Malware Analysis Report

2024-11-16 13:15

Sample ID 240625-hbrjysvdqe
Target 0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118
SHA256 183ebaf0c0091ad6267a504cf2bccf89fb29ffd355862d40ab17cb5478f26036
Tags
upx sality backdoor evasion trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

183ebaf0c0091ad6267a504cf2bccf89fb29ffd355862d40ab17cb5478f26036

Threat Level: Known bad

The file 0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

upx sality backdoor evasion trojan

Modifies firewall policy service

Sality

Windows security bypass

UAC bypass

Identifies Wine through registry keys

Windows security modification

UPX packed file

Enumerates connected drives

Checks whether UAC is enabled

Drops autorun.inf file

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

System policy modification

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-25 06:34

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 06:34

Reported

2024-06-25 06:36

Platform

win7-20240508-en

Max time kernel

123s

Max time network

122s

Command Line

"taskhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Software\Wow6432Node\Wine C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2072 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2072 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2072 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2072 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2072 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2072 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2072 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2072 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2072 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2072 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2072 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2072 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2072 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2072 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2072 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2072 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2072 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2072 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2072 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2072 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2072 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2072 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2072 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2072 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2072 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2072 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2072 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2072 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2072 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2072 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2072 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2072 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2072 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2072 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2072 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2072 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2072 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2072 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2072 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2072 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2072 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2072 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2072 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2072 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2072 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2072 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2072 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2072 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\DllHost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 update.utorrent.com udp
US 8.8.8.8:53 update.utorrent.com udp
US 8.8.8.8:53 download.utorrent.com udp
US 8.8.8.8:53 update.utorrent.com udp

Files

memory/2072-0-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/2072-1-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-4-0x00000000003B0000-0x00000000003B4000-memory.dmp

memory/2072-3-0x00000000003B0000-0x00000000003B4000-memory.dmp

memory/2072-2-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-6-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-7-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-11-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-14-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-8-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-15-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-35-0x0000000005760000-0x0000000005761000-memory.dmp

memory/2072-37-0x0000000005750000-0x0000000005752000-memory.dmp

memory/2072-36-0x0000000005750000-0x0000000005752000-memory.dmp

memory/2072-34-0x00000000003B0000-0x00000000003B4000-memory.dmp

memory/2072-33-0x00000000003B0000-0x00000000003B4000-memory.dmp

memory/2072-30-0x0000000005760000-0x0000000005761000-memory.dmp

memory/2072-29-0x0000000005750000-0x0000000005752000-memory.dmp

memory/1068-21-0x0000000000210000-0x0000000000212000-memory.dmp

memory/2072-20-0x00000000003B0000-0x00000000003B4000-memory.dmp

memory/2072-13-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-19-0x00000000003B0000-0x00000000003B4000-memory.dmp

memory/2072-18-0x00000000003B0000-0x00000000003B4000-memory.dmp

memory/2072-17-0x00000000003B0000-0x00000000003B4000-memory.dmp

memory/2072-16-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-39-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-38-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-40-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-42-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-41-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-44-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-45-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-46-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-48-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-50-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/2072-51-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-64-0x00000000078C0000-0x00000000078C1000-memory.dmp

memory/2072-65-0x00000000062F0000-0x00000000062F2000-memory.dmp

memory/2072-66-0x00000000062F0000-0x00000000062F2000-memory.dmp

memory/2072-67-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-68-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-70-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-72-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-77-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/2072-82-0x0000000002220000-0x00000000032AE000-memory.dmp

memory/2072-101-0x0000000005750000-0x0000000005752000-memory.dmp

F:\txjj.pif

MD5 e4910a82f924a63ded424aedfea1cd44
SHA1 29cc34f3363a92ce7a5267d7e833f6c1d0272897
SHA256 5f015d74b6ad2034a4828b2b69beba794d8ac6b89af31785b6cc9bb97079d8ec
SHA512 c46b65178f82bf3aa373d645b4ca0180afedd6cd14b68361eee6b372b02ca7aa8912e2ac00dd61e6167d24da4e1e25aeb61b24bbc70634ca80f5186df328f0f5

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 06:34

Reported

2024-06-25 06:36

Platform

win10v2004-20240508-en

Max time kernel

123s

Max time network

150s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Wine C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4656 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4656 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4656 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 4656 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 4656 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4656 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 4656 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4656 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4656 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 4656 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4656 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4656 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4656 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4656 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4656 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4656 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4656 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4656 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 4656 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 4656 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4656 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 4656 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4656 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4656 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 4656 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4656 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4656 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4656 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4656 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4656 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4656 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4656 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4656 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 4656 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 4656 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4656 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 4656 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4656 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4656 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 4656 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4656 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4656 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4656 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4656 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4656 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4656 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4656 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4656 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 4656 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 4656 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4656 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 4656 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4656 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4656 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 4656 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4656 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4656 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4656 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4656 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4656 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4656 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4656 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4656 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 4656 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe C:\Windows\system32\sihost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0d0f98c4b130db29aef6c82689dafa52_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 update.utorrent.com udp
US 8.8.8.8:53 update.utorrent.com udp
US 8.8.8.8:53 download.utorrent.com udp
US 8.8.8.8:53 update.utorrent.com udp

Files

memory/4656-0-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/4656-1-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-4-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-7-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-11-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-25-0x0000000000850000-0x0000000000854000-memory.dmp

memory/4656-26-0x0000000000850000-0x0000000000854000-memory.dmp

memory/4656-8-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-24-0x0000000000850000-0x0000000000854000-memory.dmp

memory/4656-23-0x0000000000850000-0x0000000000854000-memory.dmp

memory/4656-21-0x0000000000850000-0x0000000000854000-memory.dmp

memory/4656-20-0x0000000000850000-0x0000000000854000-memory.dmp

memory/4656-19-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/4656-15-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-14-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/4656-13-0x0000000000850000-0x0000000000854000-memory.dmp

memory/4656-12-0x0000000000850000-0x0000000000854000-memory.dmp

memory/4656-6-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-5-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-10-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/4656-9-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/4656-3-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-22-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-28-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-27-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-29-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-30-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-31-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-33-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-34-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/4656-35-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-37-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-38-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-40-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-42-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-43-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-45-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-51-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-53-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-56-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-57-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/4656-58-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-65-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-66-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-70-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-71-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/4656-72-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-75-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-77-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-78-0x0000000002BA0000-0x0000000003C2E000-memory.dmp

memory/4656-83-0x00000000001E0000-0x00000000001E2000-memory.dmp

F:\ibqif.exe

MD5 6fb07c7935bb7608e00c1b5396281aac
SHA1 ab489fa4c48157bc6255a30af3fa6a2b8df7083e
SHA256 83ffea34a1d98df0725b41f3e04e177ca853d689d978b596b22b4bf43efadbfa
SHA512 6609f3701a2014e7d12bfe4530addb71021ebc3355acd4d56f4915faada89383ee78a9699bfb7e0661b991f96eb48c618dc2b03574a805e217ae5705f96eadcc