Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2024, 12:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
23 signatures
150 seconds
General
-
Target
66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
66bf2bd6bcd6c3a39c5499a68a63e756
-
SHA1
839c75ada4d42132b318e8485af1bef13f161f7a
-
SHA256
05d8b7fd8054a5edda812894f1eab9d3fb91e18035851b1caed217a6bde18c41
-
SHA512
ac894fa159a50a43b493c69bf397640d3356a8803f1edbf53aa95d256ebee3df21a02ef5767b1388ad3f5636b4b96f6e9a128b8906ee651b12640c8f01ed6739
-
SSDEEP
24576:OSTr6jNMfUpY99HJnRigrOy4GSJcH+ns4:V6jXm999RiqOyiJceb
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = ",svshost.exe" 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe -
Modifies firewall policy service 3 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe:*:Enabled:@xpsp2res.dll,-22019" 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe -
Checks for any installed AV software in registry 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\AntiVir Desktop 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\svshost.exe 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\svshost.exe 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3416 set thread context of 30688 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 93 PID 30688 set thread context of 5348 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 97 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeBackupPrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeAssignPrimaryTokenPrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeAuditPrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeBackupPrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeCreatePermanentPrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeCreatePermanentPrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeCreateTokenPrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeLoadDriverPrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeLockMemoryPrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeMachineAccountPrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeRestorePrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeSecurityPrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeShutdownPrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeSystemProfilePrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeSystemtimePrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeTcbPrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeDebugPrivilege 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeSecurityPrivilege 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeLoadDriverPrivilege 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeSystemProfilePrivilege 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeSystemtimePrivilege 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeBackupPrivilege 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeRestorePrivilege 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeShutdownPrivilege 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeDebugPrivilege 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeUndockPrivilege 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeManageVolumePrivilege 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeImpersonatePrivilege 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: 33 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: 34 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: 35 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe Token: 36 5348 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 3416 wrote to memory of 30688 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 93 PID 3416 wrote to memory of 30688 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 93 PID 3416 wrote to memory of 30688 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 93 PID 3416 wrote to memory of 30688 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 93 PID 3416 wrote to memory of 30688 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 93 PID 3416 wrote to memory of 30688 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 93 PID 3416 wrote to memory of 30688 3416 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 93 PID 30688 wrote to memory of 30060 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 94 PID 30688 wrote to memory of 30060 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 94 PID 30688 wrote to memory of 30060 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 94 PID 30060 wrote to memory of 30220 30060 net.exe 96 PID 30060 wrote to memory of 30220 30060 net.exe 96 PID 30060 wrote to memory of 30220 30060 net.exe 96 PID 30688 wrote to memory of 5348 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 97 PID 30688 wrote to memory of 5348 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 97 PID 30688 wrote to memory of 5348 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 97 PID 30688 wrote to memory of 5348 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 97 PID 30688 wrote to memory of 5348 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 97 PID 30688 wrote to memory of 5348 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 97 PID 30688 wrote to memory of 5348 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 97 PID 30688 wrote to memory of 5348 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 97 PID 30688 wrote to memory of 5348 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 97 PID 30688 wrote to memory of 5348 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 97 PID 30688 wrote to memory of 5348 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 97 PID 30688 wrote to memory of 5348 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 97 PID 30688 wrote to memory of 5348 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 97 PID 30688 wrote to memory of 5348 30688 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe 97 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe2⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:30688 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:30060 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess4⤵
- System Location Discovery: System Language Discovery
PID:30220
-
-
-
C:\Users\Admin\AppData\Local\Temp\66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe3⤵
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:5348
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Pre-OS Boot
1Bootkit
1