Analysis
- max time kernel
141s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
24/06/2024, 01:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe
- Size 983KB
- Sample240624-bmdznssemb
- SHA256 d201ca35b14699011ec0c36e3bd4650f654002767d1849cbc6f066b198333228
- MD5 069f6c1f95fe98bd012e4e770ea2a2fd
- SHA1 b0702725c35f3c7e5dcecc83008409679ab7a95c
- SHA512 6e95956347ccad1740e7ff31cb22ba27a7119806c1602742c1246c4e52a832cf993bc1b7c38bbd7102cee45c05eac63c7728b4ff92f57dd5dd660f1451f64557
- SSDEEP 24576:cmgNeyQJkJLpIZqXPGPPm4rNR/AyufpYOjF2k:9gNeyQaJLpIwXPGPPm4xGyjk
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe - Disables Task Manager via registry modification
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4960 netsh.exe -
resource yara_rule behavioral2/memory/3868-28-0x0000000002E50000-0x0000000003E83000-memory.dmp upx behavioral2/memory/3868-32-0x0000000002E50000-0x0000000003E83000-memory.dmp upx behavioral2/memory/3868-35-0x0000000002E50000-0x0000000003E83000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3868 set thread context of 4780 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 91 - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4495AD01-C993-11D1-A3E4-00A0C90AEA82}\TypeLib\Version = "6.0" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}\ProxyStubClsid32 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F2-7697-11D1-A1E9-00A0C90F2731} 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8284B8A2-A8A8-11D1-A3D2-00A0C90AEA82}\ = "LicenseInfo" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7500A6BA-EB65-11D1-938D-0000F87557C9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F0-7697-11D1-A1E9-00A0C90F2731}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F1-7697-11D1-A1E9-00A0C90F2731}\TypeLib\Version = "6.0" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32\ThreadingModel = "Apartment" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}\TypeLib 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}\ = "AsyncProperty" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F1-7697-11D1-A1E9-00A0C90F2731} 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E469E0-BF61-11CF-8385-8F69D8F1350B}\TypeLib 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C5-4442-11D1-8906-00A0C9110049}\TypeLib 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C3-4442-11D1-8906-00A0C9110049}\ = "_DDataBoundAndDataSourceClass" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\ProxyStubClsid32 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\TypeLib\Version = "6.0" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E} 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82} 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB} 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F0-7697-11D1-A1E9-00A0C90F2731} 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049}\TypeLib 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C4-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C5-4442-11D1-8906-00A0C9110049}\ = "_DPersistableDataSourceClass" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{888A5A60-B283-11CF-8AD5-00A0C90AEA82}\TypeLib\Version = "6.0" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83C49FF0-B294-11D0-9488-00A0C91110ED} 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB}\TypeLib 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0324960-2AAA-11CF-AD67-00AA00614F3E}\ProxyStubClsid32 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C4-4442-11D1-8906-00A0C9110049}\TypeLib\Version = "6.0" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB} 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\TypeLib 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4E0F020-720A-11CF-8136-00AA00C14959}\ = "DataBindings" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E469E0-BF61-11CF-8385-8F69D8F1350B} 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E43FD401-8715-11D1-98E7-00A0C9702442}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E469E0-BF61-11CF-8385-8F69D8F1350B}\TypeLib\Version = "6.0" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049}\ = "_DDataBoundClass" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E469E0-BF61-11CF-8385-8F69D8F1350B}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\ = "_ErrObject" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4E0F020-720A-11CF-8136-00AA00C14959}\TypeLib 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049} 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45046D60-08CA-11CF-A90F-00AA0062BB4C}\ = "PropertyBag_VB5" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\TypeLib 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C5-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4495AD01-C993-11D1-A3E4-00A0C90AEA82}\ProxyStubClsid32 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\ = "DataObject" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{888A5A60-B283-11CF-8AD5-00A0C90AEA82}\ = "Hyperlink" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83C49FF0-B294-11D0-9488-00A0C91110ED}\TypeLib\Version = "6.0" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{000204EF-0000-0000-C000-000000000046}\6.0\9\win32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F2-7697-11D1-A1E9-00A0C90F2731}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C2-4442-11D1-8906-00A0C9110049}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\ = "Licenses" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB}\ProxyStubClsid32 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7500A6BA-EB65-11D1-938D-0000F87557C9}\TypeLib\Version = "6.0" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4E0F020-720A-11CF-8136-00AA00C14959}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C} 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCFB3D2B-A0FA-1068-A738-08002B3371B5}\ = "_DClass" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C2-4442-11D1-8906-00A0C9110049}\TypeLib\Version = "6.0" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45046D60-08CA-11CF-A90F-00AA0062BB4C}\TypeLib 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 4780 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 4780 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 4780 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 4780 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe - Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe Token: SeDebugPrivilege 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3868 wrote to memory of 4960 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 89 PID 3868 wrote to memory of 4960 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 89 PID 3868 wrote to memory of 4960 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 89 PID 3868 wrote to memory of 4780 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 91 PID 3868 wrote to memory of 4780 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 91 PID 3868 wrote to memory of 4780 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 91 PID 3868 wrote to memory of 4780 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 91 PID 3868 wrote to memory of 4780 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 91 PID 3868 wrote to memory of 4780 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 91 PID 3868 wrote to memory of 4780 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 91 PID 3868 wrote to memory of 792 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 9 PID 3868 wrote to memory of 788 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 10 PID 3868 wrote to memory of 332 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 13 PID 3868 wrote to memory of 2452 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 41 PID 3868 wrote to memory of 2464 3868 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 42 PID 4780 wrote to memory of 3384 4780 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 56 PID 4780 wrote to memory of 3384 4780 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 56 PID 4780 wrote to memory of 3384 4780 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 56 PID 4780 wrote to memory of 3384 4780 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe 56 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:332
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2452
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2464
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe"2⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3868 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4960
-
-
C:\Users\Admin\AppData\Local\Temp\069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4780
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:81⤵PID:4792
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1