Analysis
-
max time kernel
123s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14/08/2024, 17:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
22 signatures
150 seconds
General
-
Target
96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe
-
Size
689KB
-
MD5
96faee621b3bd4b492fd7fe7656cab47
-
SHA1
ae86bcc70b10e6f5486c6582a3a052ce1bb0a26c
-
SHA256
3db3bdab9b5bb686e68c2c4697b3c24be21ea3d9584da3c171211aefd5a59751
-
SHA512
92a426b7c1477156bfe21dc9d169abe692736b5a648c9dee6c270c7cd7766bf0b96fc2c610785b6296002f175a7a9130b2c007f86b255707c043c5d3a8167b94
-
SSDEEP
12288:4aA8GifKcqKCoVxug3YC5fva3I/zLmt6is6jgCLpcres/NSWW24H6t:4aA8GifKc1CoVUufi3I/zCt7jFarfEjQ
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 3 IoCs
pid Process 2668 svchost.exe 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 2684 svchost.exe -
Loads dropped DLL 6 IoCs
pid Process 2668 svchost.exe 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2812-177-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-178-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-176-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-46-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-29-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-25-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-45-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-23-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-26-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-21-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-27-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-24-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-22-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-19-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-180-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-181-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-182-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-184-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-186-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-188-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-192-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-201-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-202-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-207-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-210-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-212-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-214-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/2812-238-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened (read-only) \??\O: 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened (read-only) \??\Q: 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened (read-only) \??\R: 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened (read-only) \??\U: 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened (read-only) \??\V: 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened (read-only) \??\E: 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened (read-only) \??\G: 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened (read-only) \??\Y: 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened (read-only) \??\M: 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened (read-only) \??\K: 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened (read-only) \??\L: 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened (read-only) \??\N: 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened (read-only) \??\P: 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened (read-only) \??\S: 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened (read-only) \??\W: 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened (read-only) \??\H: 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened (read-only) \??\I: 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened (read-only) \??\X: 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened (read-only) \??\T: 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened (read-only) \??\Z: 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened for modification F:\autorun.inf 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svchost.exe 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe File opened for modification C:\Windows\SYSTEM.INI 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\TypeLib\{75A564FE-95D1-41A9-B1D9-10D1E3CB502B}\1.0 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\Interface\{D10F4BFD-C3ED-44B7-BD0D-83F05E4D52D5}\TypeLib\ = "{75A564FE-95D1-41A9-B1D9-10D1E3CB502B}" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Interface\{D10F4BFD-C3ED-44B7-BD0D-83F05E4D52D5}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Interface\{6130BEAD-7375-4DB7-8B6D-7E41303CE675}\ = "_DUnityWebPlayerAX" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\ProgID\ = "UnityWebPlayer.UnityWebPlayer.1" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\MiscStatus\ = "0" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\TypeLib 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\TypeLib\{75A564FE-95D1-41A9-B1D9-10D1E3CB502B}\1.0\FLAGS\ = "0" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\Interface\{6130BEAD-7375-4DB7-8B6D-7E41303CE675}\ = "_DUnityWebPlayerAX" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\Interface\{6130BEAD-7375-4DB7-8B6D-7E41303CE675}\ProxyStubClsid32 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\Interface\{6130BEAD-7375-4DB7-8B6D-7E41303CE675}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\AppID\{F008CD3D-7044-4CD4-BE14-BF3FCCF144F9}\ = "UnityWebPlayer" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\UnityWebPlayer.UnityWebPlayer.1 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\Implemented Categories 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Interface\{6130BEAD-7375-4DB7-8B6D-7E41303CE675}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Interface\{D10F4BFD-C3ED-44B7-BD0D-83F05E4D52D5}\ = "_DUnityWebPlayerAXEvents" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Interface\{D10F4BFD-C3ED-44B7-BD0D-83F05E4D52D5}\TypeLib\Version = "1.0" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Interface\{6130BEAD-7375-4DB7-8B6D-7E41303CE675}\ProxyStubClsid32 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\VersionIndependentProgID 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\TypeLib\{75A564FE-95D1-41A9-B1D9-10D1E3CB502B}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\LocalLow\\Unity\\WebPlayer\\loader" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Interface 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\ProgID 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\MiscStatus\1 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\UnityWebPlayer.UnityWebPlayer.1\ = "UnityWebPlayer Control" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\UnityWebPlayer.UnityWebPlayer 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\UnityWebPlayer.UnityWebPlayer\CurVer 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\CLSID 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\Interface\{D10F4BFD-C3ED-44B7-BD0D-83F05E4D52D5}\ = "_DUnityWebPlayerAXEvents" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\Version 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\TypeLib\{75A564FE-95D1-41A9-B1D9-10D1E3CB502B}\1.0\0 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\TypeLib\{75A564FE-95D1-41A9-B1D9-10D1E3CB502B}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\LocalLow\\Unity\\WebPlayer\\loader\\UnityWebPluginAX.ocx" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\Interface\{6130BEAD-7375-4DB7-8B6D-7E41303CE675}\TypeLib\ = "{75A564FE-95D1-41A9-B1D9-10D1E3CB502B}" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\AppID\UnityWebPluginAX.ocx\AppID = "{F008CD3D-7044-4CD4-BE14-BF3FCCF144F9}" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\LocalLow\\Unity\\WebPlayer\\loader\\UnityWebPluginAX.ocx, 102" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\Interface\{D10F4BFD-C3ED-44B7-BD0D-83F05E4D52D5}\ProxyStubClsid32 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Interface\{D10F4BFD-C3ED-44B7-BD0D-83F05E4D52D5}\TypeLib\ = "{75A564FE-95D1-41A9-B1D9-10D1E3CB502B}" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Interface\{6130BEAD-7375-4DB7-8B6D-7E41303CE675} 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\ToolboxBitmap32 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\MiscStatus\1\ = "131473" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Interface\{D10F4BFD-C3ED-44B7-BD0D-83F05E4D52D5} 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Interface\{D10F4BFD-C3ED-44B7-BD0D-83F05E4D52D5}\ProxyStubClsid32 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\UnityWebPlayer.UnityWebPlayer\CLSID 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\Programmable 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\Interface\{6130BEAD-7375-4DB7-8B6D-7E41303CE675} 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\AppID = "{F008CD3D-7044-4CD4-BE14-BF3FCCF144F9}" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\TypeLib\{75A564FE-95D1-41A9-B1D9-10D1E3CB502B}\1.0\ = "UnityWebPlayerAXLib" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\TypeLib\{75A564FE-95D1-41A9-B1D9-10D1E3CB502B}\1.0\FLAGS 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\Interface\{6130BEAD-7375-4DB7-8B6D-7E41303CE675}\TypeLib\Version = "1.0" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Interface\{6130BEAD-7375-4DB7-8B6D-7E41303CE675}\TypeLib 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\UnityWebPlayer.UnityWebPlayer\CLSID\ = "{444785F1-DE89-4295-863A-D46C3A781394}" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\UnityWebPlayer.UnityWebPlayer\CurVer\ = "UnityWebPlayer.UnityWebPlayer.1" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\LocalLow\\Unity\\WebPlayer\\loader\\UnityWebPluginAX.ocx" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\Version\ = "1.0" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Interface\{D10F4BFD-C3ED-44B7-BD0D-83F05E4D52D5}\TypeLib 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\AppID\{F008CD3D-7044-4CD4-BE14-BF3FCCF144F9} 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\UnityWebPlayer.UnityWebPlayer.1\CLSID\ = "{444785F1-DE89-4295-863A-D46C3A781394}" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32\ThreadingModel = "Apartment" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\TypeLib\{75A564FE-95D1-41A9-B1D9-10D1E3CB502B} 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Wow6432Node\Interface\{D10F4BFD-C3ED-44B7-BD0D-83F05E4D52D5}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Interface\{6130BEAD-7375-4DB7-8B6D-7E41303CE675}\TypeLib\ = "{75A564FE-95D1-41A9-B1D9-10D1E3CB502B}" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe Token: SeDebugPrivilege 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 59 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2668 2252 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 30 PID 2252 wrote to memory of 2668 2252 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 30 PID 2252 wrote to memory of 2668 2252 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 30 PID 2252 wrote to memory of 2668 2252 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 30 PID 2668 wrote to memory of 2812 2668 svchost.exe 31 PID 2668 wrote to memory of 2812 2668 svchost.exe 31 PID 2668 wrote to memory of 2812 2668 svchost.exe 31 PID 2668 wrote to memory of 2812 2668 svchost.exe 31 PID 2668 wrote to memory of 2812 2668 svchost.exe 31 PID 2668 wrote to memory of 2812 2668 svchost.exe 31 PID 2668 wrote to memory of 2812 2668 svchost.exe 31 PID 2812 wrote to memory of 1104 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 19 PID 2812 wrote to memory of 1160 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 20 PID 2812 wrote to memory of 1192 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 21 PID 2812 wrote to memory of 1672 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 25 PID 2812 wrote to memory of 1104 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 19 PID 2812 wrote to memory of 1160 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 20 PID 2812 wrote to memory of 1192 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 21 PID 2812 wrote to memory of 1672 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 25 PID 2812 wrote to memory of 1104 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 19 PID 2812 wrote to memory of 1160 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 20 PID 2812 wrote to memory of 1192 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 21 PID 2812 wrote to memory of 1672 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 25 PID 2812 wrote to memory of 1104 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 19 PID 2812 wrote to memory of 1160 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 20 PID 2812 wrote to memory of 1192 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 21 PID 2812 wrote to memory of 1672 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 25 PID 2812 wrote to memory of 1104 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 19 PID 2812 wrote to memory of 1160 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 20 PID 2812 wrote to memory of 1192 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 21 PID 2812 wrote to memory of 1672 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 25 PID 2812 wrote to memory of 1104 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 19 PID 2812 wrote to memory of 1160 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 20 PID 2812 wrote to memory of 1192 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 21 PID 2812 wrote to memory of 1672 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 25 PID 2812 wrote to memory of 1104 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 19 PID 2812 wrote to memory of 1160 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 20 PID 2812 wrote to memory of 1192 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 21 PID 2812 wrote to memory of 1672 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 25 PID 2812 wrote to memory of 1104 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 19 PID 2812 wrote to memory of 1160 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 20 PID 2812 wrote to memory of 1192 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 21 PID 2812 wrote to memory of 1672 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 25 PID 2812 wrote to memory of 1104 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 19 PID 2812 wrote to memory of 1160 