Malware Analysis Report

2024-11-16 13:12

Sample ID 240625-kpg9jssfrm
Target 0d6d361216466127e04d8c63f96987a3_JaffaCakes118
SHA256 6cd1913695aaa5566eff7b06a3f0a1a66e5a37937b591ef868e9253edb562bb4
Tags
sality backdoor evasion trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6cd1913695aaa5566eff7b06a3f0a1a66e5a37937b591ef868e9253edb562bb4

Threat Level: Known bad

The file 0d6d361216466127e04d8c63f96987a3_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion trojan upx

UAC bypass

Windows security bypass

Modifies firewall policy service

Sality

Windows security modification

Executes dropped EXE

UPX packed file

Checks whether UAC is enabled

Enumerates connected drives

Drops autorun.inf file

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-25 08:46

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 08:46

Reported

2024-06-25 08:49

Platform

win10v2004-20240226-en

Max time kernel

134s

Max time network

163s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4188 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4188 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4188 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 4188 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 4188 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4188 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 4188 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4188 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4188 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 4188 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4188 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4188 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4188 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4188 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4188 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4188 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4188 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4188 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4188 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4188 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4188 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4188 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4188 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4188 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4188 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 4188 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 4188 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4188 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 4188 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4188 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4188 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 4188 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4188 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4188 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4188 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4188 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4188 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4188 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4188 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4188 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4188 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4188 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4188 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4188 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4188 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4188 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4188 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 4188 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 4188 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4188 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 4188 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4188 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4188 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 4188 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4188 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4188 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4188 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4188 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4188 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4188 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4188 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4188 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4188 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4188 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffdb24e2e98,0x7ffdb24e2ea4,0x7ffdb24e2eb0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2268 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3228 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3336 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5396 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5524 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:1

C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1528 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 img.brothersoft.com udp
US 128.1.89.118:80 img.brothersoft.com tcp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 4.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 216.58.204.74:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 216.239.32.29:80 pki.goog tcp
US 8.8.8.8:53 i.pki.goog udp
US 8.8.8.8:53 i.pki.goog udp
GB 172.217.169.67:80 i.pki.goog tcp
US 8.8.8.8:53 29.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 208.143.182.52.in-addr.arpa udp

Files

memory/4188-0-0x0000000000400000-0x0000000000521000-memory.dmp

memory/4188-1-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-4-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-13-0x0000000004540000-0x0000000004542000-memory.dmp

memory/4188-11-0x0000000004540000-0x0000000004542000-memory.dmp

memory/4188-5-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-3-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-6-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-15-0x0000000004690000-0x0000000004691000-memory.dmp

memory/4188-14-0x0000000004540000-0x0000000004542000-memory.dmp

memory/4188-7-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-8-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-10-0x0000000002410000-0x000000000349E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0E580A4C_Rar\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe

MD5 568359768c0a2e7f09487425b158c67f
SHA1 edbe3f05a3499ae3a20d302afcb33d2a40ebae63
SHA256 c4eb51f2a0859788dad31aeaebf00f284e8c1cb71811e27c12b14a442a8a9a98
SHA512 f81cbc97289bf8e72ca907cc50fad8e3957b2038d100b7cd9a1e1caf72ee034b6c3c19932cc26b300a07f7bafc462315f27359b0c8246c010470381b3e233093

memory/4188-9-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-31-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-30-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-36-0x0000000002410000-0x000000000349E000-memory.dmp

C:\Users\Admin\AppData\Roaming\GetRightToGo\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.htm

MD5 33f09577707d079a40f706a18e126d92
SHA1 0cef1f55b72a84e584a51e79a6787ea78d74a603
SHA256 e7f6bd122fcb829793f4047a5b929668b0a91ebfe31247b479586ec6d8f2b378
SHA512 5538c5b4e538a97796bfc412b3a81449931a9bbc1fa4e69500a0b30b35c1259bda857f392d85d87893999098bc88a432f28d2f699fadc295709a75b8113933cb

memory/4188-40-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-39-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-42-0x0000000000400000-0x0000000000521000-memory.dmp

memory/4188-43-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-44-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-45-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-47-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-49-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-50-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-52-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-54-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-57-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-60-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-63-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-69-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-71-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-74-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-75-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-77-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-79-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-80-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-82-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-83-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-84-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-86-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-88-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-90-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-92-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4188-94-0x0000000004540000-0x0000000004542000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

MD5 faf79a48399d502194e87a5ad1ba7b8e
SHA1 09cd9d783ac126d33ec37de781beedce9ce6aa51
SHA256 3d1266025af95bdb7b92d17debbf88a1386b19b7f7c2eeb9ced77debb9748e14
SHA512 d84f8e25179e2cee6f95dc95c94a4a70dc56814aaf7f95e38f24f9828e64629cab0c184f5fddd67d834f419703f65d9d0e3a93e54d2730ed63d3d89644babb84

