Analysis
- max time kernel
147s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
25/06/2024, 12:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
General
- Target 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe
- Size 255KB
- Sample240625-pha9wasdlk
- SHA256 c774f3dca844e6fc31b1b23328fcc10860f30d2fccab118bea20d601779ae112
- MD5 0e0b392d511d9c14d51fff720b3f3d9e
- SHA1 a7e78a574012637e6c300dba2f482a94e6ecfb65
- SHA512 d003310d9ece75978b4c18f5f735da935db4411df3898a6d2df0289260780d1116347ebd186951d052fd25b18e61bf4c50777d8e559584651cff210932a4cbad
- SSDEEP 3072:HunxwgxgfR/DVG7wBpErzWRVoYc0WnqAdelWGPRSOLjK+ca1x:G+xDVG0BpE+lAvepSOLjAMx
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
-
http://klkjwre77638dfqwieuoi888.info/
Signatures
- Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe - Disables Task Manager via registry modification
- Executes dropped EXE 1 IoCs
pid Process 1012 WaterMark.exe -
resource yara_rule behavioral2/memory/4720-6-0x00000000031B0000-0x000000000423E000-memory.dmp upx behavioral2/memory/4720-11-0x00000000031B0000-0x000000000423E000-memory.dmp upx behavioral2/memory/4720-20-0x00000000031B0000-0x000000000423E000-memory.dmp upx behavioral2/memory/4720-23-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4720-17-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4720-5-0x00000000031B0000-0x000000000423E000-memory.dmp upx behavioral2/memory/1012-39-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1012-37-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4720-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4720-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4720-9-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4720-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4720-2-0x00000000031B0000-0x000000000423E000-memory.dmp upx behavioral2/memory/4720-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1012-45-0x0000000000400000-0x0000000000421000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px5DDF.tmp 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{29E36570-32ED-11EF-B1BA-7AB36BF646CA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{29E5C7B0-32ED-11EF-B1BA-7AB36BF646CA} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115001" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4267236491" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4267236491" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115001" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4269893050" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4269893050" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4267236491" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426082941" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115001" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115001" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115001" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4267236491" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115001" IEXPLORE.EXE - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe - Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 1012 WaterMark.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4392 iexplore.exe 2504 iexplore.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4392 iexplore.exe 2504 iexplore.exe 4392 iexplore.exe 2504 iexplore.exe 4776 IEXPLORE.EXE 4776 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 4776 IEXPLORE.EXE 4776 IEXPLORE.EXE - Suspicious use of UnmapMainImage 2 IoCs
pid Process 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 1012 WaterMark.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4720 wrote to memory of 796 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 9 PID 4720 wrote to memory of 800 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 10 PID 4720 wrote to memory of 388 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 13 PID 4720 wrote to memory of 2544 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 44 PID 4720 wrote to memory of 2648 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 45 PID 4720 wrote to memory of 2872 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 51 PID 4720 wrote to memory of 3484 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 55 PID 4720 wrote to memory of 1012 