sality | aae63244c132711304d1a8c3274e986d18f9961c43d4dfc654458855eca68f2d

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Size 143KB
Sample240625-nc372awfkb
SHA256 aae63244c132711304d1a8c3274e986d18f9961c43d4dfc654458855eca68f2d
MD5 0ddce57fc7ae9be6f9b74c9fd06c0258
SHA1 ab68a976a87d77fd759e35b4903f1c7bf0ea7521
SHA512 d933947f6b70da268e5d26978e42a3af8aa0c03c8cd2a801ba6233d6e4c05c2bab417ab35500709af79f468e7498c96729fb1b077a741f6bd762f3e4707b3598
SSDEEP 3072:uYNQKPWDyaRefVJltZrpRl1P3KzGP4N0NcJl5zwTJqK+hl:3NSDyaRO1thpaOIGwK+hl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sality backdoor evasion persistence privilege_escalation trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif

Signatures

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe

Disables Task Manager via registry modification
evasion

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1308	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
4984	msedge.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1496-1-0x0000000002440000-0x0000000003470000-memory.dmp	upx
behavioral2/memory/1496-3-0x0000000002440000-0x0000000003470000-memory.dmp	upx
behavioral2/memory/1496-8-0x0000000002440000-0x0000000003470000-memory.dmp	upx
behavioral2/memory/1496-15-0x0000000002440000-0x0000000003470000-memory.dmp	upx
behavioral2/memory/1496-16-0x0000000002440000-0x0000000003470000-memory.dmp	upx
behavioral2/memory/1496-23-0x0000000002440000-0x0000000003470000-memory.dmp	upx
behavioral2/memory/1496-24-0x0000000002440000-0x0000000003470000-memory.dmp	upx
behavioral2/memory/1496-25-0x0000000002440000-0x0000000003470000-memory.dmp	upx
behavioral2/memory/1496-26-0x0000000002440000-0x0000000003470000-memory.dmp	upx
behavioral2/memory/1496-40-0x0000000002440000-0x0000000003470000-memory.dmp	upx
behavioral2/memory/1496-42-0x0000000002440000-0x0000000003470000-memory.dmp	upx
behavioral2/memory/1496-45-0x0000000002440000-0x0000000003470000-memory.dmp	upx
behavioral2/memory/1496-47-0x0000000002440000-0x0000000003470000-memory.dmp	upx
behavioral2/memory/1496-48-0x0000000002440000-0x0000000003470000-memory.dmp	upx
behavioral2/memory/1496-57-0x0000000002440000-0x0000000003470000-memory.dmp	upx
behavioral2/memory/1496-59-0x0000000002440000-0x0000000003470000-memory.dmp	upx
behavioral2/memory/1496-76-0x0000000002440000-0x0000000003470000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 784	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	8
PID 1496 wrote to memory of 792	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	9
PID 1496 wrote to memory of 1020	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	13
PID 1496 wrote to memory of 2416	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	41
PID 1496 wrote to memory of 2448	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	42
PID 1496 wrote to memory of 2584	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	47
PID 1496 wrote to memory of 3332	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	56
PID 1496 wrote to memory of 3548	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	57
PID 1496 wrote to memory of 3744	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	58
PID 1496 wrote to memory of 3868	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	59
PID 1496 wrote to memory of 3936	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	60
PID 1496 wrote to memory of 1308	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	89
PID 1496 wrote to memory of 1308	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	89
PID 1496 wrote to memory of 1308	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	89
PID 1496 wrote to memory of 4028	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	61
PID 1496 wrote to memory of 4188	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	62
PID 1496 wrote to memory of 3652	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	64
PID 1496 wrote to memory of 4576	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	74
PID 1496 wrote to memory of 3476	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	76
PID 1496 wrote to memory of 4916	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	77
PID 1496 wrote to memory of 4452	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	78
PID 1496 wrote to memory of 4260	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	79
PID 1496 wrote to memory of 2012	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	80
PID 1496 wrote to memory of 5016	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	82
PID 1496 wrote to memory of 4492	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	83
PID 1496 wrote to memory of 784	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	8
PID 1496 wrote to memory of 792	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	9
PID 1496 wrote to memory of 1020	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	13
PID 1496 wrote to memory of 2416	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	41
PID 1496 wrote to memory of 2448	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	42
PID 1496 wrote to memory of 2584	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	47
PID 1496 wrote to memory of 3332	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	56
PID 1496 wrote to memory of 3548	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	57
PID 1496 wrote to memory of 3744	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	58
PID 1496 wrote to memory of 3868	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	59
PID 1496 wrote to memory of 3936	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	60
PID 1496 wrote to memory of 4028	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	61
PID 1496 wrote to memory of 4188	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	62
PID 1496 wrote to memory of 3652	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	64
PID 1496 wrote to memory of 4576	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	74
PID 1496 wrote to memory of 3476	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	76
PID 1496 wrote to memory of 4916	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	77
PID 1496 wrote to memory of 4452	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	78
PID 1496 wrote to memory of 4260	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	79
PID 1496 wrote to memory of 2012	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	80
PID 1496 wrote to memory of 5016	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	82
PID 1496 wrote to memory of 4492	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	83
PID 1496 wrote to memory of 784	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	8
PID 1496 wrote to memory of 792	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	9
PID 1496 wrote to memory of 1020	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	13
PID 1496 wrote to memory of 2416	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	41
PID 1496 wrote to memory of 2448	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	42
PID 1496 wrote to memory of 2584	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	47
PID 1496 wrote to memory of 3332	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	56
PID 1496 wrote to memory of 3548	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	57
PID 1496 wrote to memory of 3744	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	58
PID 1496 wrote to memory of 3868	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	59
PID 1496 wrote to memory of 3936	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	60
PID 1496 wrote to memory of 4028	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	61
PID 1496 wrote to memory of 4188	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	62
PID 1496 wrote to memory of 3652	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	64
PID 1496 wrote to memory of 4576	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	74
PID 1496 wrote to memory of 3476	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	76
PID 1496 wrote to memory of 4916	1496	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe	77

