Malware Analysis Report

2024-11-16 13:13

Sample ID 240625-wv7xyaxflm
Target 0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118
SHA256 b582e828fd2952cdf1914df8bd4f6fd558bc2ebd88b1918bb88f648cb7120ad7
Tags
sality backdoor evasion trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b582e828fd2952cdf1914df8bd4f6fd558bc2ebd88b1918bb88f648cb7120ad7

Threat Level: Known bad

The file 0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion trojan upx

Sality

UAC bypass

Windows security bypass

Modifies firewall policy service

Executes dropped EXE

Loads dropped DLL

UPX packed file

Windows security modification

Checks whether UAC is enabled

Enumerates connected drives

Drops file in System32 directory

Drops autorun.inf file

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious use of SetWindowsHookEx

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-25 18:15

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 18:15

Reported

2024-06-25 18:18

Platform

win7-20240508-en

Max time kernel

126s

Max time network

118s

Command Line

"taskhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\SYSLIB32.DLL C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3068 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01
PID 3068 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01
PID 3068 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01
PID 3068 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01
PID 1016 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\taskhost.exe
PID 1016 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\Dwm.exe
PID 1016 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\Explorer.EXE
PID 1016 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\DllHost.exe
PID 1016 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe
PID 1016 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe
PID 1016 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\taskhost.exe
PID 1016 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\Dwm.exe
PID 1016 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\Explorer.EXE
PID 1016 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\taskhost.exe
PID 1016 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\Dwm.exe
PID 1016 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\Explorer.EXE
PID 1016 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\taskhost.exe
PID 1016 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\Dwm.exe
PID 1016 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\Explorer.EXE
PID 1016 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\taskhost.exe
PID 1016 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\Dwm.exe
PID 1016 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\Explorer.EXE
PID 1016 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\taskhost.exe
PID 1016 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\Dwm.exe
PID 1016 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\Explorer.EXE
PID 1016 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\taskhost.exe
PID 1016 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\Dwm.exe
PID 1016 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\Explorer.EXE
PID 1016 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\taskhost.exe
PID 1016 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\Dwm.exe
PID 1016 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\Explorer.EXE
PID 1016 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\taskhost.exe
PID 1016 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\Dwm.exe
PID 1016 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\Explorer.EXE
PID 1016 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\taskhost.exe
PID 1016 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\Dwm.exe
PID 1016 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\Explorer.EXE
PID 1016 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\taskhost.exe
PID 1016 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\Dwm.exe
PID 1016 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\Explorer.EXE
PID 1016 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\taskhost.exe
PID 1016 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\Dwm.exe
PID 1016 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\Explorer.EXE
PID 1016 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\taskhost.exe
PID 1016 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\Dwm.exe
PID 1016 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\Explorer.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01

C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01

Network

N/A

Files

memory/3068-0-0x0000000000400000-0x0000000000439BE5-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01

MD5 000c3994639ec089bcd01b2dd95dcfad
SHA1 0f263242800bc2238ae4dd1626e6c15947ba5e1e
SHA256 ae065c33d3d362b1a32220d2f82e1f6c0d1553afbd229e72f06b436ae2d050d6
SHA512 2b4abf6a6338b8f0f2491bcfebe83a3794013e8f52c698413d0d5f6dae2de92cdaa4c7c0d1cd6473816c70a2d1de2008367a3f98c478c9e905b31c551b68af19

memory/1016-13-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3068-12-0x0000000000250000-0x0000000000263000-memory.dmp

memory/3068-11-0x0000000000250000-0x0000000000263000-memory.dmp

\Windows\SysWOW64\SYSLIB32.DLL

MD5 6695daf942821c4475f60326eda77e8d
SHA1 78e9c90220f1b5d01fadc05433a75d4125fee1ae
SHA256 ecab413bfbed24dfac2a53f518be89910f885c8c9d929f78835b3eb38f689b15
SHA512 4ba491d07f0abbbd18527e53d6fa994dd30fc7926327be1d857c9f39b15a70dfdd847873dcad394824e92aa421b687b0c5914a48c06cf18c3a40a210e3951ac7

memory/3068-17-0x0000000010000000-0x0000000010005000-memory.dmp

memory/1016-18-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-20-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-24-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-50-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-49-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-51-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-46-0x00000000003E0000-0x00000000003E2000-memory.dmp

