Analysis
-
max time kernel
140s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 23:25
Static task
static1
Behavioral task
behavioral1
Sample
0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe
-
Size
130KB
-
MD5
0feae239544bd76c67dc8c5db4939714
-
SHA1
fa0c7b240735557f45d48b28556d4c47cefd4a02
-
SHA256
531f95c4f1a3b67b2a6f1dfd88505d5fce9779d472abd0232aeedea6244c570a
-
SHA512
dd37243b71bc8f9d0b42728644da404e98bdcae221666ca86f7a298094759faed30856da82b67bf6b822b5b66d2aa29082991d6c474887cfab31ca1bb48a1414
-
SSDEEP
3072:Ebqb3j/8/bPHd/hghE27CxOlCbgyxIB/QQTBTU:2G3D6bPthgq27UOV+IBoOTU
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Processes:
0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe -
Processes:
0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe -
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 224 netsh.exe -
Processes:
resource yara_rule behavioral2/memory/4756-4-0x00000000028F0000-0x0000000003922000-memory.dmp upx behavioral2/memory/4756-7-0x00000000028F0000-0x0000000003922000-memory.dmp upx behavioral2/memory/4756-0-0x00000000028F0000-0x0000000003922000-memory.dmp upx behavioral2/memory/4756-18-0x00000000028F0000-0x0000000003922000-memory.dmp upx behavioral2/memory/4756-21-0x00000000028F0000-0x0000000003922000-memory.dmp upx -
Processes:
0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe -
Processes:
0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
Processes:
0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1320 4756 WerFault.exe 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exepid process 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Token: SeDebugPrivilege 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exedescription pid process target process PID 4756 wrote to memory of 224 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe netsh.exe PID 4756 wrote to memory of 224 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe netsh.exe PID 4756 wrote to memory of 224 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe netsh.exe PID 4756 wrote to memory of 808 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe fontdrvhost.exe PID 4756 wrote to memory of 812 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe fontdrvhost.exe PID 4756 wrote to memory of 380 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe dwm.exe PID 4756 wrote to memory of 2812 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe sihost.exe PID 4756 wrote to memory of 2864 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe svchost.exe PID 4756 wrote to memory of 3012 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe taskhostw.exe PID 4756 wrote to memory of 3536 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe Explorer.EXE PID 4756 wrote to memory of 3640 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe svchost.exe PID 4756 wrote to memory of 3832 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe DllHost.exe PID 4756 wrote to memory of 3972 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe StartMenuExperienceHost.exe PID 4756 wrote to memory of 4040 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe RuntimeBroker.exe PID 4756 wrote to memory of 728 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe SearchApp.exe PID 4756 wrote to memory of 3664 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe RuntimeBroker.exe PID 4756 wrote to memory of 4204 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe TextInputHost.exe PID 4756 wrote to memory of 1416 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe RuntimeBroker.exe PID 4756 wrote to memory of 4376 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe backgroundTaskHost.exe PID 4756 wrote to memory of 4840 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe backgroundTaskHost.exe PID 4756 wrote to memory of 224 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe netsh.exe PID 4756 wrote to memory of 224 4756 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe netsh.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:808
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:812
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:380
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2812
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2864
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3012
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0feae239544bd76c67dc8c5db4939714_JaffaCakes118.exe"2⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4756 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 9923⤵
- Program crash
PID:1320
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3640
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3832
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3972
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4040
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:728
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3664
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4204
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1416
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4376
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4756 -ip 47561⤵PID:4328
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1