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:792

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1020

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2448

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2584

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3332
- C:\Users\Admin\AppData\Local\Temp\0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0ddce57fc7ae9be6f9b74c9fd06c0258_JaffaCakes118.exe"
  2⤵
  - UAC bypass
  - Disables RegEdit via registry modification
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1496
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1308
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE"
    3⤵
    PID:2300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3548

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3744

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3868

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3936

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4028

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4188

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3652

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:4576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff89b692e98,0x7ff89b692ea4,0x7ff89b692eb0
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2688 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2984 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2852 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5400 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5416 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2368 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 3.9MB
SHA256 3d1266025af95bdb7b92d17debbf88a1386b19b7f7c2eeb9ced77debb9748e14
MD5 faf79a48399d502194e87a5ad1ba7b8e
SHA1 09cd9d783ac126d33ec37de781beedce9ce6aa51
SHA512 d84f8e25179e2cee6f95dc95c94a4a70dc56814aaf7f95e38f24f9828e64629cab0c184f5fddd67d834f419703f65d9d0e3a93e54d2730ed63d3d89644babb84
SSDEEP 49152:yjfjFYUQdZ86rfswN5TqMRc3iYOBRXDYvw9QkBb6IMqczsFhlkq2y/BO:LnxPWcc3iYc5lUqB2qI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1496-25-0x0000000002440000-0x0000000003470000-memory.dmp

Download

memory/1496-1-0x0000000002440000-0x0000000003470000-memory.dmp

Download

memory/1496-12-0x0000000000700000-0x0000000000702000-memory.dmp

Download

memory/1496-8-0x0000000002440000-0x0000000003470000-memory.dmp

Download

memory/1496-13-0x0000000000700000-0x0000000000702000-memory.dmp

Download

memory/1496-11-0x0000000000710000-0x0000000000711000-memory.dmp

Download

memory/1496-10-0x0000000000700000-0x0000000000702000-memory.dmp

Download

memory/1496-15-0x0000000002440000-0x0000000003470000-memory.dmp

Download

memory/1496-16-0x0000000002440000-0x0000000003470000-memory.dmp

Download

memory/1496-23-0x0000000002440000-0x0000000003470000-memory.dmp

Download

memory/1496-24-0x0000000002440000-0x0000000003470000-memory.dmp

Download

memory/1496-0-0x0000000001000000-0x0000000001027000-memory.dmp

Download

memory/1496-3-0x0000000002440000-0x0000000003470000-memory.dmp

Download

memory/1496-42-0x0000000002440000-0x0000000003470000-memory.dmp

Download

memory/1496-26-0x0000000002440000-0x0000000003470000-memory.dmp

Download

memory/1496-45-0x0000000002440000-0x0000000003470000-memory.dmp

Download

memory/1496-47-0x0000000002440000-0x0000000003470000-memory.dmp

Download

memory/1496-48-0x0000000002440000-0x0000000003470000-memory.dmp

Download

memory/1496-57-0x0000000002440000-0x0000000003470000-memory.dmp

Download

memory/1496-59-0x0000000002440000-0x0000000003470000-memory.dmp

Download

memory/1496-69-0x0000000000700000-0x0000000000702000-memory.dmp

Download

memory/1496-40-0x0000000002440000-0x0000000003470000-memory.dmp

Download

memory/1496-76-0x0000000002440000-0x0000000003470000-memory.dmp

Download

memory/2300-72-0x0000000000F50000-0x0000000000F67000-memory.dmp

Download

memory/2300-71-0x0000000000F50000-0x0000000000F67000-memory.dmp

Download