Analysis
-
max time kernel
131s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/08/2024, 04:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
24 signatures
150 seconds
General
-
Target
890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
890c6288af1b4e9d66963d946968ce4c
-
SHA1
a698881adc4d9e2012e9707b556519bba1908ea5
-
SHA256
a8c548d911b046423496e93dde158ddb08dee59490e135b0940ae22ce6934ace
-
SHA512
3f576af65967794e834f4e134ed480f657acf722d5604392cdbbac6ba2185a76a48a91701e723ea310c2cfef5531e319c03083364e0995a42378ee3b84326357
-
SSDEEP
24576:rHF6WSP0E+yrUz0ZpAv9Yxx4d/vPQ2HoIpeeksCHfMWiM61ZcDip:rwWo0SUzkqv9Y4dIuLI2y61Zj
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" Mon bifrost.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" Mon bifrost.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" Mon bifrost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Mon bifrost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Mon bifrost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Mon bifrost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Mon bifrost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Mon bifrost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Mon bifrost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Mon bifrost.exe -
ModiLoader Second Stage 7 IoCs
resource yara_rule behavioral2/memory/3376-5-0x0000000000400000-0x0000000000598000-memory.dmp modiloader_stage2 behavioral2/memory/3376-6-0x0000000000400000-0x0000000000598000-memory.dmp modiloader_stage2 behavioral2/memory/3376-8-0x0000000000400000-0x0000000000598000-memory.dmp modiloader_stage2 behavioral2/memory/3376-10-0x0000000000400000-0x0000000000598000-memory.dmp modiloader_stage2 behavioral2/files/0x00070000000234e8-15.dat modiloader_stage2 behavioral2/memory/3376-32-0x0000000000400000-0x0000000000598000-memory.dmp modiloader_stage2 behavioral2/memory/2856-50-0x0000000000400000-0x0000000000586000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation bifrost.exe -
Deletes itself 1 IoCs
pid Process 2640 Mon bifrost.exe -
Executes dropped EXE 4 IoCs
pid Process 2856 bifrost.exe 2420 7arboucha.exe 840 7arboucha.exe 2640 Mon bifrost.exe -
resource yara_rule behavioral2/memory/2640-52-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-54-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-55-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-58-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-56-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-65-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-66-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-67-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-57-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-68-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-69-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-70-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-71-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-72-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-84-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-85-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-86-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-87-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-88-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-90-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-92-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-94-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-98-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-99-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-100-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-101-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-103-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-105-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-108-0x00000000024C0000-0x000000000354E000-memory.dmp upx behavioral2/memory/2640-110-0x00000000024C0000-0x000000000354E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Mon bifrost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Mon bifrost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Mon bifrost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Mon bifrost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Mon bifrost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Mon bifrost.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Mon bifrost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Mon bifrost.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe File opened for modification C:\Windows\assembly\Desktop.ini 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: Mon bifrost.exe File opened (read-only) \??\J: Mon bifrost.exe File opened (read-only) \??\K: Mon bifrost.exe File opened (read-only) \??\R: Mon bifrost.exe File opened (read-only) \??\W: Mon bifrost.exe File opened (read-only) \??\Z: Mon bifrost.exe File opened (read-only) \??\H: Mon bifrost.exe File opened (read-only) \??\P: Mon bifrost.exe File opened (read-only) \??\S: Mon bifrost.exe File opened (read-only) \??\U: Mon bifrost.exe File opened (read-only) \??\V: Mon bifrost.exe File opened (read-only) \??\X: Mon bifrost.exe File opened (read-only) \??\N: Mon bifrost.exe File opened (read-only) \??\O: Mon bifrost.exe File opened (read-only) \??\Q: Mon bifrost.exe File opened (read-only) \??\M: Mon bifrost.exe File opened (read-only) \??\L: Mon bifrost.exe File opened (read-only) \??\T: Mon bifrost.exe File opened (read-only) \??\Y: Mon bifrost.exe File opened (read-only) \??\G: Mon bifrost.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf Mon bifrost.exe File opened for modification F:\autorun.inf Mon bifrost.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4264 set thread context of 3376 4264 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe 92 PID 2420 set thread context of 840 2420 7arboucha.exe 95 -
