Analysis
-
max time kernel
144s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 21:27
Static task
static1
Behavioral task
behavioral1
Sample
0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe
-
Size
336KB
-
MD5
0f96ee2962b0c0be8974f151205be9d3
-
SHA1
7af5781510cc7ddd6a7c4a06c0cef142c0e3bb0a
-
SHA256
958c736bb73157af0bf2ad7715e56b0cc7264cc4b844db71778d817f60e9ef0c
-
SHA512
d1440591b81c8dd833275de2b6607b9888d6236cbc54f0e70f832ef7652d1e5f094e66b5f2ffd197fcdfdb96f410aa510bd114638fd91d1ea5a6deb8c535f610
-
SSDEEP
6144:2ofwe61ykJTbHho6VlWcF302/ZHQ9dNOaeJ:InBJWcFpQ9d4rJ
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Processes:
0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe -
Processes:
0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe -
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2312 netsh.exe -
Processes:
resource yara_rule behavioral2/memory/4724-1-0x0000000002A40000-0x0000000003A73000-memory.dmp upx behavioral2/memory/4724-6-0x0000000002A40000-0x0000000003A73000-memory.dmp upx behavioral2/memory/4724-18-0x0000000002A40000-0x0000000003A73000-memory.dmp upx behavioral2/memory/4724-28-0x0000000002A40000-0x0000000003A73000-memory.dmp upx -
Processes:
0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe -
Processes:
0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exedescription pid process target process PID 4724 set thread context of 3776 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe PID 3776 set thread context of 1840 3776 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
Processes:
0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exepid process 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 1840 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 1840 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 1840 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 1840 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Token: SeDebugPrivilege 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exepid process 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 3776 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exedescription pid process target process PID 4724 wrote to memory of 2312 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe netsh.exe PID 4724 wrote to memory of 2312 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe netsh.exe PID 4724 wrote to memory of 2312 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe netsh.exe PID 4724 wrote to memory of 792 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe fontdrvhost.exe PID 4724 wrote to memory of 800 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe fontdrvhost.exe PID 4724 wrote to memory of 384 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe dwm.exe PID 4724 wrote to memory of 2508 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe svchost.exe PID 4724 wrote to memory of 2516 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe sihost.exe PID 4724 wrote to memory of 2656 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe taskhostw.exe PID 4724 wrote to memory of 3536 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Explorer.EXE PID 4724 wrote to memory of 3656 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe svchost.exe PID 4724 wrote to memory of 3832 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe DllHost.exe PID 4724 wrote to memory of 3928 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe StartMenuExperienceHost.exe PID 4724 wrote to memory of 3996 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe RuntimeBroker.exe PID 4724 wrote to memory of 1276 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe SearchApp.exe PID 4724 wrote to memory of 3764 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe RuntimeBroker.exe PID 4724 wrote to memory of 416 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe RuntimeBroker.exe PID 4724 wrote to memory of 4976 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe TextInputHost.exe PID 4724 wrote to memory of 964 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe msedge.exe PID 4724 wrote to memory of 1492 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe msedge.exe PID 4724 wrote to memory of 2404 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe msedge.exe PID 4724 wrote to memory of 4040 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe msedge.exe PID 4724 wrote to memory of 1816 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe msedge.exe PID 4724 wrote to memory of 4664 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe RuntimeBroker.exe PID 4724 wrote to memory of 1820 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe RuntimeBroker.exe PID 4724 wrote to memory of 1496 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe backgroundTaskHost.exe PID 4724 wrote to memory of 4748 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe backgroundTaskHost.exe PID 4724 wrote to memory of 2312 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe netsh.exe PID 4724 wrote to memory of 2312 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe netsh.exe PID 4724 wrote to memory of 3776 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe PID 4724 wrote to memory of 3776 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe PID 4724 wrote to memory of 3776 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe PID 4724 wrote to memory of 3776 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe PID 4724 wrote to memory of 3776 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe PID 4724 wrote to memory of 3776 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe PID 4724 wrote to memory of 3776 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe PID 4724 wrote to memory of 3776 4724 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe PID 3776 wrote to memory of 1840 3776 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe PID 3776 wrote to memory of 1840 3776 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe PID 3776 wrote to memory of 1840 3776 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe PID 3776 wrote to memory of 1840 3776 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe PID 3776 wrote to memory of 1840 3776 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe PID 3776 wrote to memory of 1840 3776 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe PID 3776 wrote to memory of 1840 3776 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe PID 1840 wrote to memory of 3536 1840 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Explorer.EXE PID 1840 wrote to memory of 3536 1840 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Explorer.EXE PID 1840 wrote to memory of 3536 1840 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Explorer.EXE PID 1840 wrote to memory of 3536 1840 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:384
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2508
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2516
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2656
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe"2⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4724 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2312
-
-
C:\Users\Admin\AppData\Local\Temp\0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1840
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3656
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3832
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3928
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3996
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1276
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3764
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:416
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4976
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵PID:964
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.92 --initial-client-data=0x240,0x244,0x248,0x23c,0x2b0,0x7ffe09c94ef8,0x7ffe09c94f04,0x7ffe09c94f102⤵PID:1492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2276,i,16866810346450717340,3849854439116899380,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:22⤵PID:2404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1936,i,16866810346450717340,3849854439116899380,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:32⤵PID:4040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2248,i,16866810346450717340,3849854439116899380,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:82⤵PID:1816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4356,i,16866810346450717340,3849854439116899380,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:82⤵PID:2536
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4664
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1820
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:1496
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4748
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1