Analysis
- max time kernel
26s - max time network
117s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
12/10/2024, 02:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
381300528c93362f563a8d39a026b40a_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
20 signatures
150 seconds
General
- Target 381300528c93362f563a8d39a026b40a_JaffaCakes118.exe
- Size 268KB
- Sample241012-c7vctsycla
- SHA256 81875a4d97d27f19fd22123226e16d65c16644dc138701ab1e4770dd6eab6479
- MD5 381300528c93362f563a8d39a026b40a
- SHA1 2dd8381fa66b715f705fb295c0d6d1aaee7f3b80
- SHA512 66438e50e3329d8ebdca1855c3cc0ab2e1e54d276b59e52d93119aae252f794350fdf557bde0d4317946b81591e0d2c39bd5e4ba8a78ebf4c0f9d5d298d02691
- SSDEEP 6144:nQUgZLVJcbg+SWrzM21TnBRB8upcRT7H8SU:nROxX6zM2nyV7cSU
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" IEXPLORE.EXE Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" IEXPLORE.EXE Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" IEXPLORE.EXE Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" IEXPLORE.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" IEXPLORE.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" IEXPLORE.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" IEXPLORE.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" IEXPLORE.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" IEXPLORE.EXE - Deletes itself 1 IoCs
pid Process 3500 IEXPLORE.EXE - Executes dropped EXE 2 IoCs
pid Process 1960 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe 344 WaterMark.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WaterMark.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe - Enumerates connected drives 3 TTPs 9 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: WaterMark.exe File opened (read-only) \??\J: WaterMark.exe File opened (read-only) \??\L: WaterMark.exe File opened (read-only) \??\M: WaterMark.exe File opened (read-only) \??\E: IEXPLORE.EXE File opened (read-only) \??\E: WaterMark.exe File opened (read-only) \??\H: WaterMark.exe File opened (read-only) \??\G: WaterMark.exe File opened (read-only) \??\K: WaterMark.exe -
resource yara_rule behavioral2/memory/1960-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1960-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1960-9-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1960-23-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1960-32-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1960-21-0x00000000031A0000-0x000000000422E000-memory.dmp upx behavioral2/memory/1960-20-0x00000000031A0000-0x000000000422E000-memory.dmp upx behavioral2/memory/1960-19-0x00000000031A0000-0x000000000422E000-memory.dmp upx behavioral2/memory/1960-26-0x00000000031A0000-0x000000000422E000-memory.dmp upx behavioral2/memory/1960-18-0x00000000031A0000-0x000000000422E000-memory.dmp upx behavioral2/memory/1960-22-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1960-7-0x00000000031A0000-0x000000000422E000-memory.dmp upx behavioral2/memory/1960-17-0x00000000031A0000-0x000000000422E000-memory.dmp upx behavioral2/memory/1960-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/344-37-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/344-40-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/344-62-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/344-52-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/344-65-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/344-64-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/344-50-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/344-45-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/344-39-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/344-66-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/344-67-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/344-69-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/344-68-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/344-70-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/344-74-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/344-73-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/344-78-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/344-79-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/344-81-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/344-83-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/344-84-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/344-90-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/344-91-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/344-115-0x0000000000400000-0x0000000000421000-memory.dmp upx - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px8C42.tmp 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 