Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2024 00:12
Static task
static1
Behavioral task
behavioral1
Sample
100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe
-
Size
167KB
-
MD5
100b8c5b6bef04961c7ebbb5975f42c1
-
SHA1
9e6f5f6bb8e21cbb214fe75eec6094c53ae5a8d4
-
SHA256
0f9a3c4f7bc7da2581418fa6a2bc104df40f136dda2eadbe5901b9611eff3314
-
SHA512
0f7502661b6b586d5b1becbb5728868d9acd3a2bc2e3ea6cacdc8cb53c40a0556f990eb9fe4ebc0515b9bd949815a69726ef0423521a4fba7e5a896aa50519b9
-
SSDEEP
3072:kYNQKPWDydRefVJltZrpRl1P3zRfx7nWdOeyY2wCSKoEd2AVX0txf:lNSDydRO1thpVRgd8YNC2Hy0zf
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Processes:
100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe -
Processes:
100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe -
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 4436 netsh.exe -
Processes:
resource yara_rule behavioral2/memory/1620-1-0x0000000002440000-0x0000000003473000-memory.dmp upx behavioral2/memory/1620-6-0x0000000002440000-0x0000000003473000-memory.dmp upx behavioral2/memory/1620-4-0x0000000002440000-0x0000000003473000-memory.dmp upx behavioral2/memory/1620-14-0x0000000002440000-0x0000000003473000-memory.dmp upx behavioral2/memory/1620-16-0x0000000002440000-0x0000000003473000-memory.dmp upx behavioral2/memory/1620-29-0x0000000002440000-0x0000000003473000-memory.dmp upx behavioral2/memory/1620-34-0x0000000002440000-0x0000000003473000-memory.dmp upx behavioral2/memory/1620-39-0x0000000002440000-0x0000000003473000-memory.dmp upx behavioral2/memory/1620-47-0x0000000002440000-0x0000000003473000-memory.dmp upx behavioral2/memory/1620-71-0x0000000002440000-0x0000000003473000-memory.dmp upx -
Processes:
100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe -
Processes:
100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe -
Drops file in Program Files directory 12 IoCs
Processes:
100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exedescription ioc process File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\JAVA\JAVA UPDATE\JUSCHED.EXE 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
Processes:
100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Modifies registry class 1 IoCs
Processes:
100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exepid process 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Token: SeDebugPrivilege 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exedescription pid process target process PID 1620 wrote to memory of 784 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe fontdrvhost.exe PID 1620 wrote to memory of 792 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe fontdrvhost.exe PID 1620 wrote to memory of 64 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe dwm.exe PID 1620 wrote to memory of 2580 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe sihost.exe PID 1620 wrote to memory of 2592 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe svchost.exe PID 1620 wrote to memory of 2932 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe taskhostw.exe PID 1620 wrote to memory of 3532 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Explorer.EXE PID 1620 wrote to memory of 3660 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe svchost.exe PID 1620 wrote to memory of 3836 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe DllHost.exe PID 1620 wrote to memory of 3928 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe StartMenuExperienceHost.exe PID 1620 wrote to memory of 3992 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe RuntimeBroker.exe PID 1620 wrote to memory of 4084 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe SearchApp.exe PID 1620 wrote to memory of 3732 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe RuntimeBroker.exe PID 1620 wrote to memory of 2064 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe TextInputHost.exe PID 1620 wrote to memory of 4420 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe RuntimeBroker.exe PID 1620 wrote to memory of 3124 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe backgroundTaskHost.exe PID 1620 wrote to memory of 3988 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe backgroundTaskHost.exe PID 1620 wrote to memory of 4436 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe netsh.exe PID 1620 wrote to memory of 4436 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe netsh.exe PID 1620 wrote to memory of 4436 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe netsh.exe PID 1620 wrote to memory of 784 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe fontdrvhost.exe PID 1620 wrote to memory of 792 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe fontdrvhost.exe PID 1620 wrote to memory of 64 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe dwm.exe PID 1620 wrote to memory of 2580 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe sihost.exe PID 1620 wrote to memory of 2592 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe svchost.exe PID 1620 wrote to memory of 2932 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe taskhostw.exe PID 1620 wrote to memory of 3532 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Explorer.EXE PID 1620 wrote to memory of 3660 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe svchost.exe PID 1620 wrote to memory of 3836 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe DllHost.exe PID 1620 wrote to memory of 3928 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe StartMenuExperienceHost.exe PID 1620 wrote to memory of 3992 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe RuntimeBroker.exe PID 1620 wrote to memory of 4084 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe SearchApp.exe PID 1620 wrote to memory of 3732 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe RuntimeBroker.exe PID 1620 wrote to memory of 2064 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe TextInputHost.exe PID 1620 wrote to memory of 4420 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe RuntimeBroker.exe PID 1620 wrote to memory of 3124 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe backgroundTaskHost.exe PID 1620 wrote to memory of 708 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe RuntimeBroker.exe PID 1620 wrote to memory of 3896 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe RuntimeBroker.exe PID 1620 wrote to memory of 784 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe fontdrvhost.exe PID 1620 wrote to memory of 792 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe fontdrvhost.exe PID 1620 wrote to memory of 64 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe dwm.exe PID 1620 wrote to memory of 2580 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe sihost.exe PID 1620 wrote to memory of 2592 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe svchost.exe PID 1620 wrote to memory of 2932 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe taskhostw.exe PID 1620 wrote to memory of 3532 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe Explorer.EXE PID 1620 wrote to memory of 3660 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe svchost.exe PID 1620 wrote to memory of 3836 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe DllHost.exe PID 1620 wrote to memory of 3928 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe StartMenuExperienceHost.exe PID 1620 wrote to memory of 3992 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe RuntimeBroker.exe PID 1620 wrote to memory of 4084 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe SearchApp.exe PID 1620 wrote to memory of 3732 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe RuntimeBroker.exe PID 1620 wrote to memory of 2064 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe TextInputHost.exe PID 1620 wrote to memory of 4420 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe RuntimeBroker.exe PID 1620 wrote to memory of 3124 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe backgroundTaskHost.exe PID 1620 wrote to memory of 708 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe RuntimeBroker.exe PID 1620 wrote to memory of 3896 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe RuntimeBroker.exe PID 1620 wrote to memory of 1444 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe NOTEPAD.EXE PID 1620 wrote to memory of 1444 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe NOTEPAD.EXE PID 1620 wrote to memory of 1444 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe NOTEPAD.EXE PID 1620 wrote to memory of 1444 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe NOTEPAD.EXE PID 1620 wrote to memory of 2912 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe NOTEPAD.EXE PID 1620 wrote to memory of 2912 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe NOTEPAD.EXE PID 1620 wrote to memory of 2912 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe NOTEPAD.EXE PID 1620 wrote to memory of 2912 1620 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe NOTEPAD.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2580
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2592
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2932
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\100b8c5b6bef04961c7ebbb5975f42c1_JaffaCakes118.exe"2⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1620 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4436
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE"3⤵PID:1444
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE"3⤵PID:2912
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE"3⤵PID:4348
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE"3⤵PID:3700
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE"3⤵PID:4984
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE"3⤵PID:540
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE"3⤵PID:2268
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3660
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3836
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3928
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3992
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4084
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3732
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2064
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4420
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:3124
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3988
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:708
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3896
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1380
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1