Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 21:08
Static task
static1
Behavioral task
behavioral1
Sample
366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe
-
Size
167KB
-
MD5
366349ba69f9f52fcc2c3d72c54776bd
-
SHA1
6475c5ef843ec918c339b72610948612920b866a
-
SHA256
a04f9d4e9f37dcf8ee7893c10ca57d3daa79ead5fd89addfd3bbff1211cd461e
-
SHA512
676bbde196d7063bcb32b72df498a89df3a6473fd269fdb7b516e9104a8828fdb8c17d51e71e1b2aec7c3201beba6d74244046648f01b5e3cd4d9c28be0bd9ac
-
SSDEEP
3072:/NQKPWDyWI0jMfLlICNQ3PFMRCxyLiFEw4lKDk7X6fgOBAzzufzJreD+Mq66PNgy:/NSDyWIQMjlXNhRCk2N4g+X+iw9Oq661
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe -
Processes:
366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe -
Processes:
366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe -
Disables Task Manager via registry modification
-
Processes:
resource yara_rule behavioral1/memory/2368-2-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-5-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-10-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-4-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-9-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-11-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-8-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-6-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-7-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-26-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-25-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-29-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-30-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-32-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-33-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-34-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-36-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-38-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-41-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-42-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-45-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-46-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-63-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-65-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-66-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-69-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-70-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral1/memory/2368-73-0x0000000002430000-0x00000000034BE000-memory.dmp upx -
Processes:
366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe -
Processes:
366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe -
Drops file in Program Files directory 5 IoCs
Processes:
366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exedescription ioc process File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\BCSSYNC.EXE 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
Processes:
366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exepid process 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes:
366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Token: SeDebugPrivilege 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 60 IoCs
Processes:
366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exedescription pid process target process PID 2368 wrote to memory of 1104 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe taskhost.exe PID 2368 wrote to memory of 1164 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Dwm.exe PID 2368 wrote to memory of 1200 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Explorer.EXE PID 2368 wrote to memory of 2044 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe DllHost.exe PID 2368 wrote to memory of 1104 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe taskhost.exe PID 2368 wrote to memory of 1164 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Dwm.exe PID 2368 wrote to memory of 1200 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Explorer.EXE PID 2368 wrote to memory of 2044 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe DllHost.exe PID 2368 wrote to memory of 1104 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe taskhost.exe PID 2368 wrote to memory of 1164 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Dwm.exe PID 2368 wrote to memory of 1200 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Explorer.EXE PID 2368 wrote to memory of 2044 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe DllHost.exe PID 2368 wrote to memory of 1104 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe taskhost.exe PID 2368 wrote to memory of 1164 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Dwm.exe PID 2368 wrote to memory of 1200 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Explorer.EXE PID 2368 wrote to memory of 2044 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe DllHost.exe PID 2368 wrote to memory of 1104 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe taskhost.exe PID 2368 wrote to memory of 1164 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Dwm.exe PID 2368 wrote to memory of 1200 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Explorer.EXE PID 2368 wrote to memory of 2044 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe DllHost.exe PID 2368 wrote to memory of 1104 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe taskhost.exe PID 2368 wrote to memory of 1164 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Dwm.exe PID 2368 wrote to memory of 1200 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Explorer.EXE PID 2368 wrote to memory of 2044 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe DllHost.exe PID 2368 wrote to memory of 1104 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe taskhost.exe PID 2368 wrote to memory of 1164 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Dwm.exe PID 2368 wrote to memory of 1200 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Explorer.EXE PID 2368 wrote to memory of 2044 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe DllHost.exe PID 2368 wrote to memory of 1104 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe taskhost.exe PID 2368 wrote to memory of 1164 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Dwm.exe PID 2368 wrote to memory of 1200 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Explorer.EXE PID 2368 wrote to memory of 2044 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe DllHost.exe PID 2368 wrote to memory of 1104 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe taskhost.exe PID 2368 wrote to memory of 1164 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Dwm.exe PID 2368 wrote to memory of 1200 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Explorer.EXE PID 2368 wrote to memory of 2044 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe DllHost.exe PID 2368 wrote to memory of 1104 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe taskhost.exe PID 2368 wrote to memory of 1164 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Dwm.exe PID 2368 wrote to memory of 1200 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Explorer.EXE PID 2368 wrote to memory of 2044 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe DllHost.exe PID 2368 wrote to memory of 1104 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe taskhost.exe PID 2368 wrote to memory of 1164 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Dwm.exe PID 2368 wrote to memory of 1200 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Explorer.EXE PID 2368 wrote to memory of 2044 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe DllHost.exe PID 2368 wrote to memory of 1104 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe taskhost.exe PID 2368 wrote to memory of 1164 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Dwm.exe PID 2368 wrote to memory of 1200 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Explorer.EXE PID 2368 wrote to memory of 2044 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe DllHost.exe PID 2368 wrote to memory of 1104 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe taskhost.exe PID 2368 wrote to memory of 1164 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Dwm.exe PID 2368 wrote to memory of 1200 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Explorer.EXE PID 2368 wrote to memory of 2044 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe DllHost.exe PID 2368 wrote to memory of 1104 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe taskhost.exe PID 2368 wrote to memory of 1164 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Dwm.exe PID 2368 wrote to memory of 1200 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Explorer.EXE PID 2368 wrote to memory of 2044 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe DllHost.exe PID 2368 wrote to memory of 1104 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe taskhost.exe PID 2368 wrote to memory of 1164 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Dwm.exe PID 2368 wrote to memory of 1200 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe Explorer.EXE PID 2368 wrote to memory of 2044 2368 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe DllHost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1164
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\366349ba69f9f52fcc2c3d72c54776bd_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2368
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2044
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1