Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 13:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
de53d0db460bf21170e8ec1adc3677f8_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
de53d0db460bf21170e8ec1adc3677f8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
20 signatures
150 seconds
General
-
Target
de53d0db460bf21170e8ec1adc3677f8_JaffaCakes118.exe
-
Size
401KB
-
MD5
de53d0db460bf21170e8ec1adc3677f8
-
SHA1
ae3408fec76913e362b929a5dbacaaa1f60ef488
-
SHA256
ca7d3c87ec54e6defa7e5ad438bc800c56c2fb8366f0de6797ab88b2c374bbff
-
SHA512
e7d943a3d0913a6e026aff6ead78469f2ed63cbd8876d919fd4588a8f7fe5ec57c5871c7bca647adee37837947bc22a854b475befc3863266d570c4fac1c5563
-
SSDEEP
12288:duDu1BX3Yl9kopZPcBV3mqTXGO67L2GxfdfT:du4hoDkopZPsV3msXGO637xp
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List document.htm .exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile document.htm .exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications document.htm .exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\system32\HPWuSchdq.exe = "C:\\Windows\\system32\\HPWuSchdq.exe:*:Enabled:Explorer" document.htm .exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" document.htm .exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1" document.htm .exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation hp-358.exe -
Executes dropped EXE 7 IoCs
pid Process 2844 setup.exe 4180 document.htm .exe 3156 document.htm .exe 1380 hp-358.exe 1964 hp-358.exe 2080 lsass.exe 3656 lsass.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1" document.htm .exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" de53d0db460bf21170e8ec1adc3677f8_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HP Software Updater v1.2 = "C:\\Windows\\system32\\HPWuSchdq.exe" document.htm .exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RTHDBPL = "C:\\Windows\\SysWOW64\\hp-358.exe" hp-358.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RTHDBPL = "C:\\Users\\Admin\\AppData\\Roaming\\SystemProc\\lsass.exe" lsass.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" document.htm .exe -
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: document.htm .exe File opened (read-only) \??\H: document.htm .exe File opened (read-only) \??\J: document.htm .exe File opened (read-only) \??\N: document.htm .exe File opened (read-only) \??\U: document.htm .exe File opened (read-only) \??\V: document.htm .exe File opened (read-only) \??\X: document.htm .exe File opened (read-only) \??\Q: document.htm .exe File opened (read-only) \??\S: document.htm .exe File opened (read-only) \??\T: document.htm .exe File opened (read-only) \??\W: document.htm .exe File opened (read-only) \??\L: document.htm .exe File opened (read-only) \??\O: document.htm .exe File opened (read-only) \??\P: document.htm .exe File opened (read-only) \??\E: document.htm .exe File opened (read-only) \??\I: document.htm .exe File opened (read-only) \??\K: document.htm .exe File opened (read-only) \??\M: document.htm .exe File opened (read-only) \??\R: document.htm .exe File opened (read-only) \??\Y: document.htm .exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\HPWuSchdq.exe document.htm .exe File created C:\Windows\SysWOW64\HPWuSchdq.exe document.htm .exe File created C:\Windows\SysWOW64\hp-358.exe document.htm .exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4180 set thread context of 3156 4180 document.htm .exe 90 PID 1380 set thread context of 1964 1380 hp-358.exe 99 PID 2080 set thread context of 3656 2080 lsass.exe 101 -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\program files\limewire\shared\Grand Theft Auto IV (Offline Activation).exe document.htm .exe File created C:\program files\limewire\shared\PDF to Word Converter 3.0.exe document.htm .exe File created C:\program files\tesla\files\Windows 2008 Enterprise Server VMWare Virtual Machine.exe document.htm .exe File created C:\program files\tesla\files\Nero 9 9.2.6.0 keygen.exe document.htm .exe File created C:\program files\winmx\shared\Super Utilities Pro 2009 11.0.exe document.htm .exe File created C:\program files\morpheus\my shared folder\Norton Internet Security 2010 crack.exe document.htm .exe File created C:\program files\emule\incoming\Mp3 Splitter and Joiner Pro v3.48.exe document.htm .exe File created C:\program files\morpheus\my