381300528c93362f563a8d39a026b40a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C8F08BD2-8843-11EF-91C3-CA65FB447F0B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C8E9653D-8843-11EF-91C3-CA65FB447F0B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 344 WaterMark.exe 344 WaterMark.exe 344 WaterMark.exe 344 WaterMark.exe 344 WaterMark.exe 344 WaterMark.exe 344 WaterMark.exe 344 WaterMark.exe 344 WaterMark.exe 344 WaterMark.exe 344 WaterMark.exe 344 WaterMark.exe 344 WaterMark.exe 344 WaterMark.exe 344 WaterMark.exe 344 WaterMark.exe 344 WaterMark.exe 344 WaterMark.exe 344 WaterMark.exe 344 WaterMark.exe 3500 IEXPLORE.EXE 3500 IEXPLORE.EXE - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe Token: SeDebugPrivilege 344 WaterMark.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2348 iexplore.exe 1744 iexplore.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2348 iexplore.exe 2348 iexplore.exe 1744 iexplore.exe 1744 iexplore.exe 3500 IEXPLORE.EXE 3500 IEXPLORE.EXE 2968 IEXPLORE.EXE 2968 IEXPLORE.EXE 2968 IEXPLORE.EXE 2968 IEXPLORE.EXE - Suspicious use of UnmapMainImage 2 IoCs
pid Process 1960 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe 344 WaterMark.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 968 wrote to memory of 1960 968 381300528c93362f563a8d39a026b40a_JaffaCakes118.exe 83 PID 968 wrote to memory of 1960 968 381300528c93362f563a8d39a026b40a_JaffaCakes118.exe 83 PID 968 wrote to memory of 1960 968 381300528c93362f563a8d39a026b40a_JaffaCakes118.exe 83 PID 1960 wrote to memory of 344 1960 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe 85 PID 1960 wrote to memory of 344 1960 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe 85 PID 1960 wrote to memory of 344 1960 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe 85 PID 344 wrote to memory of 780 344 WaterMark.exe 8 PID 344 wrote to memory of 784 344 WaterMark.exe 9 PID 344 wrote to memory of 60 344 WaterMark.exe 13 PID 344 wrote to memory of 2540 344 WaterMark.exe 42 PID 344 wrote to memory of 2548 344 WaterMark.exe 43 PID 344 wrote to memory of 2652 344 WaterMark.exe 46 PID 344 wrote to memory of 3544 344 WaterMark.exe 56 PID 344 wrote to memory of 3656 344 WaterMark.exe 57 PID 344 wrote to memory of 3840 344 WaterMark.exe 58 PID 344 wrote to memory of 3936 344 WaterMark.exe 59 PID 344 wrote to memory of 4000 344 WaterMark.exe 60 PID 344 wrote to memory of 1892 344 WaterMark.exe 87 PID 344 wrote to memory of 1892 344 WaterMark.exe 87 PID 344 wrote to memory of 1892 344 WaterMark.exe 87 PID 344 wrote to memory of 1892 344 WaterMark.exe 87 PID 344 wrote to memory of 1892 344 WaterMark.exe 87 PID 344 wrote to memory of 1892 344 WaterMark.exe 87 PID 344 wrote to memory of 1892 344 WaterMark.exe 87 PID 344 wrote to memory of 1892 344 WaterMark.exe 87 PID 344 wrote to memory of 1892 344 WaterMark.exe 87 PID 344 wrote to memory of 1064 344 WaterMark.exe 61 PID 344 wrote to memory of 4056 344 WaterMark.exe 62 PID 344 wrote to memory of 1604 344 WaterMark.exe 75 PID 344 wrote to memory of 2808 344 WaterMark.exe 76 PID 344 wrote to memory of 3676 344 WaterMark.exe 80 PID 344 wrote to memory of 4796 344 WaterMark.exe 81 PID 344 wrote to memory of 968 344 WaterMark.exe 82 PID 344 wrote to memory of 968 344 WaterMark.exe 82 PID 344 wrote to memory of 4740 344 WaterMark.exe 86 PID 344 wrote to memory of 2348 344 WaterMark.exe 89 PID 344 wrote to memory of 2348 344 WaterMark.exe 89 PID 344 wrote to memory of 1744 344 WaterMark.exe 90 PID 344 wrote to memory of 1744 344 WaterMark.exe 90 PID 1744 wrote to memory of 3500 1744 iexplore.exe 92 PID 1744 wrote to memory of 3500 1744 iexplore.exe 92 PID 1744 wrote to memory of 3500 1744 iexplore.exe 92 PID 2348 wrote to memory of 2968 2348 iexplore.exe 91 PID 2348 wrote to memory of 2968 2348 iexplore.exe 91 PID 2348 wrote to memory of 2968 2348 iexplore.exe 91 PID 344 wrote to memory of 780 344 WaterMark.exe 8 PID 344 wrote to memory of 784 344 WaterMark.exe 9 PID 344 wrote to memory of 60 344 WaterMark.exe 13 PID 344 wrote to memory of 2540 344 WaterMark.exe 42 PID 344 wrote to memory of 2548 344 WaterMark.exe 43 PID 344 wrote to memory of 2652 344 WaterMark.exe 46 PID 344 wrote to memory of 3544 344 WaterMark.exe 56 PID 344 wrote to memory of 3656 344 WaterMark.exe 57 PID 344 wrote to memory of 3840 344 WaterMark.exe 58 PID 344 wrote to memory of 3936 344 WaterMark.exe 59 PID 344 wrote to memory of 4000 344 WaterMark.exe 60 PID 344 wrote to memory of 1064 344 WaterMark.exe 61 PID 344 wrote to memory of 4056 344 WaterMark.exe 62 PID 344 wrote to memory of 1604 344 WaterMark.exe 75 PID 344 wrote to memory of 2808 344 WaterMark.exe 76 PID 344 wrote to memory of 3676 344 WaterMark.exe 80 PID 344 wrote to memory of 4740 344 WaterMark.exe 86 PID 344 wrote to memory of 2516 344 WaterMark.exe 88 PID 344 wrote to memory of 2348 344 WaterMark.exe 89 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WaterMark.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:60
