Analysis
-
max time kernel
155s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2024 00:56
Static task
static1
Behavioral task
behavioral1
Sample
102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe
-
Size
167KB
-
MD5
102ba0e9c8404ab1e8bde137dd76b600
-
SHA1
91ca6808fcc885f59cb5a6c7a4ee09fb767ed67e
-
SHA256
47a9aea93247d3fb383e3cb82e190b8a862f1e417a463da2aec3370aba43dd8d
-
SHA512
42cb0bbf023aac7254616c1eb1db131a12528c0b560ae2e08dad8a27bb5cca01444e7246e1f965c4ee193fd15e8ed368a39cdcfb536a03a4216a54c05c182cd6
-
SSDEEP
3072:pNQKPWDy7I0fFJltZrpReFX31VZ8Lf+3uMrkD42LiSukPw9:pNSDy7IkFthpGV6L4VgTiSukPw
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Processes:
102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe -
Processes:
102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe -
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 3960 netsh.exe -
Executes dropped EXE 1 IoCs
Processes:
msedge.exepid process 2040 msedge.exe -
Processes:
resource yara_rule behavioral2/memory/4292-2-0x0000000002440000-0x0000000003473000-memory.dmp upx behavioral2/memory/4292-4-0x0000000002440000-0x0000000003473000-memory.dmp upx behavioral2/memory/4292-17-0x0000000002440000-0x0000000003473000-memory.dmp upx behavioral2/memory/4292-21-0x0000000002440000-0x0000000003473000-memory.dmp upx behavioral2/memory/4292-29-0x0000000002440000-0x0000000003473000-memory.dmp upx behavioral2/memory/4292-46-0x0000000002440000-0x0000000003473000-memory.dmp upx behavioral2/memory/4292-50-0x0000000002440000-0x0000000003473000-memory.dmp upx behavioral2/memory/4292-54-0x0000000002440000-0x0000000003473000-memory.dmp upx behavioral2/memory/4292-56-0x0000000002440000-0x0000000003473000-memory.dmp upx behavioral2/memory/4292-63-0x0000000002440000-0x0000000003473000-memory.dmp upx -
Processes:
102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe -
Processes:
102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe -
Drops file in Program Files directory 12 IoCs
Processes:
102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exedescription ioc process File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
Processes:
102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exedescription ioc process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Modifies registry class 1 IoCs
Processes:
102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exepid process 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Token: SeDebugPrivilege 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exedescription pid process target process PID 4292 wrote to memory of 3960 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe netsh.exe PID 4292 wrote to memory of 3960 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe netsh.exe PID 4292 wrote to memory of 3960 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe netsh.exe PID 4292 wrote to memory of 776 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe fontdrvhost.exe PID 4292 wrote to memory of 780 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe fontdrvhost.exe PID 4292 wrote to memory of 1012 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe dwm.exe PID 4292 wrote to memory of 2396 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe sihost.exe PID 4292 wrote to memory of 2416 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe svchost.exe PID 4292 wrote to memory of 2500 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe taskhostw.exe PID 4292 wrote to memory of 3364 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Explorer.EXE PID 4292 wrote to memory of 3496 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe svchost.exe PID 4292 wrote to memory of 3716 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe DllHost.exe PID 4292 wrote to memory of 3816 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe StartMenuExperienceHost.exe PID 4292 wrote to memory of 3888 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe RuntimeBroker.exe PID 4292 wrote to memory of 4004 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe SearchApp.exe PID 4292 wrote to memory of 4148 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe RuntimeBroker.exe PID 4292 wrote to memory of 4640 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe RuntimeBroker.exe PID 4292 wrote to memory of 4648 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe TextInputHost.exe PID 4292 wrote to memory of 4568 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe msedge.exe PID 4292 wrote to memory of 4848 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe msedge.exe PID 4292 wrote to memory of 3340 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe msedge.exe PID 4292 wrote to memory of 3996 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe msedge.exe PID 4292 wrote to memory of 4744 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe msedge.exe PID 4292 wrote to memory of 2924 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe msedge.exe PID 4292 wrote to memory of 3624 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe msedge.exe PID 4292 wrote to memory of 3960 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe netsh.exe PID 4292 wrote to memory of 3960 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe netsh.exe PID 4292 wrote to memory of 1832 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Conhost.exe PID 4292 wrote to memory of 776 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe fontdrvhost.exe PID 4292 wrote to memory of 780 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe fontdrvhost.exe PID 4292 wrote to memory of 1012 