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 83 PID 4720 wrote to memory of 1012 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 83 PID 4720 wrote to memory of 1012 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 83 PID 1012 wrote to memory of 4080 1012 WaterMark.exe 84 PID 1012 wrote to memory of 4080 1012 WaterMark.exe 84 PID 1012 wrote to memory of 4080 1012 WaterMark.exe 84 PID 1012 wrote to memory of 4080 1012 WaterMark.exe 84 PID 1012 wrote to memory of 4080 1012 WaterMark.exe 84 PID 1012 wrote to memory of 4080 1012 WaterMark.exe 84 PID 1012 wrote to memory of 4080 1012 WaterMark.exe 84 PID 1012 wrote to memory of 4080 1012 WaterMark.exe 84 PID 1012 wrote to memory of 4080 1012 WaterMark.exe 84 PID 1012 wrote to memory of 4392 1012 WaterMark.exe 85 PID 1012 wrote to memory of 4392 1012 WaterMark.exe 85 PID 1012 wrote to memory of 2504 1012 WaterMark.exe 86 PID 1012 wrote to memory of 2504 1012 WaterMark.exe 86 PID 4392 wrote to memory of 4776 4392 iexplore.exe 88 PID 4392 wrote to memory of 4776 4392 iexplore.exe 88 PID 4392 wrote to memory of 4776 4392 iexplore.exe 88 PID 2504 wrote to memory of 2392 2504 iexplore.exe 87 PID 2504 wrote to memory of 2392 2504 iexplore.exe 87 PID 2504 wrote to memory of 2392 2504 iexplore.exe 87 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:388
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2544
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2648
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2872
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4720 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵PID:4080
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4392 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4776
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2392
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\WaterMark.exe
- Size 255KB
- SHA256 c774f3dca844e6fc31b1b23328fcc10860f30d2fccab118bea20d601779ae112
- MD5 0e0b392d511d9c14d51fff720b3f3d9e
- SHA1 a7e78a574012637e6c300dba2f482a94e6ecfb65
- SHA512 d003310d9ece75978b4c18f5f735da935db4411df3898a6d2df0289260780d1116347ebd186951d052fd25b18e61bf4c50777d8e559584651cff210932a4cbad
- SSDEEP 3072:HunxwgxgfR/DVG7wBpErzWRVoYc0WnqAdelWGPRSOLjK+ca1x:G+xDVG0BpE+lAvepSOLjAMx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 471B
- SHA256 4d16bb8c9a34d4de9d39bb5f0e87095617b5ad551112db17b38b6cb752fbdae4
- MD5 b9b9f42ce6d2b20bf169d05480d239d4
- SHA1 32b094cc2ff79f07fcd68d585846b919bc350e4d
- SHA512 36b45c544439c6b1fab4c2fa58712475a65ad467e3da61086c4a953d6587d35f5c6ae7de740863295ae0d3534cbf67d0bed6843d95b6786b50431bfeebcf1010
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 404B
- SHA256 3ddaba87242701d8328097672c75ed59f9a36a1449225a682c3e41d945580ca0
- MD5 e4d1807ec461b54cbe1a9e89279159ce
- SHA1 6a49612b815b5c5e658f5a8e7118dcca078905fb
- SHA512 b6cdd9184ba99ba7286c7d3514bacf6949bfaa4e8095e2b1336707844bdd0b489a4dfcc97b9d1de293d67e2bfeeb1ca21d75df92144a2c505ba1c5ec53be2ed1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{29E36570-32ED-11EF-B1BA-7AB36BF646CA}.dat
- Size 5KB
- SHA256 3d870ec6ec7f9b24f863bd7fe937cbcd30dc470d7d8b246e20c5bf2fa8f7097c
- MD5 c5d1e0ee09398a15c728414f5257a09b
- SHA1 0132550cb03cdd3ef2c82640db3446f49117ce73
- SHA512 c191354161e3dd64d9f590750280cfbe83725e4ae1e18d962138db022077736db744607fbef93629400faf45daf05c42da5e71cd0343e2632ecc3295ab862fa3
- SSDEEP 24:rRGo/Q+RGo/aL879lWpWCWAWTlUKtWr9lWpWCWAWTlUKtWdtW:rRGo4yGoZCAl9rAl9g
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{29E5C7B0-32ED-11EF-B1BA-7AB36BF646CA}.dat
- Size 3KB
- SHA256 74709942fa37d9d615062c7d6161f4a1f0413d45fd181de095beef6bd86de239
- MD5 9a9ec7a6029bf6ca7de23837470cc91c
- SHA1 576cf0705ea0db893f82d713191b5e6984fc5f60
- SHA512 2c52d121413102ee33531b94bb692ac8692deccac23ef123b43f46647d25fcedb8d246aaff4db5acbb56b74a0abe551756941da78a9c8543543eb3de3b57ed4e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verE3F7.tmp
- Size 15KB
- SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
- MD5 1a545d0052b581fbb2ab4c52133846bc
- SHA1 62f3266a9b9925cd6d98658b92adec673cbe3dd3
- SHA512 bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
- SSDEEP 384:79Jv9DF9/C9qc9/J9V791T9TK9Xf9Nm9xQ95a9BR9fV:79Jv9DF9/C9qc9/J9V791T9TK9Xf9NmT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- MD5 SHA1 SHA512 SSDEEP