Analysis
-
max time kernel
94s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2024 03:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
General
-
Target
d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe
-
Size
155KB
-
MD5
d07c0662b0d4eaf566c40282e023f832
-
SHA1
9c4e9e131203b9ff582aca55e6122891bdd1f30d
-
SHA256
a8dc459bf9158255f34198c004c52cca320ab8a5d2c52d7e8226c2543f861363
-
SHA512
c73a127c403c2eaa39cbe0088d22d7891698e62b06c939245186b4d0e51341c302aa684fc69aa15524e92f8f745906c04f6822fd0cb34a433ac7d428d7b8cec6
-
SSDEEP
3072:pHKrhJJsrbBNOYkgZsXjMxZqdQubEennvowbsHlMo+3YoVfyf:Rmsr6g+XoxUdQihnIMRISKf
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe -
Disables Task Manager via registry modification
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3388 set thread context of 4880 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 82 PID 4880 set thread context of 2480 4880 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 83 PID 2480 set thread context of 988 2480 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 84 -
resource yara_rule behavioral2/memory/3388-5-0x00000000028E0000-0x000000000396E000-memory.dmp upx behavioral2/memory/3388-1-0x00000000028E0000-0x000000000396E000-memory.dmp upx behavioral2/memory/3388-4-0x00000000028E0000-0x000000000396E000-memory.dmp upx behavioral2/memory/3388-7-0x00000000028E0000-0x000000000396E000-memory.dmp upx behavioral2/memory/3388-6-0x00000000028E0000-0x000000000396E000-memory.dmp upx behavioral2/memory/3388-3-0x00000000028E0000-0x000000000396E000-memory.dmp upx behavioral2/memory/3388-28-0x00000000028E0000-0x000000000396E000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 988 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 988 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 988 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 988 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe Token: SeDebugPrivilege 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 3388 wrote to memory of 780 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 8 PID 3388 wrote to memory of 788 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 9 PID 3388 wrote to memory of 64 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 13 PID 3388 wrote to memory of 2680 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 44 PID 3388 wrote to memory of 2704 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 45 PID 3388 wrote to memory of 2852 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 49 PID 3388 wrote to memory of 3628 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 56 PID 3388 wrote to memory of 3744 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 57 PID 3388 wrote to memory of 3944 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 58 PID 3388 wrote to memory of 4036 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 59 PID 3388 wrote to memory of 1156 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 60 PID 3388 wrote to memory of 3212 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 61 PID 3388 wrote to memory of 4248 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 62 PID 3388 wrote to memory of 4100 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 75 PID 3388 wrote to memory of 3860 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 76 PID 3388 wrote to memory of 4880 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 82 PID 3388 wrote to memory of 4880 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 82 PID 3388 wrote to memory of 4880 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 82 PID 3388 wrote to memory of 4880 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 82 PID 3388 wrote to memory of 4880 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 82 PID 3388 wrote to memory of 4880 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 82 PID 3388 wrote to memory of 4880 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 82 PID 3388 wrote to memory of 4880 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 82 PID 3388 wrote to memory of 4880 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 82 PID 3388 wrote to memory of 4880 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 82 PID 3388 wrote to memory of 4880 3388 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 82 PID 4880 wrote to memory of 2480 4880 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 83 PID 4880 wrote to memory of 2480 4880 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 83 PID 4880 wrote to memory of 2480 4880 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 83 PID 4880 wrote to memory of 2480 4880 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 83 PID 4880 wrote to memory of 2480 4880 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 83 PID 4880 wrote to memory of 2480 4880 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 83 PID 4880 wrote to memory of 2480 4880 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 83 PID 4880 wrote to memory of 2480 4880 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 83 PID 4880 wrote to memory of 2480 4880 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 83 PID 4880 wrote to memory of 2480 4880 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 83 PID 4880 wrote to memory of 2480 4880 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 83 PID 2480 wrote to memory of 988 2480 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 84 PID 2480 wrote to memory of 988 2480 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 84 PID 2480 wrote to memory of 988 2480 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 84 PID 2480 wrote to memory of 988 2480 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 84 PID 2480 wrote to memory of 988 2480 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 84 PID 2480 wrote to memory of 988 2480 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 84 PID 2480 wrote to memory of 988 2480 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 84 PID 988 wrote to memory of 3628 988 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 56 PID 988 wrote to memory of 3628 988 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 56 PID 988 wrote to memory of 3628 988 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 56 PID 988 wrote to memory of 3628 988 d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe 56 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2680
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2704
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2852
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe4⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d07c0662b0d4eaf566c40282e023f832_JaffaCakes118.exe5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:988
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3744
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3944
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4036
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1156
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3212
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4248
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4100
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3860
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5