Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2024 03:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
General
-
Target
b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe
-
Size
580KB
-
MD5
b69c254bc42a14b5193b4c0902977649
-
SHA1
aca77f932ac60d946e6d1d9db7ef4635bada68d9
-
SHA256
e5603248ccffa18a34180211e5c36ab6c2746e23b1f430632d68973a8c5c2a3f
-
SHA512
98d565e2d847bb6f4db89f13ed4f54d04d9f1c55fba668afd780f72e4c7a7c9665b3dad7d55ba5e166539146db9953b030676687f9a8a79af03bdc1a6bdd63dc
-
SSDEEP
12288:CG3z0SWs3mu0GJgYtd+LwT95/+gD9bjOmDJQ4CkCBpZCAXRgxCfPmV2Hx:rj9WwuGJgY7+LwT91+gBOm9QZtpsNlox
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Ardamax family
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023cb8-30.dat family_ardamax -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe -
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 468 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4504 DYWB.exe -
Loads dropped DLL 4 IoCs
pid Process 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 4504 DYWB.exe 4504 DYWB.exe 4504 DYWB.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DYWB Agent = "C:\\Windows\\SysWOW64\\28463\\DYWB.exe" DYWB.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\28463\DYWB.001 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\DYWB.006 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\DYWB.007 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\DYWB.exe b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\AKV.exe b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\28463 DYWB.exe -
resource yara_rule behavioral2/memory/3752-1-0x0000000002300000-0x0000000003333000-memory.dmp upx behavioral2/memory/3752-5-0x0000000002300000-0x0000000003333000-memory.dmp upx behavioral2/memory/3752-19-0x0000000002300000-0x0000000003333000-memory.dmp upx behavioral2/memory/3752-20-0x0000000002300000-0x0000000003333000-memory.dmp upx behavioral2/memory/3752-31-0x0000000002300000-0x0000000003333000-memory.dmp upx behavioral2/memory/3752-46-0x0000000002300000-0x0000000003333000-memory.dmp upx behavioral2/memory/3752-68-0x0000000002300000-0x0000000003333000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYWB.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe Token: SeDebugPrivilege 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4504 DYWB.exe 4504 DYWB.exe 4504 DYWB.exe 4504 DYWB.exe 4504 DYWB.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3752 wrote to memory of 788 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 9 PID 3752 wrote to memory of 792 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 10 PID 3752 wrote to memory of 384 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 13 PID 3752 wrote to memory of 2564 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 44 PID 3752 wrote to memory of 2608 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 45 PID 3752 wrote to memory of 2984 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 51 PID 3752 wrote to memory of 3456 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 56 PID 3752 wrote to memory of 3592 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 57 PID 3752 wrote to memory of 3776 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 58 PID 3752 wrote to memory of 3904 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 59 PID 3752 wrote to memory of 3984 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 60 PID 3752 wrote to memory of 4072 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 61 PID 3752 wrote to memory of 3860 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 62 PID 3752 wrote to memory of 2604 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 75 PID 3752 wrote to memory of 5092 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 76 PID 3752 wrote to memory of 2836 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 81 PID 3752 wrote to memory of 468 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 83 PID 3752 wrote to memory of 468 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 83 PID 3752 wrote to memory of 468 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 83 PID 3752 wrote to memory of 4504 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 85 PID 3752 wrote to memory of 4504 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 85 PID 3752 wrote to memory of 4504 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 85 PID 3752 wrote to memory of 788 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 9 PID 3752 wrote to memory of 792 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 10 PID 3752 wrote to memory of 384 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 13 PID 3752 wrote to memory of 2564 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 44 PID 3752 wrote to memory of 2608 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 45 PID 3752 wrote to memory of 2984 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 51 PID 3752 wrote to memory of 3456 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 56 PID 3752 wrote to memory of 3592 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 57 PID 3752 wrote to memory of 3776 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 58 PID 3752 wrote to memory of 3904 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 59 PID 3752 wrote to memory of 3984 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 60 PID 3752 