sality | 64508ab23525159540491d0b043c04085d66f0710eb16b66147db015a8c63d12

Analysis

max time kernel
147s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-08-2024 02:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Size

292KB
MD5

b1db9c2669b623927db676b2445548c4
SHA1

61a6bca8390c228a6956573711176627c0b8e035
SHA256

64508ab23525159540491d0b043c04085d66f0710eb16b66147db015a8c63d12
SHA512

5fe94789362acb4b838dc1dbbe120a0d81af7fa4d7f6657ce797d15aa3d28974977a6a44504a1dfb03dfd683654cdb6eded8cdacfbe4ef453aa08a555a03aca9
SSDEEP

3072:aQL/bCrWIPe5uL7jK2aTqkw7SvFaOgnYJPK2vz6VV5g6:aQL/bCrThaeKFap+v6Vvf

Score

10^/10

sality backdoor discovery evasion persistence trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe

Disables Task Manager via registry modification
evasion

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
2908	cssrs.exe
2760	cssrs.exe

Loads dropped DLL 4 IoCs

pid	Process
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2520-5-0x0000000001E60000-0x0000000002EEE000-memory.dmp	upx
behavioral1/memory/2520-4-0x0000000001E60000-0x0000000002EEE000-memory.dmp	upx
behavioral1/memory/2520-8-0x0000000001E60000-0x0000000002EEE000-memory.dmp	upx
behavioral1/memory/2520-3-0x0000000001E60000-0x0000000002EEE000-memory.dmp	upx
behavioral1/memory/2520-25-0x0000000001E60000-0x0000000002EEE000-memory.dmp	upx
behavioral1/memory/2520-7-0x0000000001E60000-0x0000000002EEE000-memory.dmp	upx
behavioral1/memory/2520-6-0x0000000001E60000-0x0000000002EEE000-memory.dmp	upx
behavioral1/memory/2520-26-0x0000000001E60000-0x0000000002EEE000-memory.dmp	upx
behavioral1/memory/2520-24-0x0000000001E60000-0x0000000002EEE000-memory.dmp	upx
behavioral1/memory/2520-43-0x0000000001E60000-0x0000000002EEE000-memory.dmp	upx
behavioral1/memory/2520-42-0x0000000001E60000-0x0000000002EEE000-memory.dmp	upx
behavioral1/memory/2520-47-0x0000000001E60000-0x0000000002EEE000-memory.dmp	upx
behavioral1/memory/2520-64-0x0000000001E60000-0x0000000002EEE000-memory.dmp	upx
behavioral1/memory/2520-65-0x0000000001E60000-0x0000000002EEE000-memory.dmp	upx
behavioral1/memory/2520-67-0x0000000001E60000-0x0000000002EEE000-memory.dmp	upx
behavioral1/memory/2520-69-0x0000000001E60000-0x0000000002EEE000-memory.dmp	upx
behavioral1/memory/2520-70-0x0000000001E60000-0x0000000002EEE000-memory.dmp	upx
behavioral1/memory/2520-72-0x0000000001E60000-0x0000000002EEE000-memory.dmp	upx
behavioral1/memory/2520-73-0x0000000001E60000-0x0000000002EEE000-memory.dmp	upx
behavioral1/memory/2520-104-0x0000000001E60000-0x0000000002EEE000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TINTIMG = "C:\\Users\\Admin\\AppData\\Roaming\\cssrs.exe"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened (read-only)	\??\I:	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened (read-only)	\??\M:	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened (read-only)	\??\P:	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened (read-only)	\??\Z:	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened (read-only)	\??\H:	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened (read-only)	\??\K:	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened (read-only)	\??\N:	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened (read-only)	\??\R:	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened (read-only)	\??\S:	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened (read-only)	\??\W:	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened (read-only)	\??\E:	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened (read-only)	\??\L:	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened (read-only)	\??\Q:	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened (read-only)	\??\T:	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened (read-only)	\??\U:	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened (read-only)	\??\V:	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened (read-only)	\??\X:	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened (read-only)	\??\J:	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened (read-only)	\??\O:	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened (read-only)	\??\Y:	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened for modification	F:\autorun.inf	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cssrs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cssrs.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs\Tabs = "http://www.114116.info"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\AboutURLs\Tabs = "http://www.114116.info"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.114116.info"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\AboutURLs	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\AboutURLs\blank = "http://www.114116.info"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://www.114116.info"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs\blank = "http://www.114116.info"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\AboutURLs	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.114116.info"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.114116.info"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2760	cssrs.exe
2760	cssrs.exe
2908	cssrs.exe
2908	cssrs.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2760	cssrs.exe
2760	cssrs.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2760	cssrs.exe
2760	cssrs.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2760	cssrs.exe
2760	cssrs.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2760	cssrs.exe
2760	cssrs.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2760	cssrs.exe
2760	cssrs.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2760	cssrs.exe
2760	cssrs.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2760	cssrs.exe
2760	cssrs.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2760	cssrs.exe
2760	cssrs.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2760	cssrs.exe
2760	cssrs.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2760	cssrs.exe
2760	cssrs.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 1080	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	18
PID 2520 wrote to memory of 1168	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	20
PID 2520 wrote to memory of 1196	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	21
PID 2520 wrote to memory of 2036	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	23
PID 2520 wrote to memory of 2760	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2760	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2760	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2760	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2908	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	31
PID 2520 wrote to memory of 2908	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	31
PID 2520 wrote to memory of 2908	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	31
PID 2520 wrote to memory of 2908	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	31
PID 2520 wrote to memory of 1080	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	18
PID 2520 wrote to memory of 1168	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	20
PID 2520 wrote to memory of 1196	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	21
PID 2520 wrote to memory of 2036	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	23
PID 2520 wrote to memory of 2760	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2760	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2908	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	31
PID 2520 wrote to memory of 2908	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	31
PID 2520 wrote to memory of 1080	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	18
PID 2520 wrote to memory of 1168	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	20
PID 2520 wrote to memory of 1196	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	21
PID 2520 wrote to memory of 2036	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	23
PID 2520 wrote to memory of 1080	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	18
PID 2520 wrote to memory of 1168	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	20
PID 2520 wrote to memory of 1196	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	21
PID 2520 wrote to memory of 2036	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	23
PID 2520 wrote to memory of 1080	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	18
PID 2520 wrote to memory of 1168	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	20
PID 2520 wrote to memory of 1196	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	21
PID 2520 wrote to memory of 2036	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	23
PID 2520 wrote to memory of 1080	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	18
PID 2520 wrote to memory of 1168	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	20
PID 2520 wrote to memory of 1196	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	21
PID 2520 wrote to memory of 2036	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	23
PID 2520 wrote to memory of 1080	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	18
PID 2520 wrote to memory of 1168	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	20
PID 2520 wrote to memory of 1196	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	21
PID 2520 wrote to memory of 2036	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	23
PID 2520 wrote to memory of 1080	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	18
PID 2520 wrote to memory of 1168	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	20
PID 2520 wrote to memory of 1196	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	21
PID 2520 wrote to memory of 2036	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	23
PID 2520 wrote to memory of 1080	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	18
PID 2520 wrote to memory of 1168	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	20
PID 2520 wrote to memory of 1196	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	21
PID 2520 wrote to memory of 2036	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	23
PID 2520 wrote to memory of 1080	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	18
PID 2520 wrote to memory of 1168	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	20
PID 2520 wrote to memory of 1196	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	21
PID 2520 wrote to memory of 2036	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	23
PID 2520 wrote to memory of 1080	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	18
PID 2520 wrote to memory of 1168	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	20
PID 2520 wrote to memory of 1196	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	21
PID 2520 wrote to memory of 2036	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	23
PID 2520 wrote to memory of 1080	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	18
PID 2520 wrote to memory of 1168	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	20
PID 2520 wrote to memory of 1196	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	21
PID 2520 wrote to memory of 2036	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	23
PID 2520 wrote to memory of 1080	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	18
PID 2520 wrote to memory of 1168	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	20
PID 2520 wrote to memory of 1196	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	21
PID 2520 wrote to memory of 2036	2520	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe	23