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2548
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2652
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\381300528c93362f563a8d39a026b40a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\381300528c93362f563a8d39a026b40a_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exeC:\Users\Admin\AppData\Local\Temp\381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1960 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:344 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:1892
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2968
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:17410 /prefetch:26⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Deletes itself
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3500
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3656
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3840
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3936
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4000
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1064
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4056
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1604
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2808
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:3676
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4796
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4740
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2516
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2400
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:5036
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:3156
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C8E9653D-8843-11EF-91C3-CA65FB447F0B}.dat
- Size 5KB
- SHA256 1398f5dbf00335a33179e468f57bb89ec0005da290eb104110f231f317ef6435
- MD5 eb888f941b8d7be21b3667044c2c4fda
- SHA1 cdb43ef2e518c8ee38aa07cfaf261c3f036a5a85
- SHA512 10e910e14746a3d2149c1babdc25f42faa1e443de0fae6cecd137f5be00de11e1954db31f0382cc93a2bd9613cedbd7cc4210a2735a38afc9cd2ce2127a7fcd2
- SSDEEP 24:r+Go/Q4eGKGo/MeGjeG879lWHnA9lWHn:r+Go4/1Gobz5CHntHn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C8F08BD2-8843-11EF-91C3-CA65FB447F0B}.dat
- Size 5KB
- SHA256 a321b7f94aed28e5dffb3411d0707419fb82f820f4c82f5ee6d77582699082eb
- MD5 8af2750481c5e3faef3a2013a4e0bb35
- SHA1 bd430cfc28abe61c7ccf48ceb42998a69a6bf2b0
- SHA512 4c47744f00d012b4592163c1115a330b53c6ac413e633c1f00d19778a72df19db67242efb9c5a2e848c7e6863d0fc8c825a71abe71a0dd27211d47f3ad4cb184
- SSDEEP 24:r0Go/Q4eGcGo/seGTeG879lWPn7p9lWPn7p:r0Go4//Gobz5CPn7sPn7p
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver1307.tmp
- Size 15KB
- SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
- MD5 1a545d0052b581fbb2ab4c52133846bc
- SHA1 62f3266a9b9925cd6d98658b92adec673cbe3dd3
- SHA512 bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
- SSDEEP 384:79Jv9DF9/C9qc9/J9V791T9TK9Xf9Nm9xQ95a9BR9fV:79Jv9DF9/C9qc9/J9V791T9TK9Xf9NmT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XH3Z2ZON\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\381300528c93362f563a8d39a026b40a_JaffaCakes118mgr.exe
- Size 164KB
- SHA256 6f37eff51c9771946eb93e72cf3c8002be097be2feef6ca4b00eb371e6955819
- MD5 cc8f22ba15e7a3c5e5ef6fdc70c7ac9f
- SHA1 8c9b61565812e1365458eb617fe9b2513443c380
- SHA512 adf1cfbfebe026ad3d52d13c1333fcfc4932bdc7390cc750c42914485c6a1af64639eac8b32b24d7ac4aa6503135bfaaafff2061df13a7216592d5d8a8693f32
- SSDEEP 3072:1nxwgxgfR/DVG7wBpEZRZANOu4oJgxTmsQoF8yFza8h25f7g:t+xDVG0BpKHAclm/B5c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 7b5fcd91601b6ff011d457ad366fe5bb96e201effd7a4455a392dfa8d590b7e5
- MD5 2f1a0b7b110f631479b4464a24b2d0c2
- SHA1 bf4c420351d4f4d3af1204344cb76a913b4631f1
- SHA512 0f4a00be2ab9a7a880e76f6a9254f19eee07d95d96272d76b12a63a3506bd48829230fb51f37d5a936e5ce06ffe650d96b34359f29125eb885873670676d5dae
- MD5 SHA1 SHA512
- Path C:\ohtbj.pif
- Size 100KB
- SHA256 03616540cc41ce5e20a43f638e95a10ec198ae8a360cb1413bfbbfa7b827c51a
- MD5 8f140c4ab0f00e29e805804e2238d01d
- SHA1 0365dfddf02c66475f9d07b47ea0aa8dd29f78e8
- SHA512 4d7d59030cd7cd296b37b8f309b551a2bd16465a11554d114978e0292299f1de750f6b98048c550c430049e64fe69629988d5f4ad534e8ce81ad0456d9126e5b
- SSDEEP 1536:ZLynCPdi0KzhDXPDBF/98mCMbcT3ZG4dlVj9pShICH+DCYmjr:5PATzhDlF/TbcTg48ShIjr
- MD5 SHA1 SHA512 SSDEEP