Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 12:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
General
-
Target
0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe
-
Size
255KB
-
MD5
0e0b392d511d9c14d51fff720b3f3d9e
-
SHA1
a7e78a574012637e6c300dba2f482a94e6ecfb65
-
SHA256
c774f3dca844e6fc31b1b23328fcc10860f30d2fccab118bea20d601779ae112
-
SHA512
d003310d9ece75978b4c18f5f735da935db4411df3898a6d2df0289260780d1116347ebd186951d052fd25b18e61bf4c50777d8e559584651cff210932a4cbad
-
SSDEEP
3072:HunxwgxgfR/DVG7wBpErzWRVoYc0WnqAdelWGPRSOLjK+ca1x:G+xDVG0BpE+lAvepSOLjAMx
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1012 WaterMark.exe -
resource yara_rule behavioral2/memory/4720-6-0x00000000031B0000-0x000000000423E000-memory.dmp upx behavioral2/memory/4720-11-0x00000000031B0000-0x000000000423E000-memory.dmp upx behavioral2/memory/4720-20-0x00000000031B0000-0x000000000423E000-memory.dmp upx behavioral2/memory/4720-23-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4720-17-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4720-5-0x00000000031B0000-0x000000000423E000-memory.dmp upx behavioral2/memory/1012-39-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1012-37-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4720-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4720-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4720-9-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4720-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4720-2-0x00000000031B0000-0x000000000423E000-memory.dmp upx behavioral2/memory/4720-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1012-45-0x0000000000400000-0x0000000000421000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px5DDF.tmp 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{29E36570-32ED-11EF-B1BA-7AB36BF646CA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{29E5C7B0-32ED-11EF-B1BA-7AB36BF646CA} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115001" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4267236491" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4267236491" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115001" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4269893050" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4269893050" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4267236491" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426082941" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115001" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115001" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115001" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4267236491" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115001" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe 1012 WaterMark.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe Token: SeDebugPrivilege 1012 WaterMark.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4392 iexplore.exe 2504 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4392 iexplore.exe 2504 iexplore.exe 4392 iexplore.exe 2504 iexplore.exe 4776 IEXPLORE.EXE 4776 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 4776 IEXPLORE.EXE 4776 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 1012 WaterMark.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4720 wrote to memory of 796 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 9 PID 4720 wrote to memory of 800 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 10 PID 4720 wrote to memory of 388 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 13 PID 4720 wrote to memory of 2544 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 44 PID 4720 wrote to memory of 2648 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 45 PID 4720 wrote to memory of 2872 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 51 PID 4720 wrote to memory of 3484 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 55 PID 4720 wrote to memory of 1012 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 83 PID 4720 wrote to memory of 1012 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 83 PID 4720 wrote to memory of 1012 4720 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe 83 PID 1012 wrote to memory of 4080 1012 WaterMark.exe 84 PID 1012 wrote to memory of 4080 1012 WaterMark.exe 84 PID 1012 wrote to memory of 4080 1012 WaterMark.exe 84 PID 1012 wrote to memory of 4080 1012 WaterMark.exe 84 PID 1012 wrote to memory of 4080 1012 WaterMark.exe 84 PID 1012 wrote to memory of 4080 1012 WaterMark.exe 84 PID 1012 wrote to memory of 4080 1012 WaterMark.exe 84 PID 1012 wrote to memory of 4080 1012 WaterMark.exe 84 PID 1012 wrote to memory of 4080 1012 WaterMark.exe 84 PID 1012 wrote to memory of 4392 1012 WaterMark.exe 85 PID 1012 wrote to memory of 4392 1012 WaterMark.exe 85 PID 1012 wrote to memory of 2504 1012 WaterMark.exe 86 PID 1012 wrote to memory of 2504 1012 WaterMark.exe 86 PID 4392 wrote to memory of 4776 4392 iexplore.exe 88 PID 4392 wrote to memory of 4776 4392 iexplore.exe 88 PID 4392 wrote to memory of 4776 4392 iexplore.exe 88 PID 2504 wrote to memory of 2392 2504 iexplore.exe 87 PID 2504 wrote to memory of 2392 2504 iexplore.exe 87 PID 2504 wrote to memory of 2392 2504 iexplore.exe 87 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:388
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2544
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2648
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2872
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4720 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵PID:4080
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4392 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4776
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2392
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD50e0b392d511d9c14d51fff720b3f3d9e
SHA1a7e78a574012637e6c300dba2f482a94e6ecfb65
SHA256c774f3dca844e6fc31b1b23328fcc10860f30d2fccab118bea20d601779ae112
SHA512d003310d9ece75978b4c18f5f735da935db4411df3898a6d2df0289260780d1116347ebd186951d052fd25b18e61bf4c50777d8e559584651cff210932a4cbad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5b9b9f42ce6d2b20bf169d05480d239d4
SHA132b094cc2ff79f07fcd68d585846b919bc350e4d
SHA2564d16bb8c9a34d4de9d39bb5f0e87095617b5ad551112db17b38b6cb752fbdae4
SHA51236b45c544439c6b1fab4c2fa58712475a65ad467e3da61086c4a953d6587d35f5c6ae7de740863295ae0d3534cbf67d0bed6843d95b6786b50431bfeebcf1010
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5e4d1807ec461b54cbe1a9e89279159ce
SHA16a49612b815b5c5e658f5a8e7118dcca078905fb
SHA2563ddaba87242701d8328097672c75ed59f9a36a1449225a682c3e41d945580ca0
SHA512b6cdd9184ba99ba7286c7d3514bacf6949bfaa4e8095e2b1336707844bdd0b489a4dfcc97b9d1de293d67e2bfeeb1ca21d75df92144a2c505ba1c5ec53be2ed1
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{29E36570-32ED-11EF-B1BA-7AB36BF646CA}.dat
Filesize5KB
MD5c5d1e0ee09398a15c728414f5257a09b
SHA10132550cb03cdd3ef2c82640db3446f49117ce73
SHA2563d870ec6ec7f9b24f863bd7fe937cbcd30dc470d7d8b246e20c5bf2fa8f7097c
SHA512c191354161e3dd64d9f590750280cfbe83725e4ae1e18d962138db022077736db744607fbef93629400faf45daf05c42da5e71cd0343e2632ecc3295ab862fa3
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{29E5C7B0-32ED-11EF-B1BA-7AB36BF646CA}.dat
Filesize3KB
MD59a9ec7a6029bf6ca7de23837470cc91c
SHA1576cf0705ea0db893f82d713191b5e6984fc5f60
SHA25674709942fa37d9d615062c7d6161f4a1f0413d45fd181de095beef6bd86de239
SHA5122c52d121413102ee33531b94bb692ac8692deccac23ef123b43f46647d25fcedb8d246aaff4db5acbb56b74a0abe551756941da78a9c8543543eb3de3b57ed4e
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee