Analysis
-
max time kernel
123s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 06:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
18 signatures
150 seconds
General
-
Target
278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe
-
Size
96KB
-
MD5
278a47c8c7857cc695f482f146e3970a
-
SHA1
9b018d69901dd4d1934dc654e741dab9fd62dded
-
SHA256
008c119961fc0dcbb7e32e83b24456328a8f32bf037fc59ab06d7319e6fa4b5d
-
SHA512
0753c18c83efceba7955d9fff048feae1c889d6c72a4bc31edc9895d0ef7a541ff5710793e15577b9268fa0e3443ebd861a163534f794ad0acde42a73044ee79
-
SSDEEP
1536:/ItAl4G/GDUiWw6sG0LdLDxso8T5f4jFIZoDlkCBHltxI1XmFrv/lXSgJ+J+oxL9:2URw6sGidnf0fwFIZQlNFtxQWdv/oa+d
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/768-7-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-6-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-5-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-4-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-3-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-30-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-32-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-35-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-31-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-37-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-38-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-44-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-45-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-46-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-48-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-49-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-50-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-52-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-54-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-55-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-65-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-69-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-71-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-73-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-75-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/768-99-0x0000000002680000-0x000000000370E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened (read-only) \??\M: 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened (read-only) \??\N: 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened (read-only) \??\P: 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened (read-only) \??\Q: 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened (read-only) \??\T: 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened (read-only) \??\E: 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened (read-only) \??\H: 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened (read-only) \??\Z: 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened (read-only) \??\X: 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened (read-only) \??\Y: 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened (read-only) \??\O: 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened (read-only) \??\R: 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened (read-only) \??\S: 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened (read-only) \??\U: 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened (read-only) \??\W: 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened (read-only) \??\G: 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened (read-only) \??\K: 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened (read-only) \??\V: 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened (read-only) \??\I: 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened (read-only) \??\L: 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened for modification F:\autorun.inf 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe -
Runs .reg file with regedit 1 IoCs
pid Process 1260 regedit.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe Token: SeDebugPrivilege 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 768 wrote to memory of 1260 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 30 PID 768 wrote to memory of 1260 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 30 PID 768 wrote to memory of 1260 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 30 PID 768 wrote to memory of 1260 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 30 PID 768 wrote to memory of 1044 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 17 PID 768 wrote to memory of 1068 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 18 PID 768 wrote to memory of 1124 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 20 PID 768 wrote to memory of 1792 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 25 PID 768 wrote to memory of 1260 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 30 PID 768 wrote to memory of 1260 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 30 PID 768 wrote to memory of 1044 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 17 PID 768 wrote to memory of 1068 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 18 PID 768 wrote to memory of 1124 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 20 PID 768 wrote to memory of 1792 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 25 PID 768 wrote to memory of 1044 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 17 PID 768 wrote to memory of 1068 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 18 PID 768 wrote to memory of 1124 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 20 PID 768 wrote to memory of 1792 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 25 PID 768 wrote to memory of 1044 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 17 PID 768 wrote to memory of 1068 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 18 PID 768 wrote to memory of 1124 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 20 PID 768 wrote to memory of 1792 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 25 PID 768 wrote to memory of 1044 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 17 PID 768 wrote to memory of 1068 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 18 PID 768 wrote to memory of 1124 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 20 PID 768 wrote to memory of 1792 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 25 PID 768 wrote to memory of 1044 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 17 PID 768 wrote to memory of 1068 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 18 PID 768 wrote to memory of 1124 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 20 PID 768 wrote to memory of 1792 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 25 PID 768 wrote to memory of 1044 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 17 PID 768 wrote to memory of 1068 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 18 PID 768 wrote to memory of 1124 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 20 PID 768 wrote to memory of 1792 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 25 PID 768 wrote to memory of 1044 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 17 PID 768 wrote to memory of 1068 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 18 PID 768 wrote to memory of 1124 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 20 PID 768 wrote to memory of 1792 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 25 PID 768 wrote to memory of 1044 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 17 PID 768 wrote to memory of 1068 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 18 PID 768 wrote to memory of 1124 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 20 PID 768 wrote to memory of 1792 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 25 PID 768 wrote to memory of 1044 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 17 PID 768 wrote to memory of 1068 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 18 PID 768 wrote to memory of 1124 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 20 PID 768 wrote to memory of 1792 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 25 PID 768 wrote to memory of 1044 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 17 PID 768 wrote to memory of 1068 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 18 PID 768 wrote to memory of 1124 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 20 PID 768 wrote to memory of 1792 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 25 PID 768 wrote to memory of 1044 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 17 PID 768 wrote to memory of 1068 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 18 PID 768 wrote to memory of 1124 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 20 PID 768 wrote to memory of 1792 768 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe 25 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1044
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1068
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\278a47c8c7857cc695f482f146e3970a_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:768 -
C:\Windows\SysWOW64\regedit.exeregedit /s C:\WINDOWS\ime\game.reg3⤵
- Runs .reg file with regedit
PID:1260
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1792
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD55dcbd894b80c7b2539cbce1603dd2390
SHA1cd269659a0dfeebdbbe70aaddaace8e530cdea4e
SHA25660b272b27c7549ed1d7f91b9a7eefd82d73a6b441cf12ada3faa0868ae0e36ea
SHA512b83c3338e6c78f1f03e04baeab0397f90cd96f54534d0a46b7ceaec57cd06eec012b0dc91d8b49b198b7d2792aec2fed092ad350de4a648704e97b10f87acadc