Drops file in Program Files directory 11 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe Mon bifrost.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe Mon bifrost.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe Mon bifrost.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe Mon bifrost.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe Mon bifrost.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe Mon bifrost.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe Mon bifrost.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe Mon bifrost.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe Mon bifrost.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe Mon bifrost.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe Mon bifrost.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\assembly 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe File created C:\Windows\assembly\Desktop.ini 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe File opened for modification C:\Windows\assembly\Desktop.ini 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe File opened for modification C:\Windows\SYSTEM.INI Mon bifrost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bifrost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7arboucha.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7arboucha.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mon bifrost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2640 Mon bifrost.exe 2640 Mon bifrost.exe 840 7arboucha.exe 840 7arboucha.exe 840 7arboucha.exe 840 7arboucha.exe 2640 Mon bifrost.exe 2640 Mon bifrost.exe 2640 Mon bifrost.exe 2640 Mon bifrost.exe 2640 Mon bifrost.exe 2640 Mon bifrost.exe 2640 Mon bifrost.exe 2640 Mon bifrost.exe 2640 Mon bifrost.exe 2640 Mon bifrost.exe 2640 Mon bifrost.exe 2640 Mon bifrost.exe 2640 Mon bifrost.exe 2640 Mon bifrost.exe 2640 Mon bifrost.exe 2640 Mon bifrost.exe 2640 Mon bifrost.exe 2640 Mon bifrost.exe 2640 Mon bifrost.exe 2640 Mon bifrost.exe 2640 Mon bifrost.exe 2640 Mon bifrost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4264 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe Token: 33 4264 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4264 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe Token: SeDebugPrivilege 2640 Mon bifrost.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2420 7arboucha.exe 2420 7arboucha.exe 2640 Mon bifrost.exe 2640 Mon bifrost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4264 wrote to memory of 3376 4264 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe 92 PID 4264 wrote to memory of 3376 4264 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe 92 PID 4264 wrote to memory of 3376 4264 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe 92 PID 4264 wrote to memory of 3376 4264 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe 92 PID 4264 wrote to memory of 3376 4264 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe 92 PID 4264 wrote to memory of 3376 4264 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe 92 PID 4264 wrote to memory of 3376 4264 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe 92 PID 4264 wrote to memory of 3376 4264 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe 92 PID 4264 wrote to memory of 3376 4264 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe 92 PID 4264 wrote to memory of 3376 4264 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe 92 PID 4264 wrote to memory of 3376 4264 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe 92 PID 4264 wrote to memory of 3376 4264 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe 92 PID 4264 wrote to memory of 3376 4264 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe 92 PID 3376 wrote to memory of 2856 3376 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe 93 PID 3376 wrote to memory of 2856 3376 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe 93 PID 3376 wrote to memory of 2856 3376 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe 93 PID 3376 wrote to memory of 2420 3376 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe 94 PID 3376 wrote to memory of 2420 3376 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe 94 PID 3376 wrote to memory of 2420 3376 890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe 94 PID 2420 wrote to memory of 840 2420 7arboucha.exe 95 PID 2420 wrote to memory of 840 2420 7arboucha.exe 95 PID 2420 wrote to memory of 840 2420 7arboucha.exe 95 PID 2420 wrote to memory of 840 2420 7arboucha.exe 95 PID 2420 wrote to memory of 840 2420 7arboucha.exe 95 PID 2420 wrote