Analysis
-
max time kernel
145s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 20:35
Static task
static1
Behavioral task
behavioral1
Sample
0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe
-
Size
167KB
-
MD5
0f70ec21027ad7bbcb46861cde32216f
-
SHA1
69512ffddf7230ec3d2bcfc9c02ef8b4fb6d10c4
-
SHA256
00793e7325854f44f54f80b285d52d525e40f96b3d71eb325163c6ef523e0eda
-
SHA512
f08f2b8a63f8482962698058663d2a21e71186f6ff213d5736949c5804a7f722970920dc9f70dc112a2c8611db00e172aca38455c64f213bc231814f8039e78c
-
SSDEEP
3072:JN6KBVsqIVJltZrpRZN3BrWi08Dy/oBjQ7KFTEAkT+:JNhsx1thpqi/DyARG3v+
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Processes:
0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe -
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 3596 netsh.exe -
Processes:
resource yara_rule behavioral2/memory/3740-3-0x0000000002440000-0x0000000003470000-memory.dmp upx behavioral2/memory/3740-5-0x0000000002440000-0x0000000003470000-memory.dmp upx behavioral2/memory/3740-8-0x0000000002440000-0x0000000003470000-memory.dmp upx behavioral2/memory/3740-15-0x0000000002440000-0x0000000003470000-memory.dmp upx behavioral2/memory/3740-17-0x0000000002440000-0x0000000003470000-memory.dmp upx behavioral2/memory/3740-30-0x0000000002440000-0x0000000003470000-memory.dmp upx behavioral2/memory/3740-33-0x0000000002440000-0x0000000003470000-memory.dmp upx behavioral2/memory/3740-35-0x0000000002440000-0x0000000003470000-memory.dmp upx behavioral2/memory/3740-38-0x0000000002440000-0x0000000003470000-memory.dmp upx behavioral2/memory/3740-48-0x0000000002440000-0x0000000003470000-memory.dmp upx behavioral2/memory/3740-50-0x0000000002440000-0x0000000003470000-memory.dmp upx -
Processes:
0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe -
Drops file in Program Files directory 12 IoCs
Processes:
0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exedescription ioc process File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\JAVA\JAVA UPDATE\JUSCHED.EXE 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
Processes:
0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Modifies registry class 1 IoCs
Processes:
0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exepid process 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Token: SeDebugPrivilege 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exedescription pid process target process PID 3740 wrote to memory of 776 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe fontdrvhost.exe PID 3740 wrote to memory of 784 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe fontdrvhost.exe PID 3740 wrote to memory of 336 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe dwm.exe PID 3740 wrote to memory of 2920 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe sihost.exe PID 3740 wrote to memory of 2996 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe svchost.exe PID 3740 wrote to memory of 3116 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe taskhostw.exe PID 3740 wrote to memory of 3500 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Explorer.EXE PID 3740 wrote to memory of 3668 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe svchost.exe PID 3740 wrote to memory of 3860 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe DllHost.exe PID 3740 wrote to memory of 3952 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe StartMenuExperienceHost.exe PID 3740 wrote to memory of 4020 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe RuntimeBroker.exe PID 3740 wrote to memory of 752 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe SearchApp.exe PID 3740 wrote to memory of 2344 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe RuntimeBroker.exe PID 3740 wrote to memory of 1756 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe TextInputHost.exe PID 3740 wrote to memory of 2928 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe RuntimeBroker.exe PID 3740 wrote to memory of 3424 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe backgroundTaskHost.exe PID 3740 wrote to memory of 836 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe backgroundTaskHost.exe PID 3740 wrote to memory of 3596 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe netsh.exe PID 3740 wrote to memory of 3596 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe netsh.exe PID 3740 wrote to memory of 3596 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe netsh.exe PID 3740 wrote to memory of 776 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe fontdrvhost.exe PID 3740 wrote to memory of 784 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe fontdrvhost.exe PID 3740 wrote to memory of 336 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe dwm.exe PID 3740 wrote to memory of 2920 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe sihost.exe PID 3740 wrote to memory of 2996 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe svchost.exe PID 3740 wrote to memory of 3116 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe taskhostw.exe PID 3740 wrote to memory of 3500 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Explorer.EXE PID 3740 wrote to memory of 3668 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe svchost.exe PID 3740 wrote to memory of 3860 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe DllHost.exe PID 3740 wrote to memory of 3952 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe StartMenuExperienceHost.exe PID 3740 wrote to memory of 4020 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe RuntimeBroker.exe PID 3740 wrote to memory of 752 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe SearchApp.exe PID 3740 wrote to memory of 2344 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe RuntimeBroker.exe PID 3740 wrote to memory of 1756 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe TextInputHost.exe PID 3740 wrote to memory of 2928 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe RuntimeBroker.exe PID 3740 wrote to memory of 3424 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe backgroundTaskHost.exe PID 3740 wrote to memory of 3448 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe RuntimeBroker.exe PID 3740 wrote to memory of 1968 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe RuntimeBroker.exe PID 3740 wrote to memory of 776 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe fontdrvhost.exe PID 3740 wrote to memory of 784 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe fontdrvhost.exe PID 3740 wrote to memory of 336 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe dwm.exe PID 3740 wrote to memory of 2920 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe sihost.exe PID 3740 wrote to memory of 2996 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe svchost.exe PID 3740 wrote to memory of 3116 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe taskhostw.exe PID 3740 wrote to memory of 3500 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe Explorer.EXE PID 3740 wrote to memory of 3668 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe svchost.exe PID 3740 wrote to memory of 3860 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe DllHost.exe PID 3740 wrote to memory of 3952 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe StartMenuExperienceHost.exe PID 3740 wrote to memory of 4020 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe RuntimeBroker.exe PID 3740 wrote to memory of 752 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe SearchApp.exe PID 3740 wrote to memory of 2344 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe RuntimeBroker.exe PID 3740 wrote to memory of 1756 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe TextInputHost.exe PID 3740 wrote to memory of 2928 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe RuntimeBroker.exe PID 3740 wrote to memory of 3424 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe backgroundTaskHost.exe PID 3740 wrote to memory of 3448 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe RuntimeBroker.exe PID 3740 wrote to memory of 1968 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe RuntimeBroker.exe PID 3740 wrote to memory of 4912 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe NOTEPAD.EXE PID 3740 wrote to memory of 4912 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe NOTEPAD.EXE PID 3740 wrote to memory of 4912 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe NOTEPAD.EXE PID 3740 wrote to memory of 4912 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe NOTEPAD.EXE PID 3740 wrote to memory of 3176 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe NOTEPAD.EXE PID 3740 wrote to memory of 3176 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe NOTEPAD.EXE PID 3740 wrote to memory of 3176 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe NOTEPAD.EXE PID 3740 wrote to memory of 3176 3740 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe NOTEPAD.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:336
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2920
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2996
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3116
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe"2⤵
- UAC bypass
- Disables RegEdit via registry modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3740 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3596
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE"3⤵PID:4912
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE"3⤵PID:3176
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE"3⤵PID:868
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE"3⤵PID:3028
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3668
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3860
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3952
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4020
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:752
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2344
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1756
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2928
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:3424
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:836
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3448
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1968
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:4252
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4592
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1