memory/3068-45-0x0000000000290000-0x0000000000292000-memory.dmp

memory/1016-44-0x00000000003E0000-0x00000000003E2000-memory.dmp

memory/3068-43-0x0000000000290000-0x0000000000292000-memory.dmp

memory/1016-42-0x00000000003F0000-0x00000000003F1000-memory.dmp

memory/3068-36-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/3068-34-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/3068-33-0x0000000000290000-0x0000000000292000-memory.dmp

memory/1096-25-0x0000000001F90000-0x0000000001F92000-memory.dmp

memory/1016-22-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-23-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-21-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-52-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-53-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-54-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-55-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-56-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-59-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-60-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-61-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-63-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/3068-65-0x0000000000400000-0x0000000000439BE5-memory.dmp

memory/1016-68-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-75-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-76-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-77-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-80-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-81-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-85-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-86-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-90-0x0000000001CD0000-0x0000000002D5E000-memory.dmp

memory/1016-105-0x00000000003E0000-0x00000000003E2000-memory.dmp

memory/3068-104-0x0000000000290000-0x0000000000292000-memory.dmp

F:\skjs.exe

MD5 e019c3a632d7cf0df454e744747749ce
SHA1 2826f4750e7f7591b81308307688e4f608ad5d9c
SHA256 38a7c5c7bbd51d9728f6b792bbd28fcfaecd1f30b95472038b95fc9a7a4b1fbb
SHA512 e29fa65fafdc84d1673cf813bf33af96887db2e7d3c143a1a4c38c77cfaaf87f33b4eaba359722723540ad91bf9327cc5f2c77d8253a47fc96c0e71a425e3cef

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 18:15

Reported

2024-06-25 18:18

Platform

win10v2004-20240508-en

Max time kernel

122s

Max time network

150s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\SYSLIB32.DLL C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\APPVCLEANER.OSH C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\APPVSHNOTIFY.EXE C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\UNINSTALL.GTQ C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe N/A
File created C:\PROGRAM FILES\7-ZIP\7ZG.FPP C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7ZG.EXE C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe N/A
File created C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\APPVSHNOTIFY.QIK C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File created C:\PROGRAM FILES\7-ZIP\7ZFM.DGL C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7ZFM.DGL C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7ZFM.EXE C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\APPVCLEANER.EXE C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7ZG.FPP C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe N/A
File created C:\PROGRAM FILES\7-ZIP\UNINSTALL.GTQ C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\UNINSTALL.EXE C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe N/A
File created C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\APPVCLEANER.OSH C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File created C:\PROGRAM FILES\7-ZIP\7Z.OAH C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7Z.OAH C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\APPVSHNOTIFY.QIK C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7Z.EXE C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4868 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01
PID 4868 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01
PID 4868 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01
PID 2440 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\fontdrvhost.exe
PID 2440 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\fontdrvhost.exe
PID 2440 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\dwm.exe
PID 2440 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\sihost.exe
PID 2440 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\svchost.exe
PID 2440 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\taskhostw.exe
PID 2440 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\Explorer.EXE
PID 2440 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\svchost.exe
PID 2440 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\DllHost.exe
PID 2440 wrote to memory of 3824 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 2440 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\System32\RuntimeBroker.exe
PID 2440 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 2440 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\System32\RuntimeBroker.exe
PID 2440 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\System32\RuntimeBroker.exe
PID 2440 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 2440 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe
PID 2440 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe
PID 2440 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\fontdrvhost.exe
PID 2440 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\fontdrvhost.exe
PID 2440 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\dwm.exe
PID 2440 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\sihost.exe
PID 2440 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\svchost.exe
PID 2440 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\taskhostw.exe
PID 2440 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\Explorer.EXE
PID 2440 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\svchost.exe
PID 2440 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\DllHost.exe
PID 2440 wrote to memory of 3824 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 2440 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\System32\RuntimeBroker.exe
PID 2440 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 2440 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\System32\RuntimeBroker.exe
PID 2440 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\System32\RuntimeBroker.exe
PID 2440 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 2440 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\fontdrvhost.exe
PID 2440 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\fontdrvhost.exe
PID 2440 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\dwm.exe
PID 2440 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\sihost.exe
PID 2440 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\svchost.exe
PID 2440 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\taskhostw.exe
PID 2440 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\Explorer.EXE
PID 2440 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\svchost.exe
PID 2440 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\DllHost.exe
PID 2440 wrote to memory of 3824 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 2440 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\System32\RuntimeBroker.exe
PID 2440 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 2440 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\System32\RuntimeBroker.exe
PID 2440 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\System32\RuntimeBroker.exe
PID 2440 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 2440 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\fontdrvhost.exe
PID 2440 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\fontdrvhost.exe
PID 2440 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\dwm.exe
PID 2440 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\sihost.exe
PID 2440 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\svchost.exe
PID 2440 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\taskhostw.exe
PID 2440 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\Explorer.EXE
PID 2440 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\svchost.exe
PID 2440 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\system32\DllHost.exe
PID 2440 wrote to memory of 3824 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 2440 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\System32\RuntimeBroker.exe
PID 2440 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 2440 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\System32\RuntimeBroker.exe
PID 2440 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 C:\Windows\System32\RuntimeBroker.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01 N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01

