Analysis
- max time kernel
147s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
24/06/2024, 10:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe
- Size 381KB
- Sample240624-mkfw2a1dnp
- SHA256 98bc20c55036d785623299d6586e3611a7581ba01314409093187b89960fb811
- MD5 07faeb0ca4b686eaf3cbfbe430e21d9b
- SHA1 f56861fbd668e1081dc045a26b24db148bce3860
- SHA512 45cf58fe6fb1371777955f266f22b19e8acb6f589b92be2288d842b59d18969b1794c4f50697a6939e9614af143d4d2d6c83e75f51670a2efb66017351db2318
- SSDEEP 6144:P9mIRKIXJMFy/x37mBqEqEweiZNM/pexGSRgpq0XHSUCQkU8imnJ9:715oy/5mQEQei7M/pzSO3LCq81nJ9
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" svchost.exe.exe - ModiLoader Second Stage 21 IoCs
resource yara_rule behavioral2/memory/3556-13-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3556-15-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3556-16-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3556-17-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3556-33-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3060-50-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3060-51-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3060-60-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3060-61-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3060-62-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3060-63-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3060-64-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3060-65-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3060-66-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3060-67-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3060-68-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3060-69-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3060-70-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3060-71-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3060-72-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3060-73-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation svchost.exe.exe - Executes dropped EXE 3 IoCs
pid Process 1012 svchost.exe.exe 3176 svchost.exe.exe 3060 svchost.exe.exe - Loads dropped DLL 1 IoCs
pid Process 3060 svchost.exe.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" svchost.exe.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "C:\\Windows\\svchost.exe.exe" svchost.exe.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe File created C:\Windows\SysWOW64\svchost.exe.exe svchost.exe.exe File opened for modification C:\Windows\SysWOW64\svchost.exe.exe svchost.exe.exe File created C:\Windows\SysWOW64\07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2668 set thread context of 1876 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 86 PID 1876 set thread context of 3556 1876 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 87 PID 1012 set thread context of 3176 1012 svchost.exe.exe 99 PID 3176 set thread context of 3060 3176 svchost.exe.exe 100 - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\svchost.exe.exe 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe File opened for modification C:\Windows\svchost.exe.exe svchost.exe.exe File created C:\Windows\ntdtcstp.dll svchost.exe.exe File created C:\Windows\svchost.exe.exe 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: 33 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1876 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 3176 svchost.exe.exe - Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 2668 wrote to memory of 1876 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 86 PID 2668 wrote to memory of 1876 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 86 PID 2668 wrote to memory of 1876 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 86 PID 2668 wrote to memory of 1876 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 86 PID 2668 wrote to memory of 1876 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 86 PID 2668 wrote to memory of 1876 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 86 PID 2668 wrote to memory of 1876 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 86 PID 2668 wrote to memory of 1876 2668 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 86 PID 1876 wrote to memory of 3556 1876 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 87 PID 1876 wrote to memory of 3556 1876 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 87 PID 1876 wrote to memory of 3556 1876 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 87 PID 1876 wrote to memory of 3556 1876 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 87 PID 1876 wrote to memory of 3556 1876 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 87 PID 1876 wrote to memory of 3556 1876 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 87 PID 1876 wrote to memory of 3556 1876 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 87 PID 1876 wrote to memory of 3556 1876 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 87 PID 1876 wrote