Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 17:31
Static task
static1
Behavioral task
behavioral1
Sample
0fdcece65289dc442a99b875eeb9c498_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
0fdcece65289dc442a99b875eeb9c498_JaffaCakes118.dll
-
Size
180KB
-
MD5
0fdcece65289dc442a99b875eeb9c498
-
SHA1
49ae8323ccb9fbd92fce5c09e058b86087e51c8c
-
SHA256
e7db1e2ba7dcc5c0e8ceb11c888ec361f0595418d82b792dcdd5844c7d13759f
-
SHA512
07607f318551990737194914510bab366973a16ed685a7fda93fb2a482efc13bf22bb2e6187578a6bb7f30f45a0551ee38468316f0e7dd538a1e19dcdb62fee9
-
SSDEEP
3072:1P2PxxtVYTRMClk3oq2L9vNTDQm/iAeQZZer:NyiRq4xZvNTOAhZZo
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" cyenjhkm.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" cyenjhkm.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" cyenjhkm.exe -
Modifies security service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" cyenjhkm.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" cyenjhkm.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Start = "4" cyenjhkm.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cyenjhkm.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" cyenjhkm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" cyenjhkm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" cyenjhkm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" cyenjhkm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" cyenjhkm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" cyenjhkm.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation t32KY8d5k Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation cyenjhkm.exe -
Executes dropped EXE 6 IoCs
pid Process 3168 t32KY8d5k 4132 t32KY8d5k 1272 cyenjhkm.exe 4800 cyenjhkm.exe 3496 cyenjhkm.exe 4736 cyenjhkm.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" cyenjhkm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" cyenjhkm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" cyenjhkm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" cyenjhkm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" cyenjhkm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" cyenjhkm.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cyenjhkm.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3168 set thread context of 4132 3168 t32KY8d5k 84 PID 1272 set thread context of 4800 1272 cyenjhkm.exe 108 PID 3496 set thread context of 4736 3496 cyenjhkm.exe 112 -
resource yara_rule behavioral2/memory/4132-11-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4132-14-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4132-16-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4132-22-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4132-27-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4132-28-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4132-33-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4132-34-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4800-73-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4736-87-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 1276 1796 WerFault.exe 85 2588 4504 WerFault.exe 99 -
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language t32KY8d5k Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cyenjhkm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cyenjhkm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cyenjhkm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language t32KY8d5k Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "516412766" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135162" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31135162" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "716100199" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4A572369-81AD-11EF-B1C5-4E01FFCF908D} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135162" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31135162" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135162" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "516412766" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "518444056" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "518444056" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434741649" IEXPLORE.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeSecurityPrivilege 4132 t32KY8d5k Token: SeDebugPrivilege 4132 t32KY8d5k Token: SeSecurityPrivilege 4800 cyenjhkm.exe Token: SeSecurityPrivilege 4736 cyenjhkm.exe Token: SeLoadDriverPrivilege 4736 cyenjhkm.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1536 IEXPLORE.EXE 1536 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 3168 t32KY8d5k 1536 IEXPLORE.EXE 1536 IEXPLORE.EXE 2308 IEXPLORE.EXE 2308 IEXPLORE.EXE 2308 IEXPLORE.EXE 2308 IEXPLORE.EXE 1536 IEXPLORE.EXE 1536 IEXPLORE.EXE 512 IEXPLORE.EXE 512 IEXPLORE.EXE 512 IEXPLORE.EXE 512 IEXPLORE.EXE 1272 cyenjhkm.exe 3496 cyenjhkm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 968 wrote to memory of 1576 968 rundll32.exe 82 PID 968 wrote to memory of 1576 968 rundll32.exe 82 PID 968 wrote to memory of 1576 968 rundll32.exe 82 PID 1576 wrote to memory of 3168 1576 rundll32.exe 83 PID 1576 wrote to memory of 3168 1576 rundll32.exe 83 PID 1576 wrote to memory of 3168 1576 rundll32.exe 83 PID 3168 wrote to memory of 4132 3168 t32KY8d5k 84 PID 3168 wrote to memory of 4132 3168 t32KY8d5k 84 PID 3168 wrote to memory of 4132 3168 t32KY8d5k 84 PID 3168 wrote to memory of 4132 3168 t32KY8d5k 84 PID 3168 wrote to memory of 4132 3168 t32KY8d5k 84 PID 3168 wrote to memory of 4132 3168 t32KY8d5k 84 PID 3168 wrote to memory