Analysis
-
max time kernel
54s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2024 19:34
Static task
static1
Behavioral task
behavioral1
Sample
5c375467509255e045544819c517aa26_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
5c375467509255e045544819c517aa26_JaffaCakes118.exe
-
Size
1.6MB
-
MD5
5c375467509255e045544819c517aa26
-
SHA1
910e1c81b5403997747d8e97ecdf140f619359bf
-
SHA256
4906dabe18713cfb2c7e2920efef762579ef0ef285eed98098639b7f22fe32fc
-
SHA512
ce8233ad76e1cc8f962a6810fa9d1b4a2657b1ce1b32ca3cb386a8450cbe43e115308aafb693b9db7ae109b07b182ef1cf381e869360a040a0097d2c09dec320
-
SSDEEP
6144:cTkbhEh9DbFZdCsKg8SVAKtVSVeB/yN7ARppUc:h9qhWg8SO0SVG/9ppUc
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
5c375467509255e045544819c517aa26_JaffaCakes118.exesystem32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" system32.exe -
Processes:
5c375467509255e045544819c517aa26_JaffaCakes118.exesystem32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe -
Processes:
5c375467509255e045544819c517aa26_JaffaCakes118.exesystem32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" system32.exe -
Deletes itself 1 IoCs
Processes:
system32.exepid process 4784 system32.exe -
Executes dropped EXE 1 IoCs
Processes:
system32.exepid process 4784 system32.exe -
Processes:
resource yara_rule behavioral2/memory/3912-3-0x0000000002BE0000-0x0000000003C6E000-memory.dmp upx behavioral2/memory/3912-5-0x0000000002BE0000-0x0000000003C6E000-memory.dmp upx behavioral2/memory/3912-7-0x0000000002BE0000-0x0000000003C6E000-memory.dmp upx behavioral2/memory/3912-12-0x0000000002BE0000-0x0000000003C6E000-memory.dmp upx behavioral2/memory/3912-13-0x0000000002BE0000-0x0000000003C6E000-memory.dmp upx behavioral2/memory/3912-14-0x0000000002BE0000-0x0000000003C6E000-memory.dmp upx behavioral2/memory/3912-15-0x0000000002BE0000-0x0000000003C6E000-memory.dmp upx behavioral2/memory/3912-16-0x0000000002BE0000-0x0000000003C6E000-memory.dmp upx behavioral2/memory/3912-17-0x0000000002BE0000-0x0000000003C6E000-memory.dmp upx behavioral2/memory/3912-18-0x0000000002BE0000-0x0000000003C6E000-memory.dmp upx behavioral2/memory/3912-27-0x0000000002BE0000-0x0000000003C6E000-memory.dmp upx behavioral2/memory/3912-34-0x0000000002BE0000-0x0000000003C6E000-memory.dmp upx behavioral2/memory/4784-44-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-46-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-47-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-52-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-53-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-54-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-55-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-56-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-57-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-58-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-59-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-60-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-61-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-62-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-64-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-65-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-66-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-74-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-78-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-81-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-83-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-86-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-87-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-89-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-91-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx behavioral2/memory/4784-149-0x0000000002D10000-0x0000000003D9E000-memory.dmp upx -
Processes:
5c375467509255e045544819c517aa26_JaffaCakes118.exesystem32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc system32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
system32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System32 = "C:\\Users\\Admin\\system32.exe" system32.exe -
Processes:
system32.exe5c375467509255e045544819c517aa26_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 5c375467509255e045544819c517aa26_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
system32.exedescription ioc process File opened (read-only) \??\E: system32.exe File opened (read-only) \??\G: system32.exe File opened (read-only) \??\H: system32.exe -
Drops file in Windows directory 1 IoCs
Processes:
5c375467509255e045544819c517aa26_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 5c375467509255e045544819c517aa26_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
5c375467509255e045544819c517aa26_JaffaCakes118.exesystem32.exepid process 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe 4784 system32.exe 4784 system32.exe 4784 system32.exe 4784 system32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