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1080

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1168

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Temp\b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe"
  2⤵
  - Modifies firewall policy service
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Drops startup file
  - Loads dropped DLL
  - Windows security modification
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2520
- - C:\Users\Admin\AppData\Roaming\cssrs.exe
    C:\Users\Admin\AppData\Roaming\cssrs.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2760
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2908

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0F769B46_Rar\b1db9c2669b623927db676b2445548c4_JaffaCakes118.exe

Filesize
216KB

MD5
9bde9702ccb28c3749e042e93cdbfb6b

SHA1
161e2e5981ef960a5345c5e64188b3294b2e5592

SHA256
e12693f934a8da01783010eed4cfae987c31ef3d4d65f6ff892140275f814bf5

SHA512
3d4f7daaefd9adf17d179a57b91a3d8718743c346cc2a70b6a7e551fbd217c108120cd8f444b8653000b63bb75298a29c890e9ad71236689811a20b8780a6553

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe

Filesize
292KB

MD5
b1db9c2669b623927db676b2445548c4

SHA1
61a6bca8390c228a6956573711176627c0b8e035

SHA256
64508ab23525159540491d0b043c04085d66f0710eb16b66147db015a8c63d12

SHA512
5fe94789362acb4b838dc1dbbe120a0d81af7fa4d7f6657ce797d15aa3d28974977a6a44504a1dfb03dfd683654cdb6eded8cdacfbe4ef453aa08a555a03aca9