C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

memory/4868-0-0x0000000000400000-0x0000000000439BE5-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0f0da788f31bc9928fd97722d857ed7d_JaffaCakes118.~01

MD5 000c3994639ec089bcd01b2dd95dcfad
SHA1 0f263242800bc2238ae4dd1626e6c15947ba5e1e
SHA256 ae065c33d3d362b1a32220d2f82e1f6c0d1553afbd229e72f06b436ae2d050d6
SHA512 2b4abf6a6338b8f0f2491bcfebe83a3794013e8f52c698413d0d5f6dae2de92cdaa4c7c0d1cd6473816c70a2d1de2008367a3f98c478c9e905b31c551b68af19

memory/2440-6-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Windows\SysWOW64\SYSLIB32.DLL

MD5 6695daf942821c4475f60326eda77e8d
SHA1 78e9c90220f1b5d01fadc05433a75d4125fee1ae
SHA256 ecab413bfbed24dfac2a53f518be89910f885c8c9d929f78835b3eb38f689b15
SHA512 4ba491d07f0abbbd18527e53d6fa994dd30fc7926327be1d857c9f39b15a70dfdd847873dcad394824e92aa421b687b0c5914a48c06cf18c3a40a210e3951ac7

memory/4868-12-0x0000000010000000-0x0000000010005000-memory.dmp

memory/2440-13-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-16-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-23-0x0000000002180000-0x000000000320E000-memory.dmp

memory/4868-28-0x0000000000A80000-0x0000000000A82000-memory.dmp

memory/2440-27-0x0000000003360000-0x0000000003362000-memory.dmp

memory/2440-26-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-25-0x0000000003360000-0x0000000003362000-memory.dmp

memory/4868-24-0x0000000000A80000-0x0000000000A82000-memory.dmp

memory/2440-17-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-18-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-22-0x0000000003370000-0x0000000003371000-memory.dmp

memory/4868-20-0x0000000000A90000-0x0000000000A91000-memory.dmp

memory/4868-19-0x0000000000A80000-0x0000000000A82000-memory.dmp

memory/2440-15-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-31-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-32-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-33-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-34-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-35-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-36-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-37-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-38-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-40-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-41-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-42-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-43-0x0000000002180000-0x000000000320E000-memory.dmp

memory/4868-45-0x0000000000400000-0x0000000000439BE5-memory.dmp

memory/2440-46-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-47-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-51-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-49-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-53-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-55-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-56-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-58-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-60-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-67-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-68-0x0000000002180000-0x000000000320E000-memory.dmp

memory/4868-69-0x0000000000400000-0x0000000000439BE5-memory.dmp

memory/2440-70-0x0000000003360000-0x0000000003362000-memory.dmp

memory/2440-72-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-74-0x0000000002180000-0x000000000320E000-memory.dmp

memory/4868-77-0x0000000000A80000-0x0000000000A82000-memory.dmp

memory/2440-78-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-85-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-87-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-89-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-91-0x0000000002180000-0x000000000320E000-memory.dmp

memory/2440-93-0x0000000002180000-0x000000000320E000-memory.dmp

F:\vfyt.pif

MD5 8ab4b203fea81552aac2782249d1a306
SHA1 520f3c6d878d524d8d6366877c34ed89e1425b2f
SHA256 4605c020a3ee9562a07d696fbdd7eda5762f697a46d0397b56abf8588e4e10ca
SHA512 37e97904b90555d610c40ddf33c9b1c438368a3a9f3026706564e8cfedca3ad4735b2d6d40e67608f2c516aed70d8ac90e3b127e76118a634df3d5dc8f160106