5c375467509255e045544819c517aa26_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
5c375467509255e045544819c517aa26_JaffaCakes118.exesystem32.exepid process 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe 4784 system32.exe -
Suspicious use of WriteProcessMemory 56 IoCs
Processes:
5c375467509255e045544819c517aa26_JaffaCakes118.exesystem32.exedescription pid process target process PID 3912 wrote to memory of 796 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe fontdrvhost.exe PID 3912 wrote to memory of 800 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe fontdrvhost.exe PID 3912 wrote to memory of 1020 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe dwm.exe PID 3912 wrote to memory of 2464 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe sihost.exe PID 3912 wrote to memory of 2488 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe svchost.exe PID 3912 wrote to memory of 2868 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe taskhostw.exe PID 3912 wrote to memory of 3384 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe Explorer.EXE PID 3912 wrote to memory of 3612 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe svchost.exe PID 3912 wrote to memory of 3812 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe DllHost.exe PID 3912 wrote to memory of 3940 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe StartMenuExperienceHost.exe PID 3912 wrote to memory of 4024 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe RuntimeBroker.exe PID 3912 wrote to memory of 748 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe SearchApp.exe PID 3912 wrote to memory of 3884 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe RuntimeBroker.exe PID 3912 wrote to memory of 2200 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe RuntimeBroker.exe PID 3912 wrote to memory of 4660 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe TextInputHost.exe PID 3912 wrote to memory of 2364 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe backgroundTaskHost.exe PID 3912 wrote to memory of 1556 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe RuntimeBroker.exe PID 3912 wrote to memory of 2000 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe RuntimeBroker.exe PID 3912 wrote to memory of 4784 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe system32.exe PID 3912 wrote to memory of 4784 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe system32.exe PID 3912 wrote to memory of 4784 3912 5c375467509255e045544819c517aa26_JaffaCakes118.exe system32.exe PID 4784 wrote to memory of 796 4784 system32.exe fontdrvhost.exe PID 4784 wrote to memory of 800 4784 system32.exe fontdrvhost.exe PID 4784 wrote to memory of 1020 4784 system32.exe dwm.exe PID 4784 wrote to memory of 2464 4784 system32.exe sihost.exe PID 4784 wrote to memory of 2488 4784 system32.exe svchost.exe PID 4784 wrote to memory of 2868 4784 system32.exe taskhostw.exe PID 4784 wrote to memory of 3384 4784 system32.exe Explorer.EXE PID 4784 wrote to memory of 3612 4784 system32.exe svchost.exe PID 4784 wrote to memory of 3812 4784 system32.exe DllHost.exe PID 4784 wrote to memory of 3940 4784 system32.exe StartMenuExperienceHost.exe PID 4784 wrote to memory of 4024 4784 system32.exe RuntimeBroker.exe PID 4784 wrote to memory of 748 4784 system32.exe SearchApp.exe PID 4784 wrote to memory of 3884 4784 system32.exe RuntimeBroker.exe PID 4784 wrote to memory of 2200 4784 system32.exe RuntimeBroker.exe PID 4784 wrote to memory of 4660 4784 system32.exe TextInputHost.exe PID 4784 wrote to memory of 2364 4784 system32.exe backgroundTaskHost.exe PID 4784 wrote to memory of 1556 4784 system32.exe RuntimeBroker.exe PID 4784 wrote to memory of 2000 4784 system32.exe RuntimeBroker.exe PID 4784 wrote to memory of 796 4784 system32.exe fontdrvhost.exe PID 4784 wrote to memory of 800 4784 system32.exe fontdrvhost.exe PID 4784 wrote to memory of 1020 4784 system32.exe dwm.exe PID 4784 wrote to memory of 2464 4784 system32.exe sihost.exe PID 4784 wrote to memory of 2488 4784 system32.exe svchost.exe PID 4784 wrote to memory of 2868 4784 system32.exe taskhostw.exe PID 4784 wrote to memory of 3384 4784 system32.exe Explorer.EXE PID 4784 wrote to memory of 3612 4784 system32.exe svchost.exe PID 4784 wrote to memory of 3812 4784 system32.exe DllHost.exe PID 4784 wrote to memory of 3940 4784 system32.exe StartMenuExperienceHost.exe PID 4784 wrote to memory of 4024 4784 system32.exe RuntimeBroker.exe PID 4784 wrote to memory of 748 4784 system32.exe SearchApp.exe PID 4784 wrote to memory of 3884 4784 system32.exe RuntimeBroker.exe PID 4784 wrote to memory of 2200 4784 system32.exe RuntimeBroker.exe PID 4784 wrote to memory of 4660 4784 system32.exe TextInputHost.exe PID 4784 wrote to memory of 1556 4784 system32.exe RuntimeBroker.exe PID 4784 wrote to memory of 2000 4784 system32.exe RuntimeBroker.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
