sality | 4a623f414432a130f49fefc752f65a9ec106cedc02c2b228d89ec6b1976cb97c

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe

Windows security bypass 2 TTPs 6 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
2972	pkl.exe

Loads dropped DLL 1 IoCs

pid	Process
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe

UPX packed file 41 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/404-0-0x0000000000400000-0x00000000005B7000-memory.dmp	upx
behavioral2/memory/404-1-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-18-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-19-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-20-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-26-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-21-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-45-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-47-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-46-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-63-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-64-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-97-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-106-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-119-0x0000000000400000-0x00000000005B7000-memory.dmp	upx
behavioral2/memory/404-118-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-120-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-125-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-146-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-154-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-156-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-170-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-171-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-181-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-180-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-186-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-187-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-190-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-191-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-192-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-195-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-196-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-208-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-209-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-211-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-228-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-229-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-230-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-231-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-232-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx
behavioral2/memory/404-233-0x0000000000B40000-0x0000000001BCE000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\Tutorial.txt	pkl.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
3860	msedge.exe
3860	msedge.exe
412	msedge.exe
412	msedge.exe
4704	msedge.exe
4704	msedge.exe
5492	identity_helper.exe
5492	identity_helper.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
Token: SeDebugPrivilege	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2972	pkl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 3560	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	85
PID 404 wrote to memory of 3560	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	85
PID 404 wrote to memory of 3560	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	85
PID 404 wrote to memory of 788	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	9
PID 404 wrote to memory of 796	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	10
PID 404 wrote to memory of 336	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	13
PID 404 wrote to memory of 2492	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	42
PID 404 wrote to memory of 2500	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	43
PID 404 wrote to memory of 2636	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	46
PID 404 wrote to memory of 3508	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	56
PID 404 wrote to memory of 3656	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	57
PID 404 wrote to memory of 3848	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	58
PID 404 wrote to memory of 3984	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	59
PID 404 wrote to memory of 4048	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	60
PID 404 wrote to memory of 660	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	61
PID 404 wrote to memory of 3528	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	62
PID 404 wrote to memory of 3452	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	75
PID 404 wrote to memory of 1456	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	76
PID 404 wrote to memory of 2356	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	81
PID 404 wrote to memory of 1716	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	82
PID 404 wrote to memory of 2004	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	84
PID 404 wrote to memory of 3560	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	85
PID 404 wrote to memory of 3560	404	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe	85
PID 3560 wrote to memory of 2972	3560	cmd.exe	86
PID 3560 wrote to memory of 2972	3560	cmd.exe	86
PID 3560 wrote to memory of 2972	3560	cmd.exe	86
PID 2972 wrote to memory of 412	2972	pkl.exe	87
PID 2972 wrote to memory of 412	2972	pkl.exe	87
PID 412 wrote to memory of 1020	412	msedge.exe	88
PID 412 wrote to memory of 1020	412	msedge.exe	88
PID 2972 wrote to memory of 2964	2972	pkl.exe	89
PID 2972 wrote to memory of 2964	2972	pkl.exe	89
PID 2964 wrote to memory of 996	2964	msedge.exe	90
PID 2964 wrote to memory of 996	2964	msedge.exe	90
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91
PID 412 wrote to memory of 540	412	msedge.exe	91

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:796

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2492

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2500

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2636

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3508
- C:\Users\Admin\AppData\Local\Temp\a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a0cbf1cd84f37e1c1e5e44f7709805bd_JaffaCakes118.exe"
  2⤵
  - Modifies firewall policy service
  - UAC bypass
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Loads dropped DLL
  - Windows security modification
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:404
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2004
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B4B9.tmp\pkl Succed.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\pkl.exe
      pkl.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pekalongan-community.com/
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:412
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0b4346f8,0x7ffa0b434708,0x7ffa0b434718
        6⤵
        
        PID:1020
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,10140733115902533978,83006946097772453,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
        6⤵
        
        PID:540
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,10140733115902533978,83006946097772453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3860
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,10140733115902533978,83006946097772453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
        6⤵
        
        PID:1520
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10140733115902533978,83006946097772453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
        6⤵
        
        PID:528
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10140733115902533978,83006946097772453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
        6⤵
        
        PID:3416
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10140733115902533978,83006946097772453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
        6⤵
        
        PID:2572
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10140733115902533978,83006946097772453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4296 /prefetch:1
        6⤵
        
        PID:1472
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10140733115902533978,83006946097772453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
        6⤵
        
        PID:4140
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10140733115902533978,83006946097772453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
        6⤵
        
        PID:3460
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10140733115902533978,83006946097772453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
        6⤵
        
        PID:1036
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10140733115902533978,83006946097772453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
        6⤵
        
        PID:3224
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,10140733115902533978,83006946097772453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6616 /prefetch:8
        6⤵
        
        PID:5324
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,10140733115902533978,83006946097772453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6616 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5492
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10140733115902533978,83006946097772453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
        6⤵
        
        PID:5520
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10140733115902533978,83006946097772453,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
        6⤵
        
        PID:5528
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10140733115902533978,83006946097772453,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
        6⤵
        
        PID:5960
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10140733115902533978,83006946097772453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
        6⤵
        
        PID:1672
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,10140733115902533978,83006946097772453,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4888 /prefetch:2
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://adfoc.us/153052382042
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2964
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffa0b4346f8,0x7ffa0b434708,0x7ffa0b434718
        6⤵
        
        PID:996
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1504,2442119996632308519,9056286895062311550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://podosugih-pekalongan.blogspot.com/
        5⤵
        
        PID:2648
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffa0b4346f8,0x7ffa0b434708,0x7ffa0b434718
        6⤵
        
        PID:5212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3656

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3848

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3984

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4048

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:660

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3528

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:3452

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1456

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:2356

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:1716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3260

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3008

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:428

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3416

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2628

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry