f57447b505177efa19040be044ab4fbadf0a7256be3a322a54bc9fbd5daa6195

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 08:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Size

183KB
MD5

f3127e868db76de169812b6274a393f9
SHA1

927ea2bd5e53faf6b3935d2ed6b27f71380365c0
SHA256

f57447b505177efa19040be044ab4fbadf0a7256be3a322a54bc9fbd5daa6195
SHA512

601febe7e1f88bec68db8d5c8f31921d074ae2ee825e6b44bed470ba6fa9fb3b32f9bf1b45ec54feb3dda850272176b0e0b77175ff952bb98edf550142a96ec1
SSDEEP

3072:JlcE5j8biKmno0BO93s0b/g/Sxrm6LAge:/cgQ+o0035b4ud

Score

10^/10

evasion trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3932-1-0x00000000021D0000-0x00000000031FA000-memory.dmp	upx
behavioral2/memory/3932-3-0x00000000021D0000-0x00000000031FA000-memory.dmp	upx
behavioral2/memory/3932-4-0x00000000021D0000-0x00000000031FA000-memory.dmp	upx
behavioral2/memory/3932-15-0x00000000021D0000-0x00000000031FA000-memory.dmp	upx
behavioral2/memory/3932-30-0x00000000021D0000-0x00000000031FA000-memory.dmp	upx
behavioral2/memory/3932-55-0x00000000021D0000-0x00000000031FA000-memory.dmp	upx
behavioral2/memory/3932-60-0x00000000021D0000-0x00000000031FA000-memory.dmp	upx
behavioral2/memory/3932-67-0x00000000021D0000-0x00000000031FA000-memory.dmp	upx
behavioral2/memory/3932-72-0x00000000021D0000-0x00000000031FA000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 808	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	9
PID 3932 wrote to memory of 816	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	10
PID 3932 wrote to memory of 332	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	13
PID 3932 wrote to memory of 2600	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	44
PID 3932 wrote to memory of 2632	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	45
PID 3932 wrote to memory of 3012	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	51
PID 3932 wrote to memory of 3428	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	56
PID 3932 wrote to memory of 3556	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	57
PID 3932 wrote to memory of 3748	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	58
PID 3932 wrote to memory of 3836	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	59
PID 3932 wrote to memory of 3948	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	60
PID 3932 wrote to memory of 4032	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	61
PID 3932 wrote to memory of 3876	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	62
PID 3932 wrote to memory of 3204	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	74
PID 3932 wrote to memory of 4452	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	75
PID 3932 wrote to memory of 4328	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	80
PID 3932 wrote to memory of 4824	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	81
PID 3932 wrote to memory of 4468	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	83
PID 3932 wrote to memory of 808	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	9
PID 3932 wrote to memory of 816	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	10
PID 3932 wrote to memory of 332	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	13
PID 3932 wrote to memory of 2600	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	44
PID 3932 wrote to memory of 2632	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	45
PID 3932 wrote to memory of 3012	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	51
PID 3932 wrote to memory of 3428	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	56
PID 3932 wrote to memory of 3556	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	57
PID 3932 wrote to memory of 3748	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	58
PID 3932 wrote to memory of 3836	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	59
PID 3932 wrote to memory of 3948	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	60
PID 3932 wrote to memory of 4032	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	61
PID 3932 wrote to memory of 3876	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	62
PID 3932 wrote to memory of 3204	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	74
PID 3932 wrote to memory of 4452	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	75
PID 3932 wrote to memory of 4328	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	80
PID 3932 wrote to memory of 2676	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	84
PID 3932 wrote to memory of 4892	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	85
PID 3932 wrote to memory of 808	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	9
PID 3932 wrote to memory of 816	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	10
PID 3932 wrote to memory of 332	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	13
PID 3932 wrote to memory of 2600	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	44
PID 3932 wrote to memory of 2632	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	45
PID 3932 wrote to memory of 3012	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	51
PID 3932 wrote to memory of 3428	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	56
PID 3932 wrote to memory of 3556	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	57
PID 3932 wrote to memory of 3748	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	58
PID 3932 wrote to memory of 3836	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	59
PID 3932 wrote to memory of 3948	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	60
PID 3932 wrote to memory of 4032	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	61
PID 3932 wrote to memory of 3876	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	62
PID 3932 wrote to memory of 3204	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	74
PID 3932 wrote to memory of 4452	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	75
PID 3932 wrote to memory of 4328	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	80
PID 3932 wrote to memory of 2676	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	84
PID 3932 wrote to memory of 4892	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	85
PID 3932 wrote to memory of 4996	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	91
PID 3932 wrote to memory of 4996	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	91
PID 3932 wrote to memory of 4996	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	91
PID 3932 wrote to memory of 4996	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	91
PID 3932 wrote to memory of 4504	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	92
PID 3932 wrote to memory of 4504	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	92
PID 3932 wrote to memory of 4504	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	92
PID 3932 wrote to memory of 4504	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	92
PID 3932 wrote to memory of 2532	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	93
PID 3932 wrote to memory of 2532	3932	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe	93

