Analysis
-
max time kernel
33s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 11:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
19 signatures
150 seconds
General
-
Target
f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe
-
Size
369KB
-
MD5
f8e4401dff213d69435c8a4c95a5deea
-
SHA1
ac46f81e1385154221a02174c2a284eb858cf48b
-
SHA256
ceba6ad4b778705c6fc2a4a968b93c5da232a3c545cf0e62bacc624c7f674b5c
-
SHA512
6c815cd96e88749c1753187d3c433388e6086fb653f7b8c827e7d371426dba4b3667419651417589ebc9e72b40e85c9d58608ed65c1abe756c316ed83cfa7156
-
SSDEEP
6144:3v3+5MVSBtJ/M7Ikc3TFarEwxhJyyQaAt6REgdfSVzQtYMhNufkF8UWYXMrj2L:/0OSR01P47wdt9YMhaAXMryL
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" voujyk.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" voujyk.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" voujyk.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" voujyk.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" voujyk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" voujyk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" voujyk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" voujyk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" voujyk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" voujyk.exe -
Executes dropped EXE 1 IoCs
pid Process 2280 voujyk.exe -
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 37.209.198.6 Destination IP 192.35.51.30 Destination IP 128.63.2.53 Destination IP 192.42.174.30 Destination IP 192.35.51.30 Destination IP 192.12.94.30 Destination IP 192.41.162.30 Destination IP 192.35.51.30 Destination IP 192.33.14.30 Destination IP 37.209.196.6 Destination IP 192.42.174.30 Destination IP 192.42.174.30 Destination IP 192.42.175.30 Destination IP 37.209.192.6 Destination IP 192.31.80.30 Destination IP 192.42.176.30 Destination IP 192.43.172.30 Destination IP 192.41.162.30 Destination IP 192.35.51.30 Destination IP 37.209.198.6 Destination IP 37.209.198.6 Destination IP 192.54.112.30 Destination IP 192.42.175.30 Destination IP 37.209.192.6 Destination IP 192.42.173.30 Destination IP 192.5.6.30 Destination IP 192.42.173.30 Destination IP 192.42.176.30 Destination IP 192.42.176.30 Destination IP 192.41.162.30 Destination IP 37.209.198.6 Destination IP 192.48.79.30 Destination IP 192.35.51.30 Destination IP 192.41.162.30 Destination IP 192.54.112.30 Destination IP 37.209.194.6 Destination IP 192.42.174.30 Destination IP 192.42.175.30 Destination IP 37.209.194.6 Destination IP 37.209.192.6 Destination IP 192.41.162.30 Destination IP 192.42.176.30 Destination IP 192.48.79.30 Destination IP 192.42.174.30 Destination IP 192.35.51.30 Destination IP 192.5.6.30 Destination IP 192.35.51.30 Destination IP 192.33.14.30 Destination IP 192.5.5.241 Destination IP 192.12.94.30 Destination IP 192.5.6.30 Destination IP 192.42.173.30 Destination IP 37.209.194.6 Destination IP 192.33.14.30 Destination IP 192.41.162.30 Destination IP 192.42.175.30 Destination IP 192.33.14.30 Destination IP 192.42.175.30 Destination IP 192.35.51.30 Destination IP 192.41.162.30 Destination IP 192.54.112.30 Destination IP 192.43.172.30 Destination IP 192.43.172.30 Destination IP 192.35.51.30 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" voujyk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc voujyk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" voujyk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" voujyk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" voujyk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" voujyk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" voujyk.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moquumoug = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\quiwoopousooz.exe" voujyk.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" voujyk.exe -
Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe File opened (read-only) \??\K: f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe File opened (read-only) \??\G: voujyk.exe File opened (read-only) \??\H: voujyk.exe File opened (read-only) \??\J: voujyk.exe File opened (read-only) \??\I: voujyk.exe File opened (read-only) \??\K: voujyk.exe File opened (read-only) \??\G: f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe File opened (read-only) \??\H: f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe File opened (read-only) \??\I: f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe File opened (read-only) \??\J: f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe File opened (read-only) \??\E: voujyk.exe -
resource yara_rule behavioral2/memory/1868-3-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral2/memory/1868-5-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral2/memory/1868-1-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral2/memory/1868-7-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral2/memory/1868-4-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral2/memory/1868-6-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral2/memory/1868-8-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral2/memory/1868-14-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral2/memory/1868-16-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral2/memory/1868-15-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral2/memory/1868-17-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral2/memory/1868-18-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral2/memory/1868-19-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral2/memory/1868-20-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral2/memory/1868-21-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral2/memory/1868-23-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral2/memory/1868-24-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral2/memory/1868-25-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral2/memory/1868-26-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral2/memory/1868-33-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral2/memory/1868-34-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral2/memory/1868-37-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral2/memory/2280-62-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2280-64-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2280-63-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2280-61-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2280-72-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2280-65-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2280-59-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2280-70-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2280-71-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2280-73-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2280-74-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2280-75-0x0000000002350000-0x00000000033DE000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language voujyk.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe 2280 voujyk.exe -