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 20 PID 2812 wrote to memory of 1192 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 21 PID 2812 wrote to memory of 1672 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 25 PID 2812 wrote to memory of 1104 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 19 PID 2812 wrote to memory of 1160 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 20 PID 2812 wrote to memory of 1192 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 21 PID 2812 wrote to memory of 1672 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 25 PID 2812 wrote to memory of 1104 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 19 PID 2812 wrote to memory of 1160 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 20 PID 2812 wrote to memory of 1192 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 21 PID 2812 wrote to memory of 1672 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 25 PID 2812 wrote to memory of 1104 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 19 PID 2812 wrote to memory of 1160 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 20 PID 2812 wrote to memory of 1192 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 21 PID 2812 wrote to memory of 1672 2812 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe 25 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\96faee621b3bd4b492fd7fe7656cab47_JaffaCakes118.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2812
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1672
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2684
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5501e69a8ed8eefc4023ec5e7cf0c634d
SHA16a688e9543f34de154a4e323d13f20b77d432275
SHA2568f808c746a3eeae33f4abbef14ec46004f5a69534c0885e48d431ce226680b9a
SHA5123a7c9266ffc484626896cc6d114b9dc554d16ea9f8d2059b36614f068799fdf39d5bf11eca25eb8b8d1108731433210958d76fec8d6ac5b2215b80a800236ec5
-
Filesize
922KB
MD5461482d079e06cc8cd6c62ac521b1390
SHA1f8d197b3d8d16cb4081d8ff47cb807d4ab3d9fd5
SHA25692a0401be747b8f269013b3c5b1fffafdb8fe50a5157bff55f74b4a291352f8f
SHA512d3f45d874f62943d745b08451b98ec0c1cfb5eb855a1d1de82296e49123759933bba42b954ec22d13ffef48f902bde1bb222145f6e6abed4df640c7b28658384
-
Filesize
653KB
MD5ee4d4710f36f8e9f4609e564fa451eca
SHA165e0197ca7fc31a8414fc12b1469a4f429a94dfb
SHA2567f1f5df1bcc6eeb884082d32594fc760dc7e1eec577ae78906eee1eea2801bd4
SHA5127bba7c1b8fdf02053dbb99210fbc891f2d9fbd035e3498bf46ef8ea98bc116453bae46ebf034689078b8b45207d165ff7473fd55305286c7efbe887909784105
-
Filesize
10KB
MD573ee934f37fc4d3dfa890ea5ec30db1d
SHA1ede6561cb69c3b9c6dc6a05b82cbee9b48e487cd
SHA25623be0b6141f07696b5ac41dbf633c5f18592b5c15d39a3eb8b5ffb65c7eb6aac
SHA512a0ee0b3ad08240ee20b154a5237471c46bcaf7f9753fca3428a48ccb9a31c05054d469dc87b96e5d44a15370ca45ae4d255db5cbc750e49aaa1fae4610c36568
-
Filesize
1KB
MD5e5d27a2c4563b83ed3c0770de07a9630
SHA1fd5347c641a7bd372af3fc20dd7954e76ddf7b6b
SHA2565ccc34e737411b2bc4f2ba93487acad695ee383fc81c465a3743747a43a2e086
SHA512f6c53e3e905930e63e53a99add915ef26ddead0610749c254082b71cecbb7c0c48f862802b1b302031f37db400560671b177a7e16339fea884f0c4538e0751d9
-
Filesize
35KB
MD59e3c13b6556d5636b745d3e466d47467
SHA12ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA25620af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
SHA5125a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b
-
Filesize
100KB
MD51fbb7b197c36eed264618a46f170b63b
SHA15296d760c3bb9f806cf8dff3d50e22038188dfe3
SHA2560ee956703c2246a591c715669a60e06d77b97945a28ed502cb4ddbb9405b5236
SHA5123bdeedcc62e4953a06474728e6acd71945cb87af20ef342c8467b90ede0e7091c2475c17a143c09a6963a22307c59c9ed28ec3c7f8b65a52485d40b2961733c4
-
Filesize
168KB
MD58848c71c4195d1f5c1c4a0190b2650d5
SHA1ff722087919ebb2e5da5ff759401062f24f42432
SHA256fdc509bd26642700e71ff9c0d508e2d5275581f0896b90a2408f6c67730eb702
SHA5123ecf9b2d0ed1c0d9b974eaae2404156885f065b97882e8f94cf46eca08092b64afe6c399e8c4c14c3ed171b4d9090d29ebffa506453897aad43f7b3443cdbbfb
-
Filesize
15KB
MD5605878b664b6c4ddefd73918fc45a440
SHA168328d6a9ce62a668bbe12878af26c1f1d0e3f82
SHA2567b3a3bf008489b61de83b94a63db4556cae5de80701a2e1ebdf9a025b3b631c4
SHA512c83eea75288272c3fb72aca2486581127dc4875ee80165511c38d32d3cb7e553836249df79358fc5d0ec5d7aef183c888c2df03ea688d163984cdd919255da26
-
Filesize
11KB
MD5d0d7d2799802f7cddf8db7a2d8ae1e23
SHA1ae8d8cfd9f1a7104036a9e8658f50f9c35c7a1c6
SHA256828819614dc0dbfb73f22d4c3712e6369230eab92819c5d4efe75870ee109a5a
SHA5122b5af0e34720eb2f5b0aa04b589b46fb4b4d344b5c5d23fdd382348b051ac9766ff80f6a2455ef66da78ba880e8ce41b23daf741033de7701ca3f17f1adde408
-
Filesize
4KB
MD513a689123cebd31c1d1862e05981beca
SHA10430094a1a0f639ba9bf5831c24f1f4330762a6d
SHA256386933bdaf4774e88670e21abbebdeddf64b1e87b1681f85ac5b3ec1cac8dcdf
SHA5120663148e80f4703000bbfc8ede2bcc7cad19877585a5cc46aa13a7003377d7315d33f01c1d311d38bcf5e3782e4b361510214f09a9f6537b856c5ad9bc41fdae