Analysis
-
max time kernel
122s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/12/2024, 06:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
150 seconds
General
-
Target
c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe
-
Size
100KB
-
MD5
c6623ec5b651e9876974081a4481bd5e
-
SHA1
aac9cdea73f7dae6c1c132e4220a9f518598d0a2
-
SHA256
efc28b3014090ed19dd1a148a75ed7d93a5959e505fba80f9e4ef50dcfc8efa7
-
SHA512
14139df22a5ebd56aec1fab3e008011e2fc124e68c77efa0e87d8a11043ad4ac6f6e4c54dbbb88241d2cf07a2ca6536620d90c22e78555bc70cfab3fd3182aa5
-
SSDEEP
1536:OJRFiem4OKKEUonNB7ok5sVNyPomMsQK35PLW9xrok5aqFH/YZ9M72fjbS6tVva7:szCUUoziEPomdkxrok0eSM8HvaA8
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened (read-only) \??\J: c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened (read-only) \??\U: c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened (read-only) \??\W: c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened (read-only) \??\M: c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened (read-only) \??\Q: c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened (read-only) \??\R: c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened (read-only) \??\Y: c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened (read-only) \??\Z: c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened (read-only) \??\E: c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened (read-only) \??\H: c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened (read-only) \??\K: c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened (read-only) \??\P: c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened (read-only) \??\S: c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened (read-only) \??\X: c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened (read-only) \??\I: c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened (read-only) \??\L: c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened (read-only) \??\N: c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened (read-only) \??\O: c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened (read-only) \??\T: c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened (read-only) \??\V: c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\autorun.inf c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened for modification C:\autorun.inf c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/1964-3-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-8-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-4-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-7-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-6-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-5-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-26-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-28-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-27-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-29-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-30-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-31-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-32-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-33-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-35-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-42-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-43-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-44-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-47-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-49-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-51-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-53-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-55-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-57-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-59-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx behavioral1/memory/1964-68-0x0000000001E10000-0x0000000002E9E000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe Token: SeDebugPrivilege 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 1964 wrote to memory of 1036 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 17 PID 1964 wrote to memory of 1052 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 18 PID 1964 wrote to memory of 1108 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 20 PID 1964 wrote to memory of 1488 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 22 PID 1964 wrote to memory of 1664 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 25 PID 1964 wrote to memory of 1036 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 17 PID 1964 wrote to memory of 1052 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 18 PID 1964 wrote to memory of 1108 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 20 PID 1964 wrote to memory of 1664 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 25 PID 1964 wrote to memory of 1036 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 17 PID 1964 wrote to memory of 1052 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 18 PID 1964 wrote to memory of 1108 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 20 PID 1964 wrote to memory of 1664 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 25 PID 1964 wrote to memory of 1036 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 17 PID 1964 wrote to memory of 1052 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 18 PID 1964 wrote to memory of 1108 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 20 PID 1964 wrote to memory of 1664 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 25 PID 1964 wrote to memory of 1036 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 17 PID 1964 wrote to memory of 1052 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 18 PID 1964 wrote to memory of 1108 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 20 PID 1964 wrote to memory of 1664 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 25 PID 1964 wrote to memory of 1036 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 17 PID 1964 wrote to memory of 1052 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 18 PID 1964 wrote to memory of 1108 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 20 PID 1964 wrote to memory of 1664 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 25 PID 1964 wrote to memory of 1036 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 17 PID 1964 wrote to memory of 1052 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 18 PID 1964 wrote to memory of 1108 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 20 PID 1964 wrote to memory of 1664 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 25 PID 1964 wrote to memory of 1036 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 17 PID 1964 wrote to memory of 1052 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 18 PID 1964 wrote to memory of 1108 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 20 PID 1964 wrote to memory of 1664 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 25 PID 1964 wrote to memory of 1036 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 17 PID 1964 wrote to memory of 1052 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 18 PID 1964 wrote to memory of 1108 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 20 PID 1964 wrote to memory of 1664 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 25 PID 1964 wrote to memory of 1036 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 17 PID 1964 wrote to memory of 1052 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 18 PID 1964 wrote to memory of 1108 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 20 PID 1964 wrote to memory of 1664 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 25 PID 1964 wrote to memory of 1036 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 17 PID 1964 wrote to memory of 1052 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 18 PID 1964 wrote to memory of 1108 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 20 PID 1964 wrote to memory of 1664 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 25 PID 1964 wrote to memory of 1036 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 17 PID 1964 wrote to memory of 1052 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 18 PID 1964 wrote to memory of 1108 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 20 PID 1964 wrote to memory of 1664 1964 c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe 25 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1036
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1052
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1108
-
C:\Windows\System32\dzuhbf.exe"C:\Windows\System32\dzuhbf.exe"2⤵PID:1488
-
-
C:\Users\Admin\AppData\Local\Temp\c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c6623ec5b651e9876974081a4481bd5e_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1964
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1664
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5360e0bfeccddc203899e34be023db35f
SHA138a78c213586aa8c523862ba2f66e1482829bd19
SHA256a310172ad9c5ae7dabd81f64e5031dfae0c99caa69ff9311205cb2091c6a0f6c
SHA512498c3e8f0210bf905366b60f181f112b86b06d7e2089221927a142022f5fcfe940da420b99dc77632039bfc3ed0f7ada0e1c503a4271788716280d5cefa815ce