Suspicious behavior: RenamesItself 2 IoCs
pid Process 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 2280 voujyk.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Token: SeDebugPrivilege 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1868 wrote to memory of 788 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 8 PID 1868 wrote to memory of 792 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 9 PID 1868 wrote to memory of 372 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 13 PID 1868 wrote to memory of 2940 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 50 PID 1868 wrote to memory of 3052 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 51 PID 1868 wrote to memory of 1108 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 53 PID 1868 wrote to memory of 3436 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 56 PID 1868 wrote to memory of 3560 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 57 PID 1868 wrote to memory of 3748 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 58 PID 1868 wrote to memory of 3836 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 59 PID 1868 wrote to memory of 3900 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 60 PID 1868 wrote to memory of 3984 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 61 PID 1868 wrote to memory of 3872 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 62 PID 1868 wrote to memory of 5016 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 75 PID 1868 wrote to memory of 880 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 76 PID 1868 wrote to memory of 3064 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 77 PID 1868 wrote to memory of 3456 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 78 PID 1868 wrote to memory of 788 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 8 PID 1868 wrote to memory of 792 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 9 PID 1868 wrote to memory of 372 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 13 PID 1868 wrote to memory of 2940 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 50 PID 1868 wrote to memory of 3052 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 51 PID 1868 wrote to memory of 1108 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 53 PID 1868 wrote to memory of 3436 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 56 PID 1868 wrote to memory of 3560 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 57 PID 1868 wrote to memory of 3748 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 58 PID 1868 wrote to memory of 3836 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 59 PID 1868 wrote to memory of 3900 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 60 PID 1868 wrote to memory of 3984 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 61 PID 1868 wrote to memory of 3872 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 62 PID 1868 wrote to memory of 5016 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 75 PID 1868 wrote to memory of 880 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 76 PID 1868 wrote to memory of 3064 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 77 PID 1868 wrote to memory of 3456 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 78 PID 1868 wrote to memory of 2280 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 88 PID 1868 wrote to memory of 2280 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 88 PID 1868 wrote to memory of 2280 1868 f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe 88 PID 2280 wrote to memory of 788 2280 voujyk.exe 8 PID 2280 wrote to memory of 792 2280 voujyk.exe 9 PID 2280 wrote to memory of 372 2280 voujyk.exe 13 PID 2280 wrote to memory of 2940 2280 voujyk.exe 50 PID 2280 wrote to memory of 3052 2280 voujyk.exe 51 PID 2280 wrote to memory of 1108 2280 voujyk.exe 53 PID 2280 wrote to memory of 3436 2280 voujyk.exe 56 PID 2280 wrote to memory of 3560 2280 voujyk.exe 57 PID 2280 wrote to memory of 3748 2280 voujyk.exe 58 PID 2280 wrote to memory of 3836 2280 voujyk.exe 59 PID 2280 wrote to memory of 3900 2280 voujyk.exe 60 PID 2280 wrote to memory of 3984 2280 voujyk.exe 61 PID 2280 wrote to memory of 3872 2280 voujyk.exe 62 PID 2280 wrote to memory of 5016 2280 voujyk.exe 75 PID 2280 wrote to memory of 880 2280 voujyk.exe 76 PID 2280 wrote to memory of 788 2280 voujyk.exe 8 PID 2280 wrote to memory of 792 2280 voujyk.exe 9 PID 2280 wrote to memory of 372 2280 voujyk.exe 13 PID 2280 wrote to memory of 2940 2280 voujyk.exe 50 PID 2280 wrote to memory of 3052 2280 voujyk.exe 51 PID 2280 wrote to memory of 1108 2280 voujyk.exe 53 PID 2280 wrote to memory of 3436 2280 voujyk.exe 56 PID 2280 wrote to memory of 3560 2280 voujyk.exe 57 PID 2280 wrote to memory of 3748 2280 voujyk.exe 58 PID 2280 wrote to memory of 3836 2280 voujyk.exe 59 PID 2280 wrote to memory of 3900 2280 voujyk.exe 60 PID 2280 wrote to memory of 3984 2280 voujyk.exe 61 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" voujyk.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:372
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2940
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3052
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:1108
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f8e4401dff213d69435c8a4c95a5deea_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1868 -
C:\Users\Admin\AppData\Roaming\Microsoft\voujyk.exeC:\Users\Admin\AppData\Roaming\Microsoft\voujyk.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2280
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3560
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3748
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3836
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3900
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3984
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3872
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:5016
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:880
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3064
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3456
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
369KB
MD5f8e4401dff213d69435c8a4c95a5deea
SHA1ac46f81e1385154221a02174c2a284eb858cf48b
SHA256ceba6ad4b778705c6fc2a4a968b93c5da232a3c545cf0e62bacc624c7f674b5c
SHA5126c815cd96e88749c1753187d3c433388e6086fb653f7b8c827e7d371426dba4b3667419651417589ebc9e72b40e85c9d58608ed65c1abe756c316ed83cfa7156
-
Filesize
257B
MD51f1a8155ce274c809395143cafddf7de
SHA1b2881b479fc0cec64ee33765afb525f8befbdc82
SHA256f637924401ec9fe9a6e783c09bbd58726b8230dbb99738e3af3c782db9af12d4
SHA5126d57c6643d3902f463729d6b86d59e07c35598d20971d7c7d5fde5a3d11fc8535eeee9983faede39eb74b57d91f668132d18f5026a0209da0e2f3e61dfc3a9ae