F:\giryhm.exe

MD5 e8efab89750fe84cc5ffd1c5627371de
SHA1 0411299f0028339c11738d09ed7430397f9d9e8e
SHA256 52ccfdbc9b0bb2216a30671792de797e03dc1869ad6212cb0632478797471808
SHA512 f64a907df2c09698db41250f0f8bbd56f70dcc2e8c0ab653a6b568afa60fd03ef903200100a78360d6b6f026a87759eee4cab73452c7ce621eca04fe35a6a673

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 08:46

Reported

2024-06-25 08:48

Platform

win7-20240508-en

Max time kernel

124s

Max time network

123s

Command Line

"taskhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2552 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2552 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2552 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2552 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2552 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2552 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2552 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2552 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2552 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2552 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2552 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2552 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2552 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2552 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2552 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2552 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2552 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2552 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2552 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2552 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2552 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2552 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2552 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2552 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2552 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2552 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2552 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2552 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2552 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2552 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2552 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2552 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2552 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2552 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2552 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2552 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2552 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2552 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2552 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2552 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2552 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2552 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2552 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2552 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2552 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2552 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2552 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2552 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2552 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2552 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2552 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2552 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe C:\Windows\system32\DllHost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 img.brothersoft.com udp
US 8.8.8.8:53 downloader.brothersoft.com udp

Files

memory/2552-0-0x0000000000400000-0x0000000000521000-memory.dmp

memory/2552-1-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-3-0x0000000001FA0000-0x000000000302E000-memory.dmp

C:\Users\Admin\AppData\Roaming\GetRightToGo\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.data0

MD5 9035c10e5ae5c97864f718390e8d4d6d
SHA1 a0eb10ca72add60213e55f8fc0520e27173e0f2d
SHA256 8bc59bd1d6e44fec14cf3eac9f331caa1f3f592f2ae3820bb79b58808fa5f7c4
SHA512 221e06f29df7e665556da4b4e1884c1cfc50d24a9ab2d4f982bc61d4a29f8c25caac2c837dc8b0e04b8e10cf04f322e2c74792307c9223f4980060ba850e4d51

C:\Users\Admin\AppData\Local\Temp\0F762F4A_Rar\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.exe

MD5 568359768c0a2e7f09487425b158c67f
SHA1 edbe3f05a3499ae3a20d302afcb33d2a40ebae63
SHA256 c4eb51f2a0859788dad31aeaebf00f284e8c1cb71811e27c12b14a442a8a9a98
SHA512 f81cbc97289bf8e72ca907cc50fad8e3957b2038d100b7cd9a1e1caf72ee034b6c3c19932cc26b300a07f7bafc462315f27359b0c8246c010470381b3e233093

memory/2552-21-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-44-0x0000000005410000-0x0000000005412000-memory.dmp

C:\Users\Admin\AppData\Roaming\GetRightToGo\0d6d361216466127e04d8c63f96987a3_JaffaCakes118.htm

MD5 33f09577707d079a40f706a18e126d92
SHA1 0cef1f55b72a84e584a51e79a6787ea78d74a603
SHA256 e7f6bd122fcb829793f4047a5b929668b0a91ebfe31247b479586ec6d8f2b378
SHA512 5538c5b4e538a97796bfc412b3a81449931a9bbc1fa4e69500a0b30b35c1259bda857f392d85d87893999098bc88a432f28d2f699fadc295709a75b8113933cb

memory/2552-37-0x0000000005410000-0x0000000005412000-memory.dmp

memory/2552-22-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-20-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-19-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-35-0x0000000005560000-0x0000000005561000-memory.dmp

memory/2552-33-0x0000000005560000-0x0000000005561000-memory.dmp

memory/2552-32-0x0000000005410000-0x0000000005412000-memory.dmp

memory/1108-24-0x0000000000320000-0x0000000000322000-memory.dmp

memory/2552-6-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-23-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-5-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-4-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-58-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-57-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-59-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-60-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-61-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-67-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-68-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-69-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-71-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-73-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-75-0x0000000000400000-0x0000000000521000-memory.dmp

memory/2552-91-0x0000000009470000-0x0000000009472000-memory.dmp

memory/2552-76-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-89-0x0000000009470000-0x0000000009472000-memory.dmp

memory/2552-88-0x00000000095C0000-0x00000000095C1000-memory.dmp

memory/2552-90-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-94-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-95-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-98-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-100-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-101-0x0000000001FA0000-0x000000000302E000-memory.dmp

memory/2552-121-0x0000000005410000-0x0000000005412000-memory.dmp

memory/2552-146-0x0000000009470000-0x0000000009472000-memory.dmp

C:\ukyp.pif

MD5 cca45c0e674c55d15b2179f20781dfaa
SHA1 55d2bfccbad5fd2a14ac5b502dbeaf8abcc68526
SHA256 1420725d9430a739592744389013893badb66bc9cb9d62bbdc7dc15447fd3013
SHA512 354881f6c0cb38ddf83976abd8caef19f9e51dc4eb8ae5d1bf7f8b792f9fcb5ce8cffccd013ace252d75424ec85496f3a3b9539d0de5e92a3e941d7daa617ed2