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe dwm.exe PID 4292 wrote to memory of 2396 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe sihost.exe PID 4292 wrote to memory of 2416 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe svchost.exe PID 4292 wrote to memory of 2500 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe taskhostw.exe PID 4292 wrote to memory of 3364 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Explorer.EXE PID 4292 wrote to memory of 3496 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe svchost.exe PID 4292 wrote to memory of 3716 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe DllHost.exe PID 4292 wrote to memory of 3816 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe StartMenuExperienceHost.exe PID 4292 wrote to memory of 3888 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe RuntimeBroker.exe PID 4292 wrote to memory of 4004 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe SearchApp.exe PID 4292 wrote to memory of 4148 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe RuntimeBroker.exe PID 4292 wrote to memory of 4640 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe RuntimeBroker.exe PID 4292 wrote to memory of 4648 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe TextInputHost.exe PID 4292 wrote to memory of 4568 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe msedge.exe PID 4292 wrote to memory of 4848 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe msedge.exe PID 4292 wrote to memory of 3340 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe msedge.exe PID 4292 wrote to memory of 3996 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe msedge.exe PID 4292 wrote to memory of 4744 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe msedge.exe PID 4292 wrote to memory of 2924 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe msedge.exe PID 4292 wrote to memory of 3624 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe msedge.exe PID 4292 wrote to memory of 776 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe fontdrvhost.exe PID 4292 wrote to memory of 780 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe fontdrvhost.exe PID 4292 wrote to memory of 1012 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe dwm.exe PID 4292 wrote to memory of 2396 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe sihost.exe PID 4292 wrote to memory of 2416 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe svchost.exe PID 4292 wrote to memory of 2500 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe taskhostw.exe PID 4292 wrote to memory of 3364 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe Explorer.EXE PID 4292 wrote to memory of 3496 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe svchost.exe PID 4292 wrote to memory of 3716 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe DllHost.exe PID 4292 wrote to memory of 3816 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe StartMenuExperienceHost.exe PID 4292 wrote to memory of 3888 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe RuntimeBroker.exe PID 4292 wrote to memory of 4004 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe SearchApp.exe PID 4292 wrote to memory of 4148 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe RuntimeBroker.exe PID 4292 wrote to memory of 4640 4292 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe RuntimeBroker.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1012
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2416
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2500
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\102ba0e9c8404ab1e8bde137dd76b600_JaffaCakes118.exe"2⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4292 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3960 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:1832
-
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE"3⤵PID:4492
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3496
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3716
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3816
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3888
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4004
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4148
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4640
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4648
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵PID:4568
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffc479f2e98,0x7ffc479f2ea4,0x7ffc479f2eb02⤵PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2248 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:22⤵PID:3340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3316 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:32⤵PID:3996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3324 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:82⤵PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5404 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:12⤵PID:2924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5508 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:12⤵PID:3624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:82⤵
- Executes dropped EXE
PID:2040
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.9MB
MD5faf79a48399d502194e87a5ad1ba7b8e
SHA109cd9d783ac126d33ec37de781beedce9ce6aa51
SHA2563d1266025af95bdb7b92d17debbf88a1386b19b7f7c2eeb9ced77debb9748e14
SHA512d84f8e25179e2cee6f95dc95c94a4a70dc56814aaf7f95e38f24f9828e64629cab0c184f5fddd67d834f419703f65d9d0e3a93e54d2730ed63d3d89644babb84