Analysis
-
max time kernel
122s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 07:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
17 signatures
150 seconds
General
-
Target
ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe
-
Size
100KB
-
MD5
ead0ff047e5a4f6360c358b7f88cabc5
-
SHA1
8f34231df3ad2d8b908aaf0c669c21e38ea1986e
-
SHA256
3623ca3e69a6d3b4e09eade1d37e0d6f58ee1f3845564952af92ad9a259abad4
-
SHA512
7563408520d0ecab51aeaefe720868df542e1d291c5d199d7b0db8a0b07b1fca0e89e97109490b295d45b34ff8ce051d69b54e2f86e4d2c2989b5881ecb8b306
-
SSDEEP
1536:ATW/52OPrNYrO9OpZkc8/qOVGyKq2rxYf8nHwRNNWqXGu9yK5FMqDr8c:5/Q0NYYcZf8/lKq2rxjnHr6yKrvx
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2904-1-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-6-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-9-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-3-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-10-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-8-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-7-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-5-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-4-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-24-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-25-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-26-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-27-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-28-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-30-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-31-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-32-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-34-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-37-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-54-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-56-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-58-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-59-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-61-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-62-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-65-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-66-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2904-67-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened (read-only) \??\M: ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened (read-only) \??\O: ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened (read-only) \??\S: ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened (read-only) \??\Y: ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened (read-only) \??\G: ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened (read-only) \??\H: ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened (read-only) \??\I: ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened (read-only) \??\Z: ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened (read-only) \??\K: ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened (read-only) \??\N: ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened (read-only) \??\W: ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened (read-only) \??\Q: ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened (read-only) \??\R: ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened (read-only) \??\E: ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened (read-only) \??\L: ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened (read-only) \??\P: ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened (read-only) \??\X: ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened (read-only) \??\T: ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened (read-only) \??\U: ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened (read-only) \??\V: ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened for modification F:\autorun.inf ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Token: SeDebugPrivilege 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Token: SeDebugPrivilege 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Token: SeDebugPrivilege 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Token: SeDebugPrivilege 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Token: SeDebugPrivilege 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Token: SeDebugPrivilege 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Token: SeDebugPrivilege 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Token: SeDebugPrivilege 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Token: SeDebugPrivilege 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Token: SeDebugPrivilege 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Token: SeDebugPrivilege 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Token: SeDebugPrivilege 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Token: SeDebugPrivilege 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Token: SeDebugPrivilege 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Token: SeDebugPrivilege 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Token: SeDebugPrivilege 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Token: SeDebugPrivilege 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Token: SeDebugPrivilege 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Token: SeDebugPrivilege 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe Token: SeDebugPrivilege 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2904 wrote to memory of 1120 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 18 PID 2904 wrote to memory of 1212 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 19 PID 2904 wrote to memory of 1256 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 20 PID 2904 wrote to memory of 1612 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 22 PID 2904 wrote to memory of 1120 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 18 PID 2904 wrote to memory of 1212 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 19 PID 2904 wrote to memory of 1256 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 20 PID 2904 wrote to memory of 1612 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 22 PID 2904 wrote to memory of 1120 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 18 PID 2904 wrote to memory of 1212 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 19 PID 2904 wrote to memory of 1256 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 20 PID 2904 wrote to memory of 1612 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 22 PID 2904 wrote to memory of 1120 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 18 PID 2904 wrote to memory of 1212 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 19 PID 2904 wrote to memory of 1256 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 20 PID 2904 wrote to memory of 1612 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 22 PID 2904 wrote to memory of 1120 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 18 PID 2904 wrote to memory of 1212 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 19 PID 2904 wrote to memory of 1256 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 20 PID 2904 wrote to memory of 1612 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 22 PID 2904 wrote to memory of 1120 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 18 PID 2904 wrote to memory of 1212 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 19 PID 2904 wrote to memory of 1256 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 20 PID 2904 wrote to memory of 1612 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 22 PID 2904 wrote to memory of 1120 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 18 PID 2904 wrote to memory of 1212 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 19 PID 2904 wrote to memory of 1256 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 20 PID 2904 wrote to memory of 1612 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 22 PID 2904 wrote to memory of 1120 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 18 PID 2904 wrote to memory of 1212 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 19 PID 2904 wrote to memory of 1256 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 20 PID 2904 wrote to memory of 1612 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 22 PID 2904 wrote to memory of 1120 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 18 PID 2904 wrote to memory of 1212 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 19 PID 2904 wrote to memory of 1256 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 20 PID 2904 wrote to memory of 1612 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 22 PID 2904 wrote to memory of 1120 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 18 PID 2904 wrote to memory of 1212 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 19 PID 2904 wrote to memory of 1256 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 20 PID 2904 wrote to memory of 1612 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 22 PID 2904 wrote to memory of 1120 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 18 PID 2904 wrote to memory of 1212 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 19 PID 2904 wrote to memory of 1256 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 20 PID 2904 wrote to memory of 1612 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 22 PID 2904 wrote to memory of 1120 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 18 PID 2904 wrote to memory of 1212 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 19 PID 2904 wrote to memory of 1256 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 20 PID 2904 wrote to memory of 1612 2904 ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe 22 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1120
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1212
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ead0ff047e5a4f6360c358b7f88cabc5_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2904
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1612
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD54120649c948d8f2e4b6cf3887fd55bef
SHA16ba726bbef352e4bab447c678cc795786465f3c4
SHA25671b723a9d7d01923bcb17e82abcd1bf6b6538958d9cbf51ae6fc00900a6a6dce
SHA512049017604efc3cffd54c652212ddfcd1aeade5d09291ef0b62ac1c89b27d0b394597e50508a6d97e6b4afe4fe72c2aa0910fdfdb81fb8b50a874a308d17e2b9e