to memory of 840 2420 7arboucha.exe 95 PID 2420 wrote to memory of 840 2420 7arboucha.exe 95 PID 2856 wrote to memory of 2640 2856 bifrost.exe 96 PID 2856 wrote to memory of 2640 2856 bifrost.exe 96 PID 2856 wrote to memory of 2640 2856 bifrost.exe 96 PID 2640 wrote to memory of 788 2640 Mon bifrost.exe 8 PID 2640 wrote to memory of 796 2640 Mon bifrost.exe 9 PID 2640 wrote to memory of 380 2640 Mon bifrost.exe 13 PID 2640 wrote to memory of 2816 2640 Mon bifrost.exe 49 PID 2640 wrote to memory of 2860 2640 Mon bifrost.exe 50 PID 2640 wrote to memory of 3016 2640 Mon bifrost.exe 51 PID 2640 wrote to memory of 3448 2640 Mon bifrost.exe 56 PID 2640 wrote to memory of 3560 2640 Mon bifrost.exe 57 PID 2640 wrote to memory of 3748 2640 Mon bifrost.exe 58 PID 2640 wrote to memory of 3840 2640 Mon bifrost.exe 59 PID 2640 wrote to memory of 3908 2640 Mon bifrost.exe 60 PID 2640 wrote to memory of 3992 2640 Mon bifrost.exe 61 PID 2640 wrote to memory of 4116 2640 Mon bifrost.exe 62 PID 2640 wrote to memory of 3600 2640 Mon bifrost.exe 75 PID 2640 wrote to memory of 224 2640 Mon bifrost.exe 76 PID 2640 wrote to memory of 3276 2640 Mon bifrost.exe 81 PID 2640 wrote to memory of 3920 2640 Mon bifrost.exe 85 PID 2640 wrote to memory of 4896 2640 Mon bifrost.exe 86 PID 2640 wrote to memory of 840 2640 Mon bifrost.exe 95 PID 2640 wrote to memory of 840 2640 Mon bifrost.exe 95 PID 840 wrote to memory of 3448 840 7arboucha.exe 56 PID 840 wrote to memory of 3448 840 7arboucha.exe 56 PID 840 wrote to memory of 3448 840 7arboucha.exe 56 PID 840 wrote to memory of 3448 840 7arboucha.exe 56 PID 2640 wrote to memory of 788 2640 Mon bifrost.exe 8 PID 2640 wrote to memory of 796 2640 Mon bifrost.exe 9 PID 2640 wrote to memory of 380 2640 Mon bifrost.exe 13 PID 2640 wrote to memory of 2816 2640 Mon bifrost.exe 49 PID 2640 wrote to memory of 2860 2640 Mon bifrost.exe 50 PID 2640 wrote to memory of 3016 2640 Mon bifrost.exe 51 PID 2640 wrote to memory of 3448 2640 Mon bifrost.exe 56 PID 2640 wrote to memory of 3560 2640 Mon bifrost.exe 57 PID 2640 wrote to memory of 3748 2640 Mon bifrost.exe 58 PID 2640 wrote to memory of 3840 2640 Mon bifrost.exe 59 PID 2640 wrote to memory of 3908 2640 Mon bifrost.exe 60 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Mon bifrost.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:380
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2816
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2860
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3016
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe"2⤵
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\890c6288af1b4e9d66963d946968ce4c_JaffaCakes118.exe"3⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\bifrost.exe"C:\Users\Admin\AppData\Local\Temp\bifrost.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\Mon bifrost.exe"C:\Users\Admin\AppData\Local\Temp\Mon bifrost.exe"5⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2640
-
-
-
C:\Users\Admin\AppData\Local\Temp\7arboucha.exe"C:\Users\Admin\AppData\Local\Temp\7arboucha.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\7arboucha.exe"C:\Users\Admin\AppData\Local\Temp\7arboucha.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:840
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3560
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3748
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3840
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3908
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3992
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4116
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3600
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:224
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:3276
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3920
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4896
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:4652
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:3572
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD5e7636d122892095b83829e80ea4bd803
SHA142c006afe6405128343ec7351991776f43b0bdb5
SHA256bb6308c787047532747c8f5381aa2209bcd057c267450e9d94aeba4da8300465
SHA512ef1eab4242fbe4816b65eee2897372367d7e51bda3933e10bd8ad7e6ed0ccb673f9a8824c3a93396e51ccabc0e72e85f2243005f34f4aa62ffdbb37b5601031e
-
Filesize
1.5MB
MD5835931c59e64ccfd25ff0319d8d96e21
SHA197438f447026d3b6af992886413e4edccf6e8b6d
SHA256e64e0fe2ede9e5dc04531cf5cf5c6b85f04d72c0b3f9df910dc34e98909343d5
SHA5127a8c30d8e81986b8f3beb4255104278f28f5d0d716c6466594d2b61c58725508b56d521556306b4b65181f1987a04f5297b565aa5c7146310f0e553f0682c687
-
Filesize
1.5MB
MD5a846898ac3f668214e7bbdc76017b402
SHA1aef15c9900b9b5470956808038dfb65818e0ca7a
SHA25665050f5f5bb2e1e5b4f71749da5b964ec7f7845f3982999936d0d04aced745ac
SHA51266c1b0dc2e5529b80e275259e4353723810c6d1b6f4c57976471cb88a23f157074252ea39531a21db91a7697352a9e26023f1893722827ac942d0f1d90087fcd
-
Filesize
100KB
MD587bcfee46411493e1aae8fef0ad42e47
SHA1f6f80c0946a062b2cb0fe784567acbb0db0db866
SHA25612f35851d9477305e04f73441971c1b301e3a87c9500afd7a40c1cd40df64875
SHA512ad634b4fc3e3e5a7b177804afe8fd1aac32ecec12abe28d049bc420ccdae1bdafa08313295f86da29e783f78b49618bcf94dd11a071f44afbdf327904dfa1a23