wrote to memory of 4072 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 61 PID 3752 wrote to memory of 3860 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 62 PID 3752 wrote to memory of 2604 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 75 PID 3752 wrote to memory of 5092 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 76 PID 3752 wrote to memory of 4504 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 85 PID 3752 wrote to memory of 4504 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 85 PID 3752 wrote to memory of 788 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 9 PID 3752 wrote to memory of 792 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 10 PID 3752 wrote to memory of 384 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 13 PID 3752 wrote to memory of 2564 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 44 PID 3752 wrote to memory of 2608 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 45 PID 3752 wrote to memory of 2984 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 51 PID 3752 wrote to memory of 3456 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 56 PID 3752 wrote to memory of 3592 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 57 PID 3752 wrote to memory of 3776 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 58 PID 3752 wrote to memory of 3904 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 59 PID 3752 wrote to memory of 3984 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 60 PID 3752 wrote to memory of 4072 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 61 PID 3752 wrote to memory of 3860 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 62 PID 3752 wrote to memory of 2604 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 75 PID 3752 wrote to memory of 5092 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 76 PID 3752 wrote to memory of 788 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 9 PID 3752 wrote to memory of 792 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 10 PID 3752 wrote to memory of 384 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 13 PID 3752 wrote to memory of 2564 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 44 PID 3752 wrote to memory of 2608 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 45 PID 3752 wrote to memory of 2984 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 51 PID 3752 wrote to memory of 3456 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 56 PID 3752 wrote to memory of 3592 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 57 PID 3752 wrote to memory of 3776 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 58 PID 3752 wrote to memory of 3904 3752 b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe 59 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:384
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2564
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2608
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2984
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b69c254bc42a14b5193b4c0902977649_JaffaCakes118.exe"2⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3752 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:468
-
-
C:\Windows\SysWOW64\28463\DYWB.exe"C:\Windows\system32\28463\DYWB.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4504
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3592
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3776
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3904
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3984
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4072
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3860
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2604
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5092
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2836
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5c3679c3ff636d1a6b8c65323540da371
SHA1d184758721a426467b687bec2a4acc80fe44c6f8
SHA256d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb
SHA512494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7
-
Filesize
395KB
MD5b8fa30233794772b8b76b4b1d91c7321
SHA10cf9561be2528944285e536f41d502be24c3aa87
SHA25614116fa79ccc105fabd312b4dff74933f8684c6b27db37e5e3a79d159092d29a
SHA51210ce8b18e7afb8c7e30bb90b0a1f199ef0b77873fa7a9efc596606e151be6b516c0ec6222a9032bdcc527e80964f53d20a28fa1881a08b4df303b2e28204549d
-
Filesize
430B
MD5248ac4eb4a016551d242264b04808584
SHA1181f70b0b9a22346acd30b9f03151e39265fe1b5
SHA25657bfbba2305791aaf3aa89db6706cbb37ef80d397e35e0b9d21bfe3645b35cf8
SHA5129ff23686b606412e715defdf6bbef8ed6cf7296d38f1c5ee20cf4eab651bdbefdcc7e854e9062695edd98a5df2967973d20817ec03208c523a4d9777119332ef
-
Filesize
8KB
MD543f02e9974b1477c1e6388882f233db0
SHA1f3e27b231193f8d5b2e1b09d05ae3a62795cf339
SHA2563c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba
SHA512e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f
-
Filesize
5KB
MD5b5a87d630436f958c6e1d82d15f98f96
SHA1d3ff5e92198d4df0f98a918071aca53550bf1cff
SHA256a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2
SHA512fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce
-
Filesize
473KB
MD517535dddecf8cb1efdba1f1952126547
SHA1a862a9a3eb6c201751be1038537522a5281ea6cb
SHA2561a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd
SHA512b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8