shared folder\Kaspersky AntiVirus 2010 crack.exe document.htm .exe File created C:\program files\winmx\shared\McAfee Total Protection 2010.exe document.htm .exe File created C:\program files\winmx\shared\Ad-aware 2010.exe document.htm .exe File created C:\program files\grokster\my grokster\Ashampoo Snap 3.02.exe document.htm .exe File created C:\program files\limewire\shared\Starcraft2 Patch v0.2.exe document.htm .exe File created C:\program files\tesla\files\Norton Internet Security 2010 crack.exe document.htm .exe File created C:\program files\winmx\shared\Myspace theme collection.exe document.htm .exe File created C:\program files\emule\incoming\Microsoft.Windows 7 ULTIMATE FINAL activator+keygen x86.exe document.htm .exe File created C:\program files\grokster\my grokster\Starcraft2 Patch v0.2.exe document.htm .exe File created C:\program files\winmx\shared\BitDefender AntiVirus 2010 Keygen.exe document.htm .exe File created C:\program files\grokster\my grokster\Anti-Porn v13.5.12.29.exe document.htm .exe File created C:\program files\emule\incoming\Absolute Video Converter 6.2.exe document.htm .exe File created C:\program files\emule\incoming\Windows2008 keygen and activator.exe document.htm .exe File created C:\program files\morpheus\my shared folder\Super Utilities Pro 2009 11.0.exe document.htm .exe File created C:\program files\winmx\shared\VmWare keygen.exe document.htm .exe File created C:\program files\grokster\my grokster\Super Utilities Pro 2009 11.0.exe document.htm .exe File created C:\program files\emule\incoming\Divx Pro 7 + keymaker.exe document.htm .exe File created C:\program files\icq\shared folder\RapidShare Killer AIO 2010.exe document.htm .exe File created C:\program files\grokster\my grokster\WinRAR v3.x keygen RaZoR.exe document.htm .exe File created C:\program files\emule\incoming\DVD Tools Nero 10.5.6.0.exe document.htm .exe File created C:\program files\tesla\files\PDF-XChange Pro.exe document.htm .exe File created C:\program files\winmx\shared\Power ISO v4.2 + keygen axxo.exe document.htm .exe File created C:\program files\icq\shared folder\Sophos antivirus updater bypass.exe document.htm .exe File created C:\program files\emule\incoming\Motorola, nokia, ericsson mobil phone tools.exe document.htm .exe File created C:\program files\limewire\shared\Motorola, nokia, ericsson mobil phone tools.exe document.htm .exe File created C:\program files\limewire\shared\Power ISO v4.2 + keygen axxo.exe document.htm .exe File created C:\program files\grokster\my grokster\Grand Theft Auto IV (Offline Activation).exe document.htm .exe File created C:\program files\morpheus\my shared folder\Windows 7 Ultimate keygen.exe document.htm .exe File created C:\program files\emule\incoming\BitDefender AntiVirus 2010 Keygen.exe document.htm .exe File created C:\program files\icq\shared folder\Starcraft2 Patch v0.2.exe document.htm .exe File created C:\program files\grokster\my grokster\Myspace theme collection.exe document.htm .exe File created C:\program files\grokster\my grokster\Power ISO v4.2 + keygen axxo.exe document.htm .exe File created C:\program files\morpheus\my shared folder\Starcraft2 Crack.exe document.htm .exe File created C:\program files\limewire\shared\Adobe Acrobat Reader keygen.exe document.htm .exe File created C:\program files\icq\shared folder\Ashampoo Snap 3.02.exe document.htm .exe File created C:\program files\tesla\files\BitDefender AntiVirus 2010 Keygen.exe document.htm .exe File created C:\program files\morpheus\my shared folder\Ad-aware 2010.exe document.htm .exe File created C:\program files\emule\incoming\Kaspersky Internet Security 2010 keygen.exe document.htm .exe File created C:\program files\morpheus\my shared folder\Daemon Tools Pro 4.11.exe document.htm .exe File created C:\program files\limewire\shared\Total Commander7 license+keygen.exe document.htm .exe File created C:\program files\tesla\files\Alcohol 120 v1.9.7.exe document.htm .exe File created C:\program files\winmx\shared\Starcraft2 Patch v0.2.exe document.htm .exe File created C:\program files\emule\incoming\YouTubeGet 5.4.exe document.htm .exe File created C:\program files\icq\shared folder\Winamp.Pro.v7.33.PowerPack.Portable+installer.exe document.htm .exe File created C:\program files\emule\incoming\VmWare keygen.exe document.htm .exe File created C:\program files\morpheus\my