6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f

Analysis

max time kernel
140s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10-08-2024 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87bc1902b89ac09e8904fb77f997bf02_JaffaCakes118.exe
Size

473KB
MD5

87bc1902b89ac09e8904fb77f997bf02
SHA1

7f193a3ca6f3e20e005d1890ccc30197ef5df1e0
SHA256

6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f
SHA512

8fa91c61513b80fcb67ecc1640359db4c481013346f7ced0d79afa08bbd5621282f57e29fd8014e7f2f651cda68705874a2e22e9340d77bf7c77b531cb86fb8e
SSDEEP

6144:JnXOFxDkS6WtG6gGUgy9ZWHhnP9Ba5CfZomKKg7+uTAVg9EVJ0BVKvh82CYBuBNk:JRS6Wefq9Ba5oO7TUUk

Score

10^/10

discovery evasion execution trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	87bc1902b89ac09e8904fb77f997bf02_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	87bc1902b89ac09e8904fb77f997bf02_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	87bc1902b89ac09e8904fb77f997bf02_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	87bc1902b89ac09e8904fb77f997bf02_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	87bc1902b89ac09e8904fb77f997bf02_JaffaCakes118.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	87bc1902b89ac09e8904fb77f997bf02_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe

Executes dropped EXE 2 IoCs

pid	Process
2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe
1080	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3608	powershell.exe
1576	powershell.exe
4504	powershell.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5104	sc.exe
1924	sc.exe
3216	sc.exe
3240	sc.exe
2808	sc.exe
4008	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	87bc1902b89ac09e8904fb77f997bf02_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe

Modifies data under HKEY_USERS 51 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3608	powershell.exe
3608	powershell.exe
1576	powershell.exe
1576	powershell.exe
4504	powershell.exe
4504	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3608	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeTcbPrivilege	1080	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 4496	4220	87bc1902b89ac09e8904fb77f997bf02_JaffaCakes118.exe	84
PID 4220 wrote to memory of 4496	4220	87bc1902b89ac09e8904fb77f997bf02_JaffaCakes118.exe	84
PID 4220 wrote to memory of 4132	4220	87bc1902b89ac09e8904fb77f997bf02_JaffaCakes118.exe	86
PID 4220 wrote to memory of 4132	4220	87bc1902b89ac09e8904fb77f997bf02_JaffaCakes118.exe	86
PID 4220 wrote to memory of 5028	4220	87bc1902b89ac09e8904fb77f997bf02_JaffaCakes118.exe	87
PID 4220 wrote to memory of 5028	4220	87bc1902b89ac09e8904fb77f997bf02_JaffaCakes118.exe	87
PID 4496 wrote to memory of 2808	4496	cmd.exe	90
PID 4496 wrote to memory of 2808	4496	cmd.exe	90
PID 4132 wrote to memory of 4008	4132	cmd.exe	92
PID 4132 wrote to memory of 4008	4132	cmd.exe	92
PID 5028 wrote to memory of 3608	5028	cmd.exe	91
PID 5028 wrote to memory of 3608	5028	cmd.exe	91
PID 4220 wrote to memory of 2052	4220	87bc1902b89ac09e8904fb77f997bf02_JaffaCakes118.exe	103
PID 4220 wrote to memory of 2052	4220	87bc1902b89ac09e8904fb77f997bf02_JaffaCakes118.exe	103
PID 4220 wrote to memory of 2052	4220	87bc1902b89ac09e8904fb77f997bf02_JaffaCakes118.exe	103
PID 2052 wrote to memory of 888	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	104
PID 2052 wrote to memory of 888	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	104
PID 2052 wrote to memory of 1748	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	106
PID 2052 wrote to memory of 1748	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	106
PID 2052 wrote to memory of 3944	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	108
PID 2052 wrote to memory of 3944	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	108
PID 888 wrote to memory of 5104	888	cmd.exe	110
PID 888 wrote to memory of 5104	888	cmd.exe	110
PID 1748 wrote to memory of 1924	1748	cmd.exe	111
PID 1748 wrote to memory of 1924	1748	cmd.exe	111
PID 3944 wrote to memory of 1576	3944	cmd.exe	112
PID 3944 wrote to memory of 1576	3944	cmd.exe	112
PID 2052 wrote to memory of 5076	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	113
PID 2052 wrote to memory of 5076	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	113
PID 2052 wrote to memory of 5076	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	113
PID 2052 wrote to memory of 5076	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	113
PID 2052 wrote to memory of 5076	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	113
PID 2052 wrote to memory of 5076	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	113
PID 2052 wrote to memory of 5076	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	113
PID 2052 wrote to memory of 5076	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	113
PID 2052 wrote to memory of 5076	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	113
PID 2052 wrote to memory of 5076	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	113
PID 2052 wrote to memory of 5076	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	113
PID 2052 wrote to memory of 5076	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	113
PID 2052 wrote to memory of 5076	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	113
PID 2052 wrote to memory of 5076	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	113
PID 2052 wrote to memory of 5076	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	113
PID 2052 wrote to memory of 5076	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	113
PID 2052 wrote to memory of 5076	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	113
PID 2052 wrote to memory of 5076	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	113
PID 2052 wrote to memory of 5076	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	113
PID 2052 wrote to memory of 5076	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	113
PID 2052 wrote to memory of 5076	2052	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	113
PID 1080 wrote to memory of 2412	1080	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	119
PID 1080 wrote to memory of 2412	1080	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	119
PID 1080 wrote to memory of 5052	1080	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	121
PID 1080 wrote to memory of 5052	1080	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	121
PID 1080 wrote to memory of 2040	1080	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	123
PID 1080 wrote to memory of 2040	1080	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	123
PID 2412 wrote to memory of 3240	2412	cmd.exe	125
PID 2412 wrote to memory of 3240	2412	cmd.exe	125
PID 5052 wrote to memory of 3216	5052	cmd.exe	126
PID 5052 wrote to memory of 3216	5052	cmd.exe	126
PID 2040 wrote to memory of 4504	2040	cmd.exe	127
PID 2040 wrote to memory of 4504	2040	cmd.exe	127
PID 1080 wrote to memory of 1476	1080	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	132
PID 1080 wrote to memory of 1476	1080	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	132
PID 1080 wrote to memory of 1476	1080	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	132
PID 1080 wrote to memory of 1476	1080	98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\87bc1902b89ac09e8904fb77f997bf02_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\87bc1902b89ac09e8904fb77f997bf02_JaffaCakes118.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:2808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc delete WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\system32\sc.exe
    sc delete WinDefend
    3⤵
    - Launches sc.exe
    PID:4008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3608
- C:\Users\Admin\AppData\Roaming\wnetwork\98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe
  C:\Users\Admin\AppData\Roaming\wnetwork\98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:888
  - - C:\Windows\system32\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      PID:5104
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc delete WinDefend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\Windows\system32\sc.exe
      sc delete WinDefend
      4⤵
      Launches sc.exe
      PID:1924
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1576
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:5076