Download Submit
F:\jmxkn.exe

Filesize
100KB

MD5
f837be3deaffcc1732bd5082147b0605

SHA1
d92b8278fa120e87713feda2070a2a10cedb7b0b

SHA256
f351b0a76d41ee416940c2375f148b15866a3550b5ac055ce95be9ee01e04b58

SHA512
e0f0bd1f544ff715009702aa8284b5116b9005336a070d0ad4cc514f2257bf2f346c11456cbde322f7fa1f7473a69406af8eea32812969fd99a541ca934a73a0

Download Submit
memory/1080-9-0x0000000000410000-0x0000000000412000-memory.dmp

Filesize
8KB

Download
memory/2520-59-0x0000000004FC0000-0x000000000500F000-memory.dmp

Filesize
316KB

Download
memory/2520-68-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/2520-18-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/2520-64-0x0000000001E60000-0x0000000002EEE000-memory.dmp

Filesize
16.6MB

Download
memory/2520-8-0x0000000001E60000-0x0000000002EEE000-memory.dmp

Filesize
16.6MB

Download
memory/2520-3-0x0000000001E60000-0x0000000002EEE000-memory.dmp

Filesize
16.6MB

Download
memory/2520-25-0x0000000001E60000-0x0000000002EEE000-memory.dmp

Filesize
16.6MB

Download
memory/2520-7-0x0000000001E60000-0x0000000002EEE000-memory.dmp

Filesize
16.6MB

Download
memory/2520-23-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/2520-6-0x0000000001E60000-0x0000000002EEE000-memory.dmp

Filesize
16.6MB

Download
memory/2520-26-0x0000000001E60000-0x0000000002EEE000-memory.dmp

Filesize
16.6MB

Download
memory/2520-24-0x0000000001E60000-0x0000000002EEE000-memory.dmp

Filesize
16.6MB

Download
memory/2520-21-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2520-5-0x0000000001E60000-0x0000000002EEE000-memory.dmp

Filesize
16.6MB

Download
memory/2520-43-0x0000000001E60000-0x0000000002EEE000-memory.dmp

Filesize
16.6MB

Download
memory/2520-46-0x0000000004E80000-0x0000000004ECF000-memory.dmp

Filesize
316KB

Download
memory/2520-42-0x0000000001E60000-0x0000000002EEE000-memory.dmp

Filesize
16.6MB

Download
memory/2520-100-0x0000000003040000-0x0000000003042000-memory.dmp

Filesize
8KB

Download
memory/2520-65-0x0000000001E60000-0x0000000002EEE000-memory.dmp

Filesize
16.6MB

Download
memory/2520-193-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2520-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2520-58-0x0000000004FC0000-0x000000000500F000-memory.dmp

Filesize
316KB

Download
memory/2520-4-0x0000000001E60000-0x0000000002EEE000-memory.dmp

Filesize
16.6MB

Download
memory/2520-22-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/2520-47-0x0000000001E60000-0x0000000002EEE000-memory.dmp

Filesize
16.6MB

Download
memory/2520-67-0x0000000001E60000-0x0000000002EEE000-memory.dmp

Filesize
16.6MB

Download
memory/2520-69-0x0000000001E60000-0x0000000002EEE000-memory.dmp

Filesize
16.6MB

Download
memory/2520-70-0x0000000001E60000-0x0000000002EEE000-memory.dmp

Filesize
16.6MB

Download
memory/2520-72-0x0000000001E60000-0x0000000002EEE000-memory.dmp

Filesize
16.6MB

Download
memory/2520-73-0x0000000001E60000-0x0000000002EEE000-memory.dmp

Filesize
16.6MB

Download
memory/2520-88-0x0000000003050000-0x0000000003051000-memory.dmp

Filesize
4KB

Download
memory/2520-92-0x0000000003040000-0x0000000003042000-memory.dmp

Filesize
8KB

Download
memory/2520-123-0x0000000003040000-0x0000000003042000-memory.dmp

Filesize
8KB

Download
memory/2520-104-0x0000000001E60000-0x0000000002EEE000-memory.dmp

Filesize
16.6MB

Download
memory/2520-19-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2760-101-0x00000000002E0000-0x00000000002E2000-memory.dmp

Filesize
8KB

Download
memory/2760-95-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2760-103-0x00000000002E0000-0x00000000002E2000-memory.dmp

Filesize
8KB

Download
memory/2760-63-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2760-203-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2908-99-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2908-102-0x0000000000250000-0x0000000000252000-memory.dmp

Filesize
8KB

Download
memory/2908-128-0x0000000000250000-0x0000000000252000-memory.dmp

Filesize
8KB

Download
memory/2908-202-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2908-62-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download