shared folder\Blaze DVD Player Pro v6.52.exe document.htm .exe File created C:\program files\morpheus\my shared folder\Starcraft2 keys.txt.exe document.htm .exe File created C:\program files\limewire\shared\Mp3 Splitter and Joiner Pro v3.48.exe document.htm .exe File created C:\program files\limewire\shared\Myspace theme collection.exe document.htm .exe File created C:\program files\winmx\shared\Alcohol 120 v1.9.7.exe document.htm .exe File created C:\program files\icq\shared folder\Adobe Illustrator CS4 crack.exe document.htm .exe File created C:\program files\limewire\shared\Avast 4.8 Professional.exe document.htm .exe File created C:\program files\tesla\files\PDF password remover (works with all acrobat reader).exe document.htm .exe File created C:\program files\limewire\shared\Anti-Porn v13.5.12.29.exe document.htm .exe File created C:\program files\grokster\my grokster\Winamp.Pro.v7.33.PowerPack.Portable+installer.exe document.htm .exe File created C:\program files\emule\incoming\Avast 4.8 Professional.exe document.htm .exe File created C:\program files\limewire\shared\Image Size Reducer Pro v1.0.1.exe document.htm .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language document.htm .exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hp-358.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hp-358.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de53d0db460bf21170e8ec1adc3677f8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language document.htm .exe -
Modifies registry class 22 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment dfsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "R47Y3WPZ5P63K9Q2594EQDJB" dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Software\Microsoft\Windows\CurrentVersion dfsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "W5GENA9C2K4CZ02VP8LA5GOV" dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Software\Microsoft\Windows dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide dfsvc.exe Key deleted \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0 dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0 dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Software\Microsoft dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots dfsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "5N8BZ67VZT69EAEVM7T3POQN" dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Software dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies dfsvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ hp-358.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe 3156 document.htm .exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3004 dfsvc.exe Token: SeDebugPrivilege 3656 lsass.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4180 document.htm .exe 1380 hp-358.exe 2080 lsass.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 3404 wrote to memory of 2844 3404 de53d0db460bf21170e8ec1adc3677f8_JaffaCakes118.exe 83 PID 3404 wrote to memory of 2844 3404 de53d0db460bf21170e8ec1adc3677f8_JaffaCakes118.exe 83 PID 3404 wrote to memory of 2844 3404 de53d0db460bf21170e8ec1adc3677f8_JaffaCakes118.exe 83 PID 2844 wrote to memory of 3004 2844 setup.exe 85 PID 2844 wrote to memory of 3004 2844 setup.exe 85 PID 3404 wrote to memory of 4180 3404 de53d0db460bf21170e8ec1adc3677f8_JaffaCakes118.exe 88 PID 3404 wrote to memory of 4180 3404 de53d0db460bf21170e8ec1adc3677f8_JaffaCakes118.exe 88 PID 3404 wrote to memory of 4180 3404 de53d0db460bf21170e8ec1adc3677f8_JaffaCakes118.exe 88 PID 4180 wrote to memory of 3156 4180 document.htm .exe 90 PID 4180 wrote to memory of 3156 4180 document.htm .exe 90 PID 4180 wrote to memory of 3156 4180 document.htm .exe 90 PID 4180 wrote to memory of 3156 4180 document.htm .exe 90 PID 4180 wrote to memory of 3156 4180 document.htm .exe 90 PID 4180 wrote to memory of 3156 4180 document.htm .exe 90 PID 4180 wrote to memory of 3156 4180 document.htm .exe 90 PID 4180 wrote to memory of 3156 4180 document.htm .exe 90 PID 4180 wrote to memory of 3156 4180 document.htm .exe 90 PID 4180 wrote to memory of 3156 4180 document.htm .exe 90 PID 4180 wrote to memory of 3156 4180 document.htm .exe 90 PID 3156 wrote to memory of 1380 3156 document.htm .exe 96 PID 3156 wrote to memory of 1380 3156 document.htm .exe 96 PID 3156 wrote to memory of 1380 3156 document.htm .exe 96 PID 1380 