system32.exe5c375467509255e045544819c517aa26_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 5c375467509255e045544819c517aa26_JaffaCakes118.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\5c375467509255e045544819c517aa26_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5c375467509255e045544819c517aa26_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\system32.exeC:\Users\Admin\system32.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
6Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\System32.exeFilesize
1.6MB
MD55c375467509255e045544819c517aa26
SHA1910e1c81b5403997747d8e97ecdf140f619359bf
SHA2564906dabe18713cfb2c7e2920efef762579ef0ef285eed98098639b7f22fe32fc
SHA512ce8233ad76e1cc8f962a6810fa9d1b4a2657b1ce1b32ca3cb386a8450cbe43e115308aafb693b9db7ae109b07b182ef1cf381e869360a040a0097d2c09dec320
-
C:\Windows\SYSTEM.INIFilesize
257B
MD533f02634b0f0044ea10367008d433c44
SHA1441fa92ec12108de6ea6b5e56520bfe34a899d2c
SHA256e0c4a79377281025859e7ac45d9cfaa124c3dc6a73c258aaeba0d4087fe0a174
SHA51290738bf801c002740007573615849ef0f2ebce842e1e2a90cdba088e0da73210913255c8444590c48820df23498b7c87b55c34710e4086aee5a89a0e93a3a397
-
F:\odjfxo.exeFilesize
100KB
MD5618e254a67a93c832189db01238ca035
SHA1d6378911498cf8ffe24803353c6ac0dc7db723ec
SHA2562234e39ef617876efe202d4b995c2240b4c41adbd2fbcc7774c1d3ca22a11f0c
SHA512793055c6c62649b8d49a316c112936b1597a1ad6789ad7d555243e0efccf8601eb16544842eb7c6347c13ae8502e56e62e552b77360a59e25d78ddf5ff6d0be4
-
memory/3912-15-0x0000000002BE0000-0x0000000003C6E000-memory.dmpFilesize
16.6MB
-
memory/3912-17-0x0000000002BE0000-0x0000000003C6E000-memory.dmpFilesize
16.6MB
-
memory/3912-9-0x0000000002A80000-0x0000000002A81000-memory.dmpFilesize
4KB
-
memory/3912-11-0x0000000002280000-0x0000000002282000-memory.dmpFilesize
8KB
-
memory/3912-12-0x0000000002BE0000-0x0000000003C6E000-memory.dmpFilesize
16.6MB
-
memory/3912-13-0x0000000002BE0000-0x0000000003C6E000-memory.dmpFilesize
16.6MB
-
memory/3912-14-0x0000000002BE0000-0x0000000003C6E000-memory.dmpFilesize
16.6MB
-
memory/3912-0-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/3912-16-0x0000000002BE0000-0x0000000003C6E000-memory.dmpFilesize
16.6MB
-
memory/3912-7-0x0000000002BE0000-0x0000000003C6E000-memory.dmpFilesize
16.6MB
-
memory/3912-8-0x0000000002280000-0x0000000002282000-memory.dmpFilesize
8KB
-
memory/3912-18-0x0000000002BE0000-0x0000000003C6E000-memory.dmpFilesize
16.6MB
-
memory/3912-27-0x0000000002BE0000-0x0000000003C6E000-memory.dmpFilesize
16.6MB
-
memory/3912-38-0x0000000002280000-0x0000000002282000-memory.dmpFilesize
8KB
-
memory/3912-34-0x0000000002BE0000-0x0000000003C6E000-memory.dmpFilesize
16.6MB
-
memory/3912-43-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/3912-5-0x0000000002BE0000-0x0000000003C6E000-memory.dmpFilesize
16.6MB
-
memory/3912-3-0x0000000002BE0000-0x0000000003C6E000-memory.dmpFilesize
16.6MB
-
memory/4784-47-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-64-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-51-0x0000000000760000-0x0000000000762000-memory.dmpFilesize
8KB
-
memory/4784-46-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-52-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-53-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-54-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-55-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-56-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-57-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-58-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-59-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-60-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-61-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-62-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-49-0x00000000020F0000-0x00000000020F1000-memory.dmpFilesize
4KB
-
memory/4784-65-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-66-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-74-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-78-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-81-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-83-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-86-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-87-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-89-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-91-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-149-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB
-
memory/4784-150-0x0000000000760000-0x0000000000762000-memory.dmpFilesize
8KB
-
memory/4784-44-0x0000000002D10000-0x0000000003D9E000-memory.dmpFilesize
16.6MB