C:\Users\Admin\AppData\Roaming\wnetwork\98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe
C:\Users\Admin\AppData\Roaming\wnetwork\98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:3240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc delete WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\system32\sc.exe
    sc delete WinDefend
    3⤵
    - Launches sc.exe
    PID:3216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4504
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:1476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gwsig3pi.dr1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-523280732-2327480845-3730041215-1000\0f5007522459c86e95ffcc62f32308f1_a5c5e2ae-85e3-447c-9e0b-c9a7b966d823

Filesize
1KB

MD5
71c6f8abb62757d6ccbe6095c7226084

SHA1
cb4d0e8635ec38f2425c3eabb3c6a23f7be586b3

SHA256
ca2d274d7277d239da31551fa3922c1a28bed0b72e28c66cfcaf4bb5c0e98c00

SHA512
e2f4d5e8396d68ac6327ec9d91f83c24509311889d0efaec3a1423f6dc446600a58e9d3e70411738bfcc0ebf8b2ba850570b1bc4827346351c59c5ff7a1248d4

Download Submit
C:\Users\Admin\AppData\Roaming\wnetwork\98bc1902b99ac09e9905fb88f998bf02_KaffaDalet119.exe

Filesize
473KB

MD5
87bc1902b89ac09e8904fb77f997bf02

SHA1
7f193a3ca6f3e20e005d1890ccc30197ef5df1e0

SHA256
6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f

SHA512
8fa91c61513b80fcb67ecc1640359db4c481013346f7ced0d79afa08bbd5621282f57e29fd8014e7f2f651cda68705874a2e22e9340d77bf7c77b531cb86fb8e

Download Submit
memory/1080-92-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1080-93-0x0000000002510000-0x00000000025CE000-memory.dmp

Filesize
760KB

Download
memory/1080-82-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1080-94-0x00000000025D0000-0x0000000002899000-memory.dmp

Filesize
2.8MB

Download
memory/1476-96-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2052-47-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2052-35-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2052-39-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2052-48-0x0000000003840000-0x00000000038FE000-memory.dmp

Filesize
760KB

Download
memory/2052-49-0x0000000003900000-0x0000000003BC9000-memory.dmp

Filesize
2.8MB

Download
memory/3608-0-0x00007FFCD1573000-0x00007FFCD1575000-memory.dmp

Filesize
8KB

Download
memory/3608-15-0x00007FFCD1570000-0x00007FFCD2031000-memory.dmp

Filesize
10.8MB

Download
memory/3608-12-0x00007FFCD1570000-0x00007FFCD2031000-memory.dmp

Filesize
10.8MB

Download
memory/3608-11-0x00007FFCD1570000-0x00007FFCD2031000-memory.dmp

Filesize
10.8MB

Download
memory/3608-7-0x0000025A275A0000-0x0000025A275C2000-memory.dmp

Filesize
136KB

Download
memory/4220-22-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4220-16-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4504-72-0x00000206A3DA0000-0x00000206A3DBC000-memory.dmp

Filesize
112KB

Download
memory/4504-73-0x00000206A3D80000-0x00000206A3D8A000-memory.dmp

Filesize
40KB

Download
memory/4504-74-0x00000206A3DE0000-0x00000206A3DFA000-memory.dmp

Filesize
104KB

Download
memory/4504-75-0x00000206A3D90000-0x00000206A3D98000-memory.dmp

Filesize
32KB

Download
memory/4504-76-0x00000206A3DC0000-0x00000206A3DC6000-memory.dmp

Filesize
24KB

Download
memory/4504-77-0x00000206A3DD0000-0x00000206A3DDA000-memory.dmp

Filesize
40KB

Download
memory/4504-71-0x00000206A3B50000-0x00000206A3B5A000-memory.dmp

Filesize
40KB

Download
memory/4504-70-0x00000206A3B80000-0x00000206A3C35000-memory.dmp

Filesize
724KB

Download
memory/4504-69-0x00000206A3B60000-0x00000206A3B7C000-memory.dmp

Filesize
112KB

Download
memory/5076-43-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download