Malware Analysis Report

2024-11-16 13:13

Sample ID 240625-xdy45syfqn
Target 0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118
SHA256 46c8827671b0bac03d68810275eb2824bb148bd2bb40f35fb68465d15f7a9be1
Tags
sality backdoor evasion trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

46c8827671b0bac03d68810275eb2824bb148bd2bb40f35fb68465d15f7a9be1

Threat Level: Known bad

The file 0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion trojan upx

Sality

Modifies firewall policy service

UAC bypass

Windows security bypass

UPX packed file

Windows security modification

Checks whether UAC is enabled

Enumerates connected drives

Drops autorun.inf file

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

System policy modification

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-25 18:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 18:44

Reported

2024-06-25 18:47

Platform

win10v2004-20240611-en

Max time kernel

122s

Max time network

101s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4864 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4864 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4864 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 4864 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 4864 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4864 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 4864 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4864 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4864 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 4864 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4864 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4864 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4864 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4864 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4864 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4864 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4864 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4864 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4864 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4864 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 4864 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 4864 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4864 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 4864 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4864 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4864 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 4864 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4864 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4864 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4864 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4864 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4864 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4864 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4864 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4864 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4864 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4864 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4864 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 4864 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 4864 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4864 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 4864 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4864 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4864 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 4864 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4864 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4864 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4864 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4864 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4864 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4864 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4864 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4864 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4864 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4864 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4864 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 4864 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 4864 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4864 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 4864 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4864 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4864 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 4864 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4864 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe"

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
BE 2.17.107.131:443 www.bing.com tcp
US 8.8.8.8:53 131.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

memory/4864-0-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4864-7-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-5-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-6-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-12-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-15-0x0000000004090000-0x0000000004092000-memory.dmp

memory/4864-9-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-8-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-4-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-3-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-14-0x0000000004090000-0x0000000004092000-memory.dmp

memory/4864-11-0x00000000041E0000-0x00000000041E1000-memory.dmp

memory/4864-10-0x0000000004090000-0x0000000004092000-memory.dmp

memory/4864-13-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-16-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-17-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-18-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-20-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-19-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-22-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-23-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-24-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-26-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-27-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-29-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-30-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-33-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-37-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-38-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-39-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-41-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-43-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-44-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-47-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-48-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-51-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-52-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-53-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-61-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-62-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-65-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-66-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-68-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-69-0x0000000002190000-0x000000000321E000-memory.dmp

memory/4864-70-0x0000000004090000-0x0000000004092000-memory.dmp

C:\dgpr.pif

MD5 5dac9fe8dd1e02aedc65a3b6498050a3
SHA1 d1f63225622919b8202660bb585735ff40dbee7c
SHA256 95d27ebaa06c1d91ca8d7cfb0bc636d5d4f96058f44b15f129044da9862ade40
SHA512 72ee83e317250539d3a274b40bf976f14a85b687d37ca6d64fc3a46e28a324d433dbc5d61c7a2c31120a74c41c35d64eba4fefb5b2a2cdfb0e0507b323b03206

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 18:44

Reported

2024-06-25 18:47

Platform

win7-20240611-en

Max time kernel

123s

Max time network

123s

Command Line

"taskhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2968 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2968 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2968 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2968 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2968 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2968 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2968 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2968 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2968 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2968 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2968 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2968 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2968 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2968 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2968 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2968 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2968 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2968 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2968 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2968 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2968 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2968 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2968 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2968 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2968 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2968 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2968 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2968 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2968 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2968 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2968 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2968 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2968 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2968 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2968 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2968 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2968 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe C:\Windows\Explorer.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0f2381db9e4a70cccdaccc6912137b1f_JaffaCakes118.exe"

Network

N/A

Files

memory/2968-0-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2968-2-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/1220-12-0x00000000001D0000-0x00000000001D2000-memory.dmp

memory/2968-25-0x0000000003370000-0x0000000003372000-memory.dmp

memory/2968-24-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

memory/2968-22-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

memory/2968-21-0x0000000003370000-0x0000000003372000-memory.dmp

memory/2968-4-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-7-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-11-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-5-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-26-0x0000000003370000-0x0000000003372000-memory.dmp

memory/2968-8-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-9-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-6-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-10-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-27-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-28-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-29-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-30-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-31-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-33-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-34-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-35-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-37-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-39-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-52-0x00000000002A0000-0x00000000002A2000-memory.dmp

memory/2968-51-0x0000000003360000-0x0000000003361000-memory.dmp

memory/2968-53-0x00000000002A0000-0x00000000002A2000-memory.dmp

memory/2968-54-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-55-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-57-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-59-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-60-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-61-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-62-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-65-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-67-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-68-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-78-0x0000000001D80000-0x0000000002E0E000-memory.dmp

memory/2968-84-0x0000000003370000-0x0000000003372000-memory.dmp

memory/2968-102-0x00000000002A0000-0x00000000002A2000-memory.dmp

F:\xuhmvg.exe

MD5 3f4e4056de5283773912a93a91906c4e
SHA1 b0b0c7a9818ec4ffe1c42bc089f566dc66547b63
SHA256 e26f88563c18f9fc469a3075aacc191d142861b1b88a5b6224ec74faa33a406e
SHA512 10071570666ff8586fe37a40c99bcd5e487d61e5ed961576e48482a71fa734e5c9c3287d5f34e1dad0d310645a3452bde68c5b4c8e2a17d47a8c35865f9a34cc