of 4132 3168 t32KY8d5k 84 PID 4132 wrote to memory of 1796 4132 t32KY8d5k 85 PID 4132 wrote to memory of 1796 4132 t32KY8d5k 85 PID 4132 wrote to memory of 1796 4132 t32KY8d5k 85 PID 4132 wrote to memory of 1796 4132 t32KY8d5k 85 PID 4132 wrote to memory of 1796 4132 t32KY8d5k 85 PID 4132 wrote to memory of 1796 4132 t32KY8d5k 85 PID 4132 wrote to memory of 1796 4132 t32KY8d5k 85 PID 4132 wrote to memory of 1796 4132 t32KY8d5k 85 PID 4132 wrote to memory of 1796 4132 t32KY8d5k 85 PID 4132 wrote to memory of 1796 4132 t32KY8d5k 85 PID 4132 wrote to memory of 4404 4132 t32KY8d5k 93 PID 4132 wrote to memory of 4404 4132 t32KY8d5k 93 PID 4132 wrote to memory of 4404 4132 t32KY8d5k 93 PID 4404 wrote to memory of 1536 4404 iexplore.exe 94 PID 4404 wrote to memory of 1536 4404 iexplore.exe 94 PID 1536 wrote to memory of 2308 1536 IEXPLORE.EXE 95 PID 1536 wrote to memory of 2308 1536 IEXPLORE.EXE 95 PID 1536 wrote to memory of 2308 1536 IEXPLORE.EXE 95 PID 4132 wrote to memory of 4504 4132 t32KY8d5k 99 PID 4132 wrote to memory of 4504 4132 t32KY8d5k 99 PID 4132 wrote to memory of 4504 4132 t32KY8d5k 99 PID 4132 wrote to memory of 4504 4132 t32KY8d5k 99 PID 4132 wrote to memory of 4504 4132 t32KY8d5k 99 PID 4132 wrote to memory of 4504 4132 t32KY8d5k 99 PID 4132 wrote to memory of 4504 4132 t32KY8d5k 99 PID 4132 wrote to memory of 4504 4132 t32KY8d5k 99 PID 4132 wrote to memory of 4504 4132 t32KY8d5k 99 PID 4132 wrote to memory of 4504 4132 t32KY8d5k 99 PID 4132 wrote to memory of 4780 4132 t32KY8d5k 103 PID 4132 wrote to memory of 4780 4132 t32KY8d5k 103 PID 4132 wrote to memory of 4780 4132 t32KY8d5k 103 PID 4780 wrote to memory of 3804 4780 iexplore.exe 104 PID 4780 wrote to memory of 3804 4780 iexplore.exe 104 PID 1536 wrote to memory of 512 1536 IEXPLORE.EXE 105 PID 1536 wrote to memory of 512 1536 IEXPLORE.EXE 105 PID 1536 wrote to memory of 512 1536 IEXPLORE.EXE 105 PID 4132 wrote to memory of 1272 4132 t32KY8d5k 107 PID 4132 wrote to memory of 1272 4132 t32KY8d5k 107 PID 4132 wrote to memory of 1272 4132 t32KY8d5k 107 PID 1272 wrote to memory of 4800 1272 cyenjhkm.exe 108 PID 1272 wrote to memory of 4800 1272 cyenjhkm.exe 108 PID 1272 wrote to memory of 4800 1272 cyenjhkm.exe 108 PID 1272 wrote to memory of 4800 1272 cyenjhkm.exe 108 PID 1272 wrote to memory of 4800 1272 cyenjhkm.exe 108 PID 1272 wrote to memory of 4800 1272 cyenjhkm.exe 108 PID 1272 wrote to memory of 4800 1272 cyenjhkm.exe 108 PID 4800 wrote to memory of 3000 4800 cyenjhkm.exe 109 PID 4800 wrote to memory of 3000 4800 cyenjhkm.exe 109 PID 4800 wrote to memory of 3000 4800 cyenjhkm.exe 109 PID 3000 wrote to memory of 3496 3000 cmd.exe 111 PID 3000 wrote to memory of 3496 3000 cmd.exe 111 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cyenjhkm.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0fdcece65289dc442a99b875eeb9c498_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0fdcece65289dc442a99b875eeb9c498_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\t32KY8d5k"t32KY8d5k"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\t32KY8d5k"t32KY8d5k"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:1796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 2046⤵
- Program crash
PID:1276
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1536 CREDAT:17410 /prefetch:27⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2308
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1536 CREDAT:17416 /prefetch:27⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:512
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:4504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 2046⤵
- Program crash
PID:2588
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"6⤵
- Modifies Internet Explorer settings
PID:3804
-
-
-
C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe"C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe" elevate5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe"C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe" elevate6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe"" admin7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe"C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe" admin8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe"C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe" admin9⤵
- Modifies firewall policy service
- Modifies security service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4736
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1796 -ip 17961⤵PID:2620
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4504 -ip 45041⤵PID:2976
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD56de4427d02d49cee2c46a8fead1fafa8
SHA1bee49bf0e4452ca72442face8e655bf4a8c3af17
SHA25646d5cd7ff558e5c788807eb674587359c6a660cef091eb420676977e49833d53
SHA512c80311bb92f9f49de96d06e9a76a3ef0310365999f00f401fd003d438b66744a88f093b5887e1723c6b8179798697ec24c4b2bda489323337f6cec6d28ef6434
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5b85b3b492f6b920450a0e4af9b8abf54
SHA119cb7b9396882cc7f7571f7d9015d7cef122e43e
SHA25616dd95fe5aa6b58597d7744013980297618e69fe0073698614ce45c871d3ec42
SHA512fc3693fb9d9319b99bd1472d4c05c103d6e9f7835c4456450c8d270b84245fa02b0744616f83126a79507963817d1d6411abca8a62e092d8dcf6151c6e3f0b79
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
99KB
MD533ace2a98e6aa56dbd6f1ae58a9af9ae
SHA167de6edab77318d997f002c9884dd08069612570
SHA2568bf10012bf59dbc3f6509bbf1dc12490779fc5962aa37fcebbcc434e2612371c
SHA512ea77d71297f7ef842f0c1c7b6f8eb53f8d6d3f223d4f5d2bb4214102601a1197f038a1339d5245ed87671947e90910b78cbe7081d05c0e5cedd55b0726e362f5