Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
369a1abf72e...18.exe
windows7-x64
1069a1abf72e...18.exe
windows10-2004-x64
10$PLUGINSDI...Ex.dll
windows7-x64
3$PLUGINSDI...Ex.dll
windows10-2004-x64
3$PLUGINSDI...ad.dll
windows7-x64
3$PLUGINSDI...ad.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/Time.dll
windows7-x64
3$PLUGINSDIR/Time.dll
windows10-2004-x64
3$PLUGINSDI...ef.dll
windows7-x64
3$PLUGINSDI...ef.dll
windows10-2004-x64
3$PLUGINSDIR/mt.dll
windows7-x64
3$PLUGINSDIR/mt.dll
windows10-2004-x64
3$PLUGINSDI...os.dll
windows7-x64
3$PLUGINSDI...os.dll
windows10-2004-x64
3$_12_/exte...ete.js
windows7-x64
3$_12_/exte...ete.js
windows10-2004-x64
3$_12_/exte...lon.js
windows7-x64
3$_12_/exte...lon.js
windows10-2004-x64
3$_12_/exte...art.js
windows7-x64
3$_12_/exte...art.js
windows10-2004-x64
3$_12_/exte...ver.js
windows7-x64
3$_12_/exte...ver.js
windows10-2004-x64
3$_12_/exte...plt.js
windows7-x64
3$_12_/exte...plt.js
windows10-2004-x64
3$_12_/exte...ref.js
windows7-x64
3$_12_/exte...ref.js
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
24/07/2024, 00:50
Static task
static1
Behavioral task
behavioral1
Sample
69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ExtractDLLEx.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ExtractDLLEx.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InetLoad.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InetLoad.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/Time.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/Time.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/chrmPref.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/chrmPref.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/mt.dll
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/mt.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsisos.dll
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsisos.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
$_12_/extensions/[email protected]/components/acplus-autocomplete.js
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
$_12_/extensions/[email protected]/components/acplus-autocomplete.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
$_12_/extensions/[email protected]/content/babylon.js
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
$_12_/extensions/[email protected]/content/babylon.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
$_12_/extensions/[email protected]/content/mtstart.js
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
$_12_/extensions/[email protected]/content/mtstart.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
$_12_/extensions/[email protected]/content/server.js
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
$_12_/extensions/[email protected]/content/server.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
$_12_/extensions/[email protected]/content/tmplt.js
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
$_12_/extensions/[email protected]/content/tmplt.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
$_12_/extensions/[email protected]/defaults/preferences/instlPref.js
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
$_12_/extensions/[email protected]/defaults/preferences/instlPref.js
Resource
win10v2004-20240709-en
General
-
Target
69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe
-
Size
284KB
-
MD5
69a1abf72e139156db11fe97d335af60
-
SHA1
d295a6cb874e5a5e4de2a5c74a76dc6e70cb5c2b
-
SHA256
84a87dd084e36b8d75e627e159b44d02099461d9862659c4abbdc3ac6ce9296a
-
SHA512
a583754d45b6700dbd3c4b60958c56f7d56de39469a0d30e379a90df9f2d021ca50de229b4ea9cc576e188546db6d50268132b58b0bb7b51f21edf339e4f270b
-
SSDEEP
6144:aevN4q82soV8Bf+a2GWy4j0zGiTpiE+frpjF+q+o1f31qRH:7v82zV8BfWjbcpiE+frpjV+o1N6H
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe -
Loads dropped DLL 2 IoCs
pid Process 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/3052-5-0x0000000001F60000-0x0000000002FEE000-memory.dmp upx behavioral1/memory/3052-6-0x0000000001F60000-0x0000000002FEE000-memory.dmp upx behavioral1/memory/3052-7-0x0000000001F60000-0x0000000002FEE000-memory.dmp upx behavioral1/memory/3052-4-0x0000000001F60000-0x0000000002FEE000-memory.dmp upx behavioral1/memory/3052-3-0x0000000001F60000-0x0000000002FEE000-memory.dmp upx behavioral1/memory/3052-8-0x0000000001F60000-0x0000000002FEE000-memory.dmp upx behavioral1/memory/3052-82-0x0000000001F60000-0x0000000002FEE000-memory.dmp upx behavioral1/memory/3052-83-0x0000000001F60000-0x0000000002FEE000-memory.dmp upx behavioral1/memory/3052-84-0x0000000001F60000-0x0000000002FEE000-memory.dmp upx behavioral1/memory/3052-112-0x0000000001F60000-0x0000000002FEE000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe -
Drops file in Program Files directory 47 IoCs
description ioc Process File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\logo.PNG 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\privecy_16_hot.gif 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\vssver.scc 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\bg.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\ch.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\en.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\babylon.css 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\tmplt.js 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\il.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\ro.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\se.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\server.js 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\home.gif 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\eg.