Analysis
-
max time kernel
147s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
15-12-2024 14:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe
Resource
win7-20241023-en
windows7-x64
20 signatures
150 seconds
General
-
Target
f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe
-
Size
100KB
-
MD5
f45653f0c9fd118d515c308e34bc324b
-
SHA1
75535a1c7c25acc9395386b5e11c18cf89a7faa0
-
SHA256
fc67275e3b058a230e7fb8bac0dcb80a6bd8ca6c6bf59f5a0f91fb3deca4812d
-
SHA512
b9294f3de8aa7f68a43c18186a71fa6d14b3933001c4460f65e1c3ec25052182497ef2c45484afd5f79c551a75e404bfccf459f5ba39c40080ce3a306166c026
-
SSDEEP
3072:9fpgl4PnKQDOpMc0e5hBW2OrTnz4dgUB2faDfb7:9fulsK5pMl+FOrTn8dMifb
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe -
Disables Task Manager via registry modification
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened (read-only) \??\S: f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened (read-only) \??\I: f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened (read-only) \??\K: f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened (read-only) \??\T: f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened (read-only) \??\V: f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened (read-only) \??\W: f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened (read-only) \??\X: f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened (read-only) \??\J: f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened (read-only) \??\R: f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened (read-only) \??\N: f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened (read-only) \??\P: f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened (read-only) \??\Y: f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened (read-only) \??\E: f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened (read-only) \??\L: f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened (read-only) \??\O: f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened (read-only) \??\Q: f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened (read-only) \??\U: f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened (read-only) \??\Z: f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened (read-only) \??\G: f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened (read-only) \??\H: f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened for modification F:\autorun.inf f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/1740-6-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-7-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-9-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-11-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-3-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-8-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-1-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-5-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-4-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-10-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-27-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-28-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-29-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-31-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-30-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-33-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-34-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-35-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-37-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-40-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-56-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-58-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-61-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-62-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-64-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-65-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-66-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-68-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx behavioral1/memory/1740-69-0x0000000001D70000-0x0000000002DFE000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe Token: SeDebugPrivilege 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 1740 wrote to memory of 1100 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 19 PID 1740 wrote to memory of 1160 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 20 PID 1740 wrote to memory of 1188 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 21 PID 1740 wrote to memory of 1028 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 25 PID 1740 wrote to memory of 1100 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 19 PID 1740 wrote to memory of 1160 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 20 PID 1740 wrote to memory of 1188 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 21 PID 1740 wrote to memory of 1028 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 25 PID 1740 wrote to memory of 1100 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 19 PID 1740 wrote to memory of 1160 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 20 PID 1740 wrote to memory of 1188 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 21 PID 1740 wrote to memory of 1028 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 25 PID 1740 wrote to memory of 1100 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 19 PID 1740 wrote to memory of 1160 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 20 PID 1740 wrote to memory of 1188 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 21 PID 1740 wrote to memory of 1028 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 25 PID 1740 wrote to memory of 1100 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 19 PID 1740 wrote to memory of 1160 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 20 PID 1740 wrote to memory of 1188 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 21 PID 1740 wrote to memory of 1028 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 25 PID 1740 wrote to memory of 1100 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 19 PID 1740 wrote to memory of 1160 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 20 PID 1740 wrote to memory of 1188 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 21 PID 1740 wrote to memory of 1028 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 25 PID 1740 wrote to memory of 1100 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 19 PID 1740 wrote to memory of 1160 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 20 PID 1740 wrote to memory of 1188 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 21 PID 1740 wrote to memory of 1028 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 25 PID 1740 wrote to memory of 1100 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 19 PID 1740 wrote to memory of 1160 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 20 PID 1740 wrote to memory of 1188 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 21 PID 1740 wrote to memory of 1028 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 25 PID 1740 wrote to memory of 1100 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 19 PID 1740 wrote to memory of 1160 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 20 PID 1740 wrote to memory of 1188 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 21 PID 1740 wrote to memory of 1028 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 25 PID 1740 wrote to memory of 1100 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 19 PID 1740 wrote to memory of 1160 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 20 PID 1740 wrote to memory of 1188 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 21 PID 1740 wrote to memory of 1028 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 25 PID 1740 wrote to memory of 1100 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 19 PID 1740 wrote to memory of 1160 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 20 PID 1740 wrote to memory of 1188 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 21 PID 1740 wrote to memory of 1028 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 25 PID 1740 wrote to memory of 1100 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 19 PID 1740 wrote to memory of 1160 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 20 PID 1740 wrote to memory of 1188 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 21 PID 1740 wrote to memory of 1028 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 25 PID 1740 wrote to memory of 1100 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 19 PID 1740 wrote to memory of 1160 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 20 PID 1740 wrote to memory of 1188 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 21 PID 1740 wrote to memory of 1028 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 25 PID 1740 wrote to memory of 1100 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 19 PID 1740 wrote to memory of 1160 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 20 PID 1740 wrote to memory of 1188 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 21 PID 1740 wrote to memory of 1028 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 25 PID 1740 wrote to memory of 1100 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 19 PID 1740 wrote to memory of 1160 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 20 PID 1740 wrote to memory of 1188 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 21 PID 1740 wrote to memory of 1028 1740 f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe 25 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1100
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f45653f0c9fd118d515c308e34bc324b_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1740
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1028
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5a721790fcb26917ae5403bb2a477c08f
SHA1d26dc130a306d23b9839480a764efe86815ff8d3
SHA2561b576c53dde874b0275e7e2caebd6ca2c2c98c11d253f43524bea10604565564
SHA512ed73da5e9cd7c8aa10fa724d4668bc6b52add6e27afabcec8e498c5e883ac2a38476068d9ca51a262da0a0b2b0b2a48f5debb41d20da9d5275e2246dde93a4f3