Analysis
-
max time kernel
21s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28-11-2024 03:08
Behavioral task
behavioral1
Sample
aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
26 signatures
150 seconds
General
-
Target
aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe
-
Size
166KB
-
MD5
aac0f1d7271c9e63ca28e33bd71c3a95
-
SHA1
43cc582e48b987d72bb2ebc7bbdcb77283aadf24
-
SHA256
85fe4728de5e7cd9e8ae18f984080d5a3b5c9348e3969a1322a277e6c2494a06
-
SHA512
64c8125d8157743bccf78c97aeedd7cd16cf66aeb0decb888e3c5c797c6cc49aed85298170bcd81481a57278b46cc98f560979ca25830d028d5267f8a7707378
-
SSDEEP
3072:sr85CJT9fp9Ms2eKKBjtz4c6BQzmt0RGwyCdHsGEg0+A3GPKlk:k9/fINeVjyct+0RjdH+vJWv
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Detect Neshta payload 2 IoCs
resource yara_rule behavioral1/files/0x0013000000010321-10.dat family_neshta behavioral1/memory/3056-116-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe -
Loads dropped DLL 2 IoCs
pid Process 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened (read-only) \??\G: aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/1076-15-0x0000000001D60000-0x0000000002DEE000-memory.dmp upx behavioral1/memory/1076-20-0x0000000001D60000-0x0000000002DEE000-memory.dmp upx behavioral1/memory/1076-49-0x0000000001D60000-0x0000000002DEE000-memory.dmp upx behavioral1/memory/1076-50-0x0000000001D60000-0x0000000002DEE000-memory.dmp upx behavioral1/memory/1076-48-0x0000000001D60000-0x0000000002DEE000-memory.dmp upx behavioral1/memory/1076-19-0x0000000001D60000-0x0000000002DEE000-memory.dmp upx behavioral1/memory/1076-18-0x0000000001D60000-0x0000000002DEE000-memory.dmp upx behavioral1/memory/1076-17-0x0000000001D60000-0x0000000002DEE000-memory.dmp upx behavioral1/memory/1076-13-0x0000000001D60000-0x0000000002DEE000-memory.dmp upx behavioral1/memory/1076-16-0x0000000001D60000-0x0000000002DEE000-memory.dmp upx behavioral1/memory/1076-70-0x0000000001D60000-0x0000000002DEE000-memory.dmp upx behavioral1/memory/1076-73-0x0000000001D60000-0x0000000002DEE000-memory.dmp upx behavioral1/memory/1076-79-0x0000000001D60000-0x0000000002DEE000-memory.dmp upx behavioral1/memory/3056-128-0x0000000002FD0000-0x000000000405E000-memory.dmp upx behavioral1/memory/3056-134-0x0000000002FD0000-0x000000000405E000-memory.dmp upx behavioral1/memory/3056-133-0x0000000002FD0000-0x000000000405E000-memory.dmp upx behavioral1/memory/3056-131-0x0000000002FD0000-0x000000000405E000-memory.dmp upx behavioral1/memory/3056-141-0x0000000002FD0000-0x000000000405E000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe File opened for modification C:\Windows\SYSTEM.INI aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 776 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Token: SeDebugPrivilege 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 3056 wrote to memory of 1076 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 30 PID 3056 wrote to memory of 1076 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 30 PID 3056 wrote to memory of 1076 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 30 PID 3056 wrote to memory of 1076 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 30 PID 3056 wrote to memory of 1076 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 30 PID 3056 wrote to memory of 1076 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 30 PID 3056 wrote to memory of 1076 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 30 PID 1076 wrote to memory of 776 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 31 PID 1076 wrote to memory of 776 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 31 PID 1076 wrote to memory of 776 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 31 PID 1076 wrote to memory of 776 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 31 PID 1076 wrote to memory of 1112 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 19 PID 1076 wrote to memory of 1160 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 20 PID 1076 wrote to memory of 1200 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 21 PID 1076 wrote to memory of 1440 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 23 PID 1076 wrote to memory of 3056 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 29 PID 1076 wrote to memory of 3056 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 29 PID 1076 wrote to memory of 776 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 31 PID 1076 wrote to memory of 776 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 31 PID 1076 wrote to memory of 2544 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 32 PID 1076 wrote to memory of 1948 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 33 PID 1076 wrote to memory of 1948 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 33 PID 1076 wrote to memory of 1948 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 33 PID 1076 wrote to memory of 1948 1076 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 33 PID 3056 wrote to memory of 1112 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 19 PID 3056 wrote to memory of 1160 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 20 PID 3056 wrote to memory of 1200 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 21 PID 3056 wrote to memory of 1440 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 23 PID 3056 wrote to memory of 1076 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 30 PID 3056 wrote to memory of 2592 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 35 PID 3056 wrote to memory of 1112 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 19 PID 3056 wrote to memory of 1160 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 20 PID 3056 wrote to memory of 1200 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 21 PID 3056 wrote to memory of 1440 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 23 PID 3056 wrote to memory of 2592 3056 aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe 35 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Modifies system executable filetype association
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\3582-490\aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\aac0f1d7271c9e63ca28e33bd71c3a95_JaffaCakes118.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1076 -
C:\Windows\SysWOW64\schtasks.exeC:\Windows\system32\schtasks.exe /create /tn "JavaUpdateAdmin" /tr C:\Users\Admin\AppData\Local\Temp\3582-490\jusched.exe /sc daily4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:776
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\system32\schtasks.exe /run /tn "JavaUpdateAdmin"4⤵
- System Location Discovery: System Language Discovery
PID:1948
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1440
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1302882154-1818028051093790043-1770298503-120566053816624992562034640893417455455"1⤵PID:2544
-
C:\Windows\system32\taskeng.exetaskeng.exe {00FB2249-2D5C-42A0-BA62-FBABAB1195DA} S-1-5-21-3063565911-2056067323-3330884624-1000:KHBTHJFA\Admin:Interactive:[1]1⤵PID:2592
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5566ed4f62fdc96f175afedd811fa0370
SHA1d4b47adc40e0d5a9391d3f6f2942d1889dd2a451
SHA256e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460
SHA512cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7
-
Filesize
125KB
MD53fcd088d9b464b43fd1af54f9113d2f4
SHA1962acc0fcf3a712d5118df7f37194ef9dbd276af
SHA2564686fed0cc7db64c595bc35547dfbe12e5741fe6d347a64d2705595fe64361f6
SHA512ddaea7a6794c9903cc463af1d01e4502ff4ad9255e2a0de36c67d0313e50dff23a69f286e404aa1e5a67d93e1a55338e26c9f2bf361f7f60b64f70c32e60b00f
-
Filesize
257B
MD5949565c1b6873e9165909bb9b2e187a6
SHA184ce8b485d7a9a27c1a7dc243f6c12ffb9fa687d
SHA256ef895d6a13e225de7c4cc4d8fcc7dabb361b01fd55137e298d9d81664a74aa0f
SHA512c50bd677a5baf2ceb27de36d694b5ee1d7cf76c9ae25741231e837d09f72fc9472b21f391e48cd2ec2a47af661ee4ca03e8762c45d2633bca98bb17cf5a5626c
-
Filesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156