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\it.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\pt.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\components\acplus-autocomplete.js 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\de.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\tellafriend.gif 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\ja.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\jp.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\sa.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\defaults\preferences\instlPref.js 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\mtstart.js 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\chrome.manifest 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\arwDwn.gif 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\cn.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\es.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\pl.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\ru.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\install.rdf 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\help_16.gif 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\nl.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Mozilla Firefox\user.js 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\babylon.xul 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\Thumbs.db 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\fr.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\he.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\no.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\tr.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\us.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\bbyln.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\cz.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\sv.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\ua.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\ae.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\gr.png 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB} 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}\instl 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}\instl\data\instlRef = "na" 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}\instl\data 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Token: SeDebugPrivilege 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Token: SeDebugPrivilege 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Token: SeDebugPrivilege 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Token: SeDebugPrivilege 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Token: SeDebugPrivilege 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Token: SeDebugPrivilege 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Token: SeDebugPrivilege 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Token: SeDebugPrivilege 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Token: SeDebugPrivilege 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Token: SeDebugPrivilege 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Token: SeDebugPrivilege 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Token: SeDebugPrivilege 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Token: SeDebugPrivilege 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Token: SeDebugPrivilege 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Token: SeDebugPrivilege 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Token: SeDebugPrivilege 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Token: SeDebugPrivilege 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Token: SeDebugPrivilege 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Token: SeDebugPrivilege 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Token: SeDebugPrivilege 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe Token: SeDebugPrivilege 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3052 wrote to memory of 1124 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe 19 PID 3052 wrote to memory of 1192 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe 20 PID 3052 wrote to memory of 1256 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe 21 PID 3052 wrote to memory of 1560 3052 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe 25 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1124
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1192
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\69a1abf72e139156db11fe97d335af60_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3052
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1560
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
222B
MD516250119013cd45cf98e860add74e412
SHA1aac1f56275bcd946bdc968e0b04c06a18be51d2f
SHA25667e3103cd044b18a5b77d750411956427e115879ba48d5f124303b77a4da2995
SHA51265356cc6c15308bfd8c968311f559ae3776d2c9bcb750d77fa89b8ecbfc59d7f41465bd77d355699896d0c143f6d2191a9df60eb4dd1a9ef6645037cc9da7828
-
Filesize
110B
MD5ce66fc825067c20b07450b54f3daa197
SHA1723f5e32db06460ce7340aabd5ec1976f1dd9ea4
SHA256172c247c317ecc3708a362deed70d6c01163d289805f919607a9a7e13e7060fc
SHA5121d4be652f5db7126e798343c1e71bec3d3d28119266dd05fc0b9fe22a058b3a95ffe95559dde665e7b7fcf3e470033410fa89425abf5272b3563a2558fc238d3
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
5KB
MD569806691d649ef1c8703fd9e29231d44
SHA1e2193fcf5b4863605eec2a5eb17bf84c7ac00166
SHA256ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6
SHA5125e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb