Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-12-2024 20:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe
Resource
win7-20241010-en
windows7-x64
19 signatures
150 seconds
General
-
Target
e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe
-
Size
644KB
-
MD5
e80e2e312ca2d56401c304ac6f7c4e4b
-
SHA1
7969ab497fa1119c76f57ce084e331263160da15
-
SHA256
0eb94ab4ac84838292b2b94c020f4a75318d45f5dc39983e273a9cfbcf15678c
-
SHA512
d04662efd99d407bd6533126846fa79ef9a91109ae04df6d9a9d60f3497cf98b86870e04fb1546a1f26501b25c59d10d018122e191a076a95329201194bb4aed
-
SSDEEP
12288:hhWr1in8urT5cV4Xem4p1vESPAPB+kM1bkq:qQNTWfR/FOAk8t
Malware Config
Signatures
-
Darkcomet family
-
Modifies firewall policy service 3 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe:*:Enabled:@xpsp2res.dll,-22019" e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1" e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe -
Disables Task Manager via registry modification
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 5048 set thread context of 27336 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 82 PID 27336 set thread context of 6612 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 87 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeAuditPrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeBackupPrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeCreatePermanentPrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeCreatePermanentPrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeCreateTokenPrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeLoadDriverPrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeLockMemoryPrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeMachineAccountPrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeRestorePrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeSecurityPrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeShutdownPrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeSystemProfilePrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeSystemtimePrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeTcbPrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeDebugPrivilege 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeSecurityPrivilege 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeLoadDriverPrivilege 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeSystemProfilePrivilege 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeSystemtimePrivilege 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeBackupPrivilege 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeRestorePrivilege 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeShutdownPrivilege 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeDebugPrivilege 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeUndockPrivilege 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeManageVolumePrivilege 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeImpersonatePrivilege 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: 33 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: 34 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: 35 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe Token: 36 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 6612 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 5048 wrote to memory of 27336 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 82 PID 5048 wrote to memory of 27336 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 82 PID 5048 wrote to memory of 27336 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 82 PID 5048 wrote to memory of 27336 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 82 PID 5048 wrote to memory of 27336 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 82 PID 5048 wrote to memory of 27336 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 82 PID 5048 wrote to memory of 27336 5048 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 82 PID 27336 wrote to memory of 26680 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 83 PID 27336 wrote to memory of 26680 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 83 PID 27336 wrote to memory of 26680 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 83 PID 26680 wrote to memory of 26956 26680 net.exe 85 PID 26680 wrote to memory of 26956 26680 net.exe 85 PID 26680 wrote to memory of 26956 26680 net.exe 85 PID 27336 wrote to memory of 6612 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 87 PID 27336 wrote to memory of 6612 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 87 PID 27336 wrote to memory of 6612 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 87 PID 27336 wrote to memory of 6612 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 87 PID 27336 wrote to memory of 6612 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 87 PID 27336 wrote to memory of 6612 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 87 PID 27336 wrote to memory of 6612 27336 e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe2⤵
- Modifies firewall policy service
- Checks computer location settings
- Maps connected drives based on registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:27336 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:26680 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess4⤵
- System Location Discovery: System Language Discovery
PID:26956
-
-
-
C:\Users\Admin\AppData\Local\Temp\e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\e80e2e312ca2d56401c304ac6f7c4e4b_JaffaCakes118.exe3⤵
- Modifies firewall policy service
- Windows security bypass
- Checks BIOS information in registry
- Windows security modification
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6612
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
3Pre-OS Boot
1Bootkit
1