wrote to memory of 1964 1380 hp-358.exe 99 PID 1380 wrote to memory of 1964 1380 hp-358.exe 99 PID 1380 wrote to memory of 1964 1380 hp-358.exe 99 PID 1380 wrote to memory of 1964 1380 hp-358.exe 99 PID 1380 wrote to memory of 1964 1380 hp-358.exe 99 PID 1380 wrote to memory of 1964 1380 hp-358.exe 99 PID 1380 wrote to memory of 1964 1380 hp-358.exe 99 PID 1380 wrote to memory of 1964 1380 hp-358.exe 99 PID 1380 wrote to memory of 1964 1380 hp-358.exe 99 PID 1964 wrote to memory of 2080 1964 hp-358.exe 100 PID 1964 wrote to memory of 2080 1964 hp-358.exe 100 PID 1964 wrote to memory of 2080 1964 hp-358.exe 100 PID 2080 wrote to memory of 3656 2080 lsass.exe 101 PID 2080 wrote to memory of 3656 2080 lsass.exe 101 PID 2080 wrote to memory of 3656 2080 lsass.exe 101 PID 2080 wrote to memory of 3656 2080 lsass.exe 101 PID 2080 wrote to memory of 3656 2080 lsass.exe 101 PID 2080 wrote to memory of 3656 2080 lsass.exe 101 PID 2080 wrote to memory of 3656 2080 lsass.exe 101 PID 2080 wrote to memory of 3656 2080 lsass.exe 101 PID 2080 wrote to memory of 3656 2080 lsass.exe 101 PID 3656 wrote to memory of 3424 3656 lsass.exe 56 PID 3656 wrote to memory of 3424 3656 lsass.exe 56 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" document.htm .exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\de53d0db460bf21170e8ec1adc3677f8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\de53d0db460bf21170e8ec1adc3677f8_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"4⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\document.htm .exe"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\document.htm .exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\document.htm .exe"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\document.htm .exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3156 -
C:\Windows\SysWOW64\hp-358.exe"C:\Windows\system32\hp-358.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\hp-358.exe"C:\Windows\SysWOW64\hp-358.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Roaming\SystemProc\lsass.exe"C:\Users\Admin\AppData\Roaming\SystemProc\lsass.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Roaming\SystemProc\lsass.exe"C:\Users\Admin\AppData\Roaming\SystemProc\lsass.exe"8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3656
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome.manifest
Filesize151B
MD52fa89bb5ec500c62cc40d5a46a6a8cd3
SHA1ab2c5fed92fb203ff7ca8b3353a9e086377afebd
SHA256bbcea744c5edfaf49d50a046051338c2fc75fd12247ae5997b9967fe3f454543
SHA51241299af72f3f78bd1d82423e36272bcde20441254402b5776537de2d5061d125f80f65bbee07bf5d1609003a784f85caf0e4cadbf91782737ea4aa58a0c51e59
-
C:\Program Files (x86)\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content\timer.xul
Filesize1KB
MD58db91883ee3533d23dee7f960f35a86b
SHA17711e7240614ce19fff8efad065ec4945954a64c
SHA256b6dce1cd85ef55a6887abd3cccd6b644e8ca9b877640feb75d072b9c2f9f46a3
SHA5127c5f5e3d363559a8099a9f94fb80f85272a53f7c92413932b2006f6db1c6b47f58e5767a8ef11bf3b8b370ef8a7d149f3feb95d3c4ef67787bc5466a91044373
-
C:\Program Files (x86)\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf
Filesize765B
MD578ad4864983e69fdc09b56c0cabf8e70
SHA1dbb7c8129472f7d96b069f8a2a9bd117cbf9c5b6
SHA25630e1fc099fdd3eab43a3e390ef120e143bce0befb0dcc3ae05f52590e06ec26a
SHA51210e6708f51f81ac59bb01043acd11ad74a1bb9d52074d32562edfc60a778f3499033515a524d413f1205e2e133e3390cbed34bde6386766fdf7d4eab0dd018da
-
Filesize
292KB
MD561bdeffc0946da743e90dd871abb44b1
SHA1ab476b562b55e86769861d01a291e34d65cbefe0
SHA2561f9a64623275ab45796d8862c6a640cd4eca37108d0d855d38a697b8561d0041
SHA512d3669d4fef76311bbca4cae8d8327b679ac2986f5558d0cc2d560962af46072a025dbfdd21d0057eee10a14c6adba41271df8f84f8da924cccf8129a08780698
-
Filesize
666KB
MD552390ffcd8dac59cbe89accd5513d7cc
SHA129acf3219826070c4d667c2d7d4058335d77b4c8
SHA2563cf416cee08191e2f030df18804b450137f427fd752ddfcf875ba77e0d746be1
SHA512f740e51dab7eeb1cec4ccdbf829b13e0d33f63126ce248ddd5e7fddaee6a9ee0a96db877f892ba2e83b4ecd22db516ce7fd425a1c6a8dc8a25f46a9e915a8529
-
Filesize
160KB
MD528114caa6f505680d673577aedc6834d
SHA1d4ac67e1bfa696bad04d950ea72adfae7a90c5e5
SHA256764d4e44f0c2c11fa6e9df043bd3201bc57ed3da4cce7cc2d8dd366ed67fe402
SHA51275a2569e431f7536137246315444e0e4c24c53ff8a3376b3027168ff024b98f93a618a7007c343a2de90715a90c6bc0d5e9bfa2a6129a8f684cea77e6c253a42