Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 21:47
Static task
static1
Behavioral task
behavioral1
Sample
0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe
-
Size
100KB
-
MD5
0fa5d41dba4b38724ad0307e3197753e
-
SHA1
fefb06dbcbe703debb9b4f0e9162d89ffe303f43
-
SHA256
9c43b14b790ed1111a4fe6a613df8c5050bda9d79cf6833641c5dd48245fb725
-
SHA512
ec5985534b5eb09977831a4fc29bb1a22dc8cbb196f256b7cfda7ed85d272a9afbea45cdb6d292e0b365edc31a5551e5c65add6e0530a95b053ea5893b00f8d3
-
SSDEEP
1536:QLnuwmEhIrTXDUSFMdCyf2VGLZQtChI5aj4Yfuyl2+R7eujVTKpiZ6RNStbJEdZj:BwmRe/uVs/I8cYfu1WVTKioRNSJGdJ
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe -
Processes:
0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe -
Processes:
0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe -
Disables Task Manager via registry modification
-
Processes:
resource yara_rule behavioral2/memory/4480-1-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-9-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-4-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-12-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-13-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-8-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-7-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-3-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-14-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-15-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-16-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-17-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-18-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-19-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-20-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-22-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-23-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-24-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-26-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-27-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-29-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-31-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-34-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-36-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-38-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-41-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-40-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-42-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-43-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-45-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-47-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-54-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-55-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-57-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-59-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-61-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-62-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-65-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-67-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-69-0x0000000002200000-0x000000000328E000-memory.dmp upx behavioral2/memory/4480-70-0x0000000002200000-0x000000000328E000-memory.dmp upx -
Processes:
0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe -
Processes:
0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exedescription ioc process File opened (read-only) \??\W: 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened (read-only) \??\Z: 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened (read-only) \??\E: 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened (read-only) \??\L: 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened (read-only) \??\T: 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened (read-only) \??\V: 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened (read-only) \??\G: 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened (read-only) \??\K: 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened (read-only) \??\M: 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened (read-only) \??\Y: 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened (read-only) \??\N: 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened (read-only) \??\O: 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened (read-only) \??\S: 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened (read-only) \??\U: 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened (read-only) \??\Q: 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened (read-only) \??\R: 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened (read-only) \??\X: 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened (read-only) \??\H: 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened (read-only) \??\I: 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened (read-only) \??\J: 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened (read-only) \??\P: 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exedescription ioc process File opened for modification C:\autorun.inf 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened for modification F:\autorun.inf 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe -
Drops file in Program Files directory 12 IoCs
Processes:
0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exedescription ioc process File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
Processes:
0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exepid process 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Token: SeDebugPrivilege 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exedescription pid process target process PID 4480 wrote to memory of 772 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe fontdrvhost.exe PID 4480 wrote to memory of 780 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe fontdrvhost.exe PID 4480 wrote to memory of 60 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe dwm.exe PID 4480 wrote to memory of 2520 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe sihost.exe PID 4480 wrote to memory of 2560 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe svchost.exe PID 4480 wrote to memory of 2668 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe taskhostw.exe PID 4480 wrote to memory of 3488 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Explorer.EXE PID 4480 wrote to memory of 3692 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe svchost.exe PID 4480 wrote to memory of 3892 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe DllHost.exe PID 4480 wrote to memory of 3984 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe StartMenuExperienceHost.exe PID 4480 wrote to memory of 4052 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe RuntimeBroker.exe PID 4480 wrote to memory of 764 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe SearchApp.exe PID 4480 wrote to memory of 3048 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe RuntimeBroker.exe PID 4480 wrote to memory of 4092 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe RuntimeBroker.exe PID 4480 wrote to memory of 4520 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe TextInputHost.exe PID 4480 wrote to memory of 772 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe fontdrvhost.exe PID 4480 wrote to memory of 780 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe fontdrvhost.exe PID 4480 wrote to memory of 60 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe dwm.exe PID 4480 wrote to memory of 2520 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe sihost.exe PID 4480 wrote to memory of 2560 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe svchost.exe PID 4480 wrote to memory of 2668 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe taskhostw.exe PID 4480 wrote to memory of 3488 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Explorer.EXE PID 4480 wrote to memory of 3692 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe svchost.exe PID 4480 wrote to memory of 3892 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe DllHost.exe PID 4480 wrote to memory of 3984 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe StartMenuExperienceHost.exe PID 4480 wrote to memory of 4052 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe RuntimeBroker.exe PID 4480 wrote to memory of 764 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe SearchApp.exe PID 4480 wrote to memory of 3048 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe RuntimeBroker.exe PID 4480 wrote to memory of 4092 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe RuntimeBroker.exe PID 4480 wrote to memory of 4520 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe TextInputHost.exe PID 4480 wrote to memory of 772 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe fontdrvhost.exe PID 4480 wrote to memory of 780 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe fontdrvhost.exe PID 4480 wrote to memory of 60 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe dwm.exe PID 4480 wrote to memory of 2520 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe sihost.exe PID 4480 wrote to memory of 2560 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe svchost.exe PID 4480 wrote to memory of 2668 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe taskhostw.exe PID 4480 wrote to memory of 3488 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Explorer.EXE PID 4480 wrote to memory of 3692 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe svchost.exe PID 4480 wrote to memory of 3892 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe DllHost.exe PID 4480 wrote to memory of 3984 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe StartMenuExperienceHost.exe PID 4480 wrote to memory of 4052 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe RuntimeBroker.exe PID 4480 wrote to memory of 764 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe SearchApp.exe PID 4480 wrote to memory of 3048 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe RuntimeBroker.exe PID 4480 wrote to memory of 4092 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe RuntimeBroker.exe PID 4480 wrote to memory of 4520 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe TextInputHost.exe PID 4480 wrote to memory of 772 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe fontdrvhost.exe PID 4480 wrote to memory of 780 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe fontdrvhost.exe PID 4480 wrote to memory of 60 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe dwm.exe PID 4480 wrote to memory of 2520 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe sihost.exe PID 4480 wrote to memory of 2560 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe svchost.exe PID 4480 wrote to memory of 2668 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe taskhostw.exe PID 4480 wrote to memory of 3488 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe Explorer.EXE PID 4480 wrote to memory of 3692 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe svchost.exe PID 4480 wrote to memory of 3892 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe DllHost.exe PID 4480 wrote to memory of 3984 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe StartMenuExperienceHost.exe PID 4480 wrote to memory of 4052 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe RuntimeBroker.exe PID 4480 wrote to memory of 764 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe SearchApp.exe PID 4480 wrote to memory of 3048 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe RuntimeBroker.exe PID 4480 wrote to memory of 4092 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe RuntimeBroker.exe PID 4480 wrote to memory of 4520 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe TextInputHost.exe PID 4480 wrote to memory of 772 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe fontdrvhost.exe PID 4480 wrote to memory of 780 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe fontdrvhost.exe PID 4480 wrote to memory of 60 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe dwm.exe PID 4480 wrote to memory of 2520 4480 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe sihost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:60
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2520
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2560
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2668
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4480
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3692
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3892
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3984
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4052
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:764
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3048
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4092
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4520
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5c2b2c56f1ea64f7fe34c16010d258a71
SHA12a2d23bb06435fd0ff8a4de85b76fe4575d487f1
SHA256bc92033f9d80854dcb81d99140968fe4337732fa7f8350864bdd54bf37d9b886
SHA512288cb3c4a3e29274edc788fffac45e34004fba2f10d98a7156c8dd0ef37dc13a93c0a418d2f6f3fbb5766071098b0842ade47c04cfe91cd16d950bf1422baebe