to memory of 3556 1876 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 87 PID 1876 wrote to memory of 3556 1876 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 87 PID 1876 wrote to memory of 3556 1876 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 87 PID 1876 wrote to memory of 3556 1876 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 87 PID 1876 wrote to memory of 3556 1876 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 87 PID 1876 wrote to memory of 2588 1876 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 88 PID 1876 wrote to memory of 2588 1876 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 88 PID 1876 wrote to memory of 2588 1876 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 88 PID 3556 wrote to memory of 1012 3556 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 93 PID 3556 wrote to memory of 1012 3556 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 93 PID 3556 wrote to memory of 1012 3556 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe 93 PID 1012 wrote to memory of 3176 1012 svchost.exe.exe 99 PID 1012 wrote to memory of 3176 1012 svchost.exe.exe 99 PID 1012 wrote to memory of 3176 1012 svchost.exe.exe 99 PID 1012 wrote to memory of 3176 1012 svchost.exe.exe 99 PID 1012 wrote to memory of 3176 1012 svchost.exe.exe 99 PID 1012 wrote to memory of 3176 1012 svchost.exe.exe 99 PID 1012 wrote to memory of 3176 1012 svchost.exe.exe 99 PID 1012 wrote to memory of 3176 1012 svchost.exe.exe 99 PID 3176 wrote to memory of 3060 3176 svchost.exe.exe 100 PID 3176 wrote to memory of 3060 3176 svchost.exe.exe 100 PID 3176 wrote to memory of 3060 3176 svchost.exe.exe 100 PID 3176 wrote to memory of 3060 3176 svchost.exe.exe 100 PID 3176 wrote to memory of 3060 3176 svchost.exe.exe 100 PID 3176 wrote to memory of 3060 3176 svchost.exe.exe 100 PID 3176 wrote to memory of 3060 3176 svchost.exe.exe 100 PID 3176 wrote to memory of 3060 3176 svchost.exe.exe 100 PID 3176 wrote to memory of 3060 3176 svchost.exe.exe 100 PID 3176 wrote to memory of 3060 3176 svchost.exe.exe 100 PID 3176 wrote to memory of 3060 3176 svchost.exe.exe 100 PID 3176 wrote to memory of 3060 3176 svchost.exe.exe 100 PID 3176 wrote to memory of 3060 3176 svchost.exe.exe 100 PID 3176 wrote to memory of 4960 3176 svchost.exe.exe 101 PID 3176 wrote to memory of 4960 3176 svchost.exe.exe 101 PID 3176 wrote to memory of 4960 3176 svchost.exe.exe 101 - System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe.exe - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe2⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe3⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\svchost.exe.exe"C:\Windows\svchost.exe.exe" \melt "C:\Users\Admin\AppData\Local\Temp\07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\svchost.exe.exeC:\Windows\svchost.exe.exe \melt "C:\Users\Admin\AppData\Local\Temp\07faeb0ca4b686eaf3cbfbe430e21d9b_JaffaCakes118.exe"5⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3176 -
C:\Windows\svchost.exe.exeC:\Windows\svchost.exe.exe6⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:3060
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\temp.bat" "6⤵PID:4960
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\temp.bat" "3⤵PID:2588
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:5020
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\temp.bat
- Size 227B
- SHA256 1a9df6375d548d506b7047c8a92388dc3918f5f6c12230fe678af3629a6c1a5d
- MD5 6681307193f0224a32212632382c730f
- SHA1 37748d354cc32c8335b3a5bb3e4c12a190259852
- SHA512 f60cb36bee4eedcb8840029c4fa6786253d95efb84078be807218b38f94e00a1c0db9bc52b8362ca7c13a483265b5eee20c5acd1c1d608b623edde579eed6d19
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\temp.bat
- Size 111B
- SHA256 38e0e99da77db7640b8a6e70a1ec4d68a183768246c02919f1d0bc841aff79c7
- MD5 75e550af8a288807bba93796f0a250fc
- SHA1 a279f1d75827329dd926ab7a3589afef28c7bcec
- SHA512 318afe5b246511e3662827f8d3b5052b397cb76c6604d4c1f3ef28925acbdeffb2d2325ca446b166197d5a87f7275e47423e9c917eab477098908dbd741609f6
- MD5 SHA1 SHA512
- Path C:\Windows\ntdtcstp.dll
- Size 40KB
- SHA256 003eb1ba56dc99c6a6d4e8f35233edcee64aa8001ac5f7289369cae2325ff019
- MD5 3f689ab34ba20ffbc647f3c4ce7c9c92
- SHA1 0275be6c5d43a4916f4b6b2b4aa06398e193206f
- SHA512 5336b3d410c21746a81a67c1b0da791d5592d4dc42fe559bc9b12a89b6bc6aef04b385a1566e55a7599c2489741ee7b0953f9cb0b3b5b9a9feb006678e2bdbce
- SSDEEP 768:JYTpEMMLAEWGsxX/M1DXCslms9/8oMUr:JYTpEMMLD8UDXCiFmoMM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\svchost.exe.exe
- Size 381KB
- SHA256 98bc20c55036d785623299d6586e3611a7581ba01314409093187b89960fb811
- MD5 07faeb0ca4b686eaf3cbfbe430e21d9b
- SHA1 f56861fbd668e1081dc045a26b24db148bce3860
- SHA512 45cf58fe6fb1371777955f266f22b19e8acb6f589b92be2288d842b59d18969b1794c4f50697a6939e9614af143d4d2d6c83e75f51670a2efb66017351db2318
- SSDEEP 6144:P9mIRKIXJMFy/x37mBqEqEweiZNM/pexGSRgpq0XHSUCQkU8imnJ9:715oy/5mQEQei7M/pzSO3LCq81nJ9
- MD5 SHA1 SHA512 SSDEEP