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f3127e868db76de169812b6274a393f9_JaffaCakes118.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:808

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:816

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:332

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2632

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:3012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3428
- C:\Users\Admin\AppData\Local\Temp\f3127e868db76de169812b6274a393f9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f3127e868db76de169812b6274a393f9_JaffaCakes118.exe"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3932
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE"
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE"
    3⤵
    PID:4504
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE"
    3⤵
    PID:2532
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE"
    3⤵
    PID:1884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3556

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3748

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3836

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3948

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4032

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3876

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:3204

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4452

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:4328

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4824

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
PID:4468

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2676

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1884-66-0x00000000008A0000-0x00000000008B4000-memory.dmp

Filesize
80KB

Download
memory/1884-64-0x00000000008A0000-0x00000000008B4000-memory.dmp

Filesize
80KB

Download
memory/2532-61-0x0000000000DC0000-0x0000000000DD4000-memory.dmp

Filesize
80KB

Download
memory/2532-63-0x0000000000DC0000-0x0000000000DD4000-memory.dmp

Filesize
80KB

Download
memory/3932-60-0x00000000021D0000-0x00000000031FA000-memory.dmp

Filesize
16.2MB

Download
memory/3932-5-0x00000000037C0000-0x00000000037C2000-memory.dmp

Filesize
8KB

Download
memory/3932-9-0x00000000037C0000-0x00000000037C2000-memory.dmp

Filesize
8KB

Download
memory/3932-15-0x00000000021D0000-0x00000000031FA000-memory.dmp

Filesize
16.2MB

Download
memory/3932-30-0x00000000021D0000-0x00000000031FA000-memory.dmp

Filesize
16.2MB

Download
memory/3932-46-0x00000000037C0000-0x00000000037C2000-memory.dmp

Filesize
8KB

Download
memory/3932-72-0x00000000021D0000-0x00000000031FA000-memory.dmp

Filesize
16.2MB

Download
memory/3932-67-0x00000000021D0000-0x00000000031FA000-memory.dmp

Filesize
16.2MB

Download
memory/3932-55-0x00000000021D0000-0x00000000031FA000-memory.dmp

Filesize
16.2MB

Download
memory/3932-1-0x00000000021D0000-0x00000000031FA000-memory.dmp

Filesize
16.2MB

Download
memory/3932-3-0x00000000021D0000-0x00000000031FA000-memory.dmp

Filesize
16.2MB

Download
memory/3932-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3932-6-0x00000000037D0000-0x00000000037D1000-memory.dmp

Filesize
4KB

Download
memory/3932-4-0x00000000021D0000-0x00000000031FA000-memory.dmp

Filesize
16.2MB

Download
memory/4504-58-0x0000000000E10000-0x0000000000E24000-memory.dmp

Filesize
80KB

Download
memory/4504-56-0x0000000000E10000-0x0000000000E24000-memory.dmp

Filesize
80KB

Download
memory/4996-52-0x0000000000830000-0x0000000000844000-memory.dmp

Filesize
80KB

Download
memory/4996-51-0x0000000000830000-0x0000000000844000-memory.dmp

Filesize
80KB

Download