Malware Analysis Report

2024-11-16 13:14

Sample ID 240625-1nafbaxgll
Target 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118
SHA256 9c43b14b790ed1111a4fe6a613df8c5050bda9d79cf6833641c5dd48245fb725
Tags
sality backdoor evasion trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9c43b14b790ed1111a4fe6a613df8c5050bda9d79cf6833641c5dd48245fb725

Threat Level: Known bad

The file 0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion trojan upx

Modifies firewall policy service

Sality

Windows security bypass

UAC bypass

Disables Task Manager via registry modification

Disables RegEdit via registry modification

Windows security modification

UPX packed file

Checks whether UAC is enabled

Enumerates connected drives

Drops autorun.inf file

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies registry class

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-25 21:47

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 21:47

Reported

2024-06-25 21:49

Platform

win7-20240508-en

Max time kernel

148s

Max time network

122s

Command Line

"taskhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Disables Task Manager via registry modification

evasion

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2184 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2184 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2184 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2184 wrote to memory of 108 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2184 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2184 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2184 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2184 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2184 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2184 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2184 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2184 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2184 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2184 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2184 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2184 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2184 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2184 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2184 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2184 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2184 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2184 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2184 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2184 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2184 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2184 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2184 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2184 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2184 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2184 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2184 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2184 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2184 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2184 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2184 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2184 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2184 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2184 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2184 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2184 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2184 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2184 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2184 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2184 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2184 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2184 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\Explorer.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe"

Network

N/A

Files

memory/2184-0-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2184-1-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-3-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-5-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-7-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-6-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-10-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-8-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-9-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-4-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/1108-11-0x0000000001F10000-0x0000000001F12000-memory.dmp

memory/2184-18-0x0000000003820000-0x0000000003822000-memory.dmp

memory/2184-21-0x0000000003830000-0x0000000003831000-memory.dmp

memory/2184-19-0x0000000003830000-0x0000000003831000-memory.dmp

memory/2184-23-0x0000000003820000-0x0000000003822000-memory.dmp

memory/2184-22-0x0000000003820000-0x0000000003822000-memory.dmp

memory/2184-24-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-25-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-26-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-28-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-27-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-30-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-31-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-32-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-35-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-37-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-38-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-39-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-47-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-48-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-49-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-51-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-52-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-53-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-60-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-61-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-64-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-65-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-68-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2184-81-0x0000000003820000-0x0000000003822000-memory.dmp

C:\fpyh.pif

MD5 dbcdf13f2c18743f8d9646b2ae4d28a9
SHA1 db0ac7bfea29032bb9d93342f721097264afb519
SHA256 94a7e0a5749b3df99add4241b144ff0efa3c48b66a7d90382d421e3812b20b68
SHA512 dbd51acb6fdb64b458d07e7ef4aebe9813716d0cb141e1dad88427cc77d1c780b222b72e8bfb6903be2a89d3c69bfa7a603d823e923753ca12b52cdef5a22168

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 21:47

Reported

2024-06-25 21:49

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

153s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Disables Task Manager via registry modification

evasion

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4480 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4480 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4480 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 4480 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 4480 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4480 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 4480 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4480 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4480 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 4480 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4480 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4480 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4480 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4480 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4480 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4480 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4480 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4480 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 4480 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 4480 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4480 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 4480 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4480 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4480 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 4480 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4480 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4480 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4480 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4480 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4480 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4480 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4480 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4480 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 4480 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 4480 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4480 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 4480 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4480 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4480 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 4480 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4480 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4480 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4480 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4480 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4480 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4480 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4480 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4480 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 4480 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 4480 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4480 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 4480 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4480 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4480 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 4480 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4480 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4480 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4480 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4480 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4480 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4480 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4480 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4480 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 4480 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe C:\Windows\system32\sihost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0fa5d41dba4b38724ad0307e3197753e_JaffaCakes118.exe"

Network

Files

memory/4480-0-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4480-1-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-10-0x0000000000730000-0x0000000000732000-memory.dmp

memory/4480-9-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-4-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-12-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-13-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-8-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-7-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-11-0x0000000000730000-0x0000000000732000-memory.dmp

memory/4480-6-0x0000000000740000-0x0000000000741000-memory.dmp

memory/4480-5-0x0000000000730000-0x0000000000732000-memory.dmp

memory/4480-3-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-14-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-15-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-16-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-17-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-18-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-19-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-20-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-22-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-23-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-24-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-26-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-27-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-29-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-31-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-34-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-36-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-38-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-41-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-40-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-42-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-43-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-45-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-47-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-54-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-55-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-57-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-59-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-61-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-62-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-63-0x0000000000730000-0x0000000000732000-memory.dmp

memory/4480-65-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-67-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-69-0x0000000002200000-0x000000000328E000-memory.dmp

memory/4480-70-0x0000000002200000-0x000000000328E000-memory.dmp

F:\tekgpc.exe

MD5 c2b2c56f1ea64f7fe34c16010d258a71
SHA1 2a2d23bb06435fd0ff8a4de85b76fe4575d487f1
SHA256 bc92033f9d80854dcb81d99140968fe4337732fa7f8350864bdd54bf37d9b886
SHA512 288cb3c4a3e29274edc788fffac45e34004fba2f10d98a7156c8dd0ef37dc13a93c0a418d2f6f3fbb5766071098b0842ade47c04cfe91cd16d950bf1422baebe