-efs-util-library_31bf3856ad364e35_6.1.7600.16385_none_a30e530ebc7f9b22.manifest JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-eventlog_31bf3856ad364e35_6.1.7601.17514_none_3aea61892978b9c5.manifest JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1_services.mof_abfc36b4 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-u..em-config.resources_31bf3856ad364e35_6.1.7600.16385_it-it_7a60e7beae811506_modemui.dll.mui_a710bc71 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2944 vssadmin.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2184 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2400 vssvc.exe Token: SeRestorePrivilege 2400 vssvc.exe Token: SeAuditPrivilege 2400 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2788 2184 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe 30 PID 2184 wrote to memory of 2788 2184 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe 30 PID 2184 wrote to memory of 2788 2184 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe 30 PID 2184 wrote to memory of 2788 2184 JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe 30 PID 2788 wrote to memory of 2944 2788 cmd.exe 32 PID 2788 wrote to memory of 2944 2788 cmd.exe 32 PID 2788 wrote to memory of 2944 2788 cmd.exe 32 PID 2788 wrote to memory of 2944 2788 cmd.exe 32 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:2944
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2400
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
6KB
MD5b43d4db64e63d77da10018a939729081
SHA180cf8e551d67d3f2878402d5fbabd826cace02ae
SHA256ff9eb9eb77d0ffc69cad2b3cf14af56edb369107ceaea0ee07676d0bcc3405b7
SHA512d765a2b85ed4b7c1362092e024f01357e73790440679dd81a284cd3d31a1fefb22ea519e5d8438bd4c43e5194cba72b2344a5f07e97b76dffb7f876a975129d3