Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-01-2025 20:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe
Resource
win7-20240903-en
windows7-x64
24 signatures
150 seconds
General
-
Target
JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe
-
Size
160KB
-
MD5
67f7f42b6afc0a1c6406f376e3b84320
-
SHA1
415f8ae10bbe301c20adb03c7e058725e926fa73
-
SHA256
5968cc9cf000bc3de800e8f24f052835c05b82104d8297a7ad2902bad8dc7860
-
SHA512
cdb8c4a7444942d452e279d9faec4198b7323b6781332420e962828216cc3066d6199351bb65a87cba7ee751700e339c3caae18c9ccaff1093a42f623d387e98
-
SSDEEP
3072:pnxwgxgfR/DVG7wBpEEP06nHBBOf/xyz8Wm6lTiWvMUfN0a:p+xDVG0BpHvMhWxdim/VD
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe -
Ramnit family
-
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 2764 WaterMark.exe -
Loads dropped DLL 2 IoCs
pid Process 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
resource yara_rule behavioral1/memory/2428-5-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2428-1-0x00000000027B0000-0x000000000383E000-memory.dmp upx behavioral1/memory/2428-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2428-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2428-4-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2428-16-0x00000000027B0000-0x000000000383E000-memory.dmp upx behavioral1/memory/2428-17-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2428-3-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2428-2-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2428-10-0x00000000027B0000-0x000000000383E000-memory.dmp upx behavioral1/memory/2428-15-0x00000000027B0000-0x000000000383E000-memory.dmp upx behavioral1/memory/2428-11-0x00000000027B0000-0x000000000383E000-memory.dmp upx behavioral1/memory/2428-12-0x00000000027B0000-0x000000000383E000-memory.dmp upx behavioral1/memory/2428-21-0x00000000027B0000-0x000000000383E000-memory.dmp upx behavioral1/memory/2428-20-0x00000000027B0000-0x000000000383E000-memory.dmp upx behavioral1/memory/2428-19-0x00000000027B0000-0x000000000383E000-memory.dmp upx behavioral1/memory/2428-14-0x00000000027B0000-0x000000000383E000-memory.dmp upx behavioral1/memory/2428-61-0x00000000027B0000-0x000000000383E000-memory.dmp upx behavioral1/memory/2764-66-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2764-113-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\cpu.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\AiodLite.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEXBE.DLL svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\picturePuzzle.html svchost.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe svchost.exe File opened for modification C:\Program Files\Internet Explorer\ieproxy.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\dtplugin\deployJava1.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_sse2_plugin.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7zG.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Design.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libball_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MAPISHELLR.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libsap_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jpeg.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_avi_plugin.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-locale-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\calendar.html svchost.exe File opened for modification C:\Program Files\7-Zip\7z.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libparam_eq_plugin.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libdtv_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libvobsub_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\settings.html svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\settings.html svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\settings.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe svchost.exe File opened for modification C:\Program Files\Internet Explorer\jsdbgui.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libkaraoke_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\calendar.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\RSSFeeds.html svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2native.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Design.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libnoseek_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe svchost.exe File opened for modification C:\Program Files\Windows Photo Viewer\PhotoAcq.dll svchost.exe File opened for modification C:\Program Files\Windows Portable Devices\sqmapi.dll svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCore.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libaribsub_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_standard_plugin.dll svchost.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe -
Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe 2764 WaterMark.exe 2764 WaterMark.exe 2764 WaterMark.exe 2764 WaterMark.exe 2764 WaterMark.exe 2764 WaterMark.exe 2764 WaterMark.exe 2764 WaterMark.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe 748 svchost.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Token: SeDebugPrivilege 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Token: SeDebugPrivilege 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Token: SeDebugPrivilege 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Token: SeDebugPrivilege 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Token: SeDebugPrivilege 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Token: SeDebugPrivilege 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Token: SeDebugPrivilege 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Token: SeDebugPrivilege 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Token: SeDebugPrivilege 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Token: SeDebugPrivilege 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Token: SeDebugPrivilege 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Token: SeDebugPrivilege 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Token: SeDebugPrivilege 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Token: SeDebugPrivilege 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Token: SeDebugPrivilege 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Token: SeDebugPrivilege 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Token: SeDebugPrivilege 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Token: SeDebugPrivilege 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Token: SeDebugPrivilege 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe Token: SeDebugPrivilege 2764 WaterMark.exe Token: SeDebugPrivilege 748 svchost.exe Token: SeDebugPrivilege 2764 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe 2764 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2428 wrote to memory of 1120 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe 19 PID 2428 wrote to memory of 1164 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe 20 PID 2428 wrote to memory of 1200 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe 21 PID 2428 wrote to memory of 1624 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe 23 PID 2428 wrote to memory of 2764 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe 28 PID 2428 wrote to memory of 2764 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe 28 PID 2428 wrote to memory of 2764 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe 28 PID 2428 wrote to memory of 2764 2428 JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe 28 PID 2764 wrote to memory of 2044 2764 WaterMark.exe 29 PID 2764 wrote to memory of 2044 2764 WaterMark.exe 29 PID 2764 wrote to memory of 2044 2764 WaterMark.exe 29 PID 2764 wrote to memory of 2044 2764 WaterMark.exe 29 PID 2764 wrote to memory of 2044 2764 WaterMark.exe 29 PID 2764 wrote to memory of 2044 2764 WaterMark.exe 29 PID 2764 wrote to memory of 2044 2764 WaterMark.exe 29 PID 2764 wrote to memory of 2044 2764 WaterMark.exe 29 PID 2764 wrote to memory of 2044 2764 WaterMark.exe 29 PID 2764 wrote to memory of 2044 2764 WaterMark.exe 29 PID 2764 wrote to memory of 748 2764 WaterMark.exe 30 PID 2764 wrote to memory of 748 2764 WaterMark.exe 30 PID 2764 wrote to memory of 748 2764 WaterMark.exe 30 PID 2764 wrote to memory of 748 2764 WaterMark.exe 30 PID 2764 wrote to memory of 748 2764 WaterMark.exe 30 PID 2764 wrote to memory of 748 2764 WaterMark.exe 30 PID 2764 wrote to memory of 748 2764 WaterMark.exe 30 PID 2764 wrote to memory of 748 2764 WaterMark.exe 30 PID 2764 wrote to memory of 748 2764 WaterMark.exe 30 PID 2764 wrote to memory of 748 2764 WaterMark.exe 30 PID 748 wrote to memory of 256 748 svchost.exe 1 PID 748 wrote to memory of 256 748 svchost.exe 1 PID 748 wrote to memory of 256 748 svchost.exe 1 PID 748 wrote to memory of 256 748 svchost.exe 1 PID 748 wrote to memory of 256 748 svchost.exe 1 PID 748 wrote to memory of 336 748 svchost.exe 2 PID 748 wrote to memory of 336 748 svchost.exe 2 PID 748 wrote to memory of 336 748 svchost.exe 2 PID 748 wrote to memory of 336 748 svchost.exe 2 PID 748 wrote to memory of 336 748 svchost.exe 2 PID 748 wrote to memory of 384 748 svchost.exe 3 PID 748 wrote to memory of 384 748 svchost.exe 3 PID 748 wrote to memory of 384 748 svchost.exe 3 PID 748 wrote to memory of 384 748 svchost.exe 3 PID 748 wrote to memory of 384 748 svchost.exe 3 PID 748 wrote to memory of 396 748 svchost.exe 4 PID 748 wrote to memory of 396 748 svchost.exe 4 PID 748 wrote to memory of 396 748 svchost.exe 4 PID 748 wrote to memory of 396 748 svchost.exe 4 PID 748 wrote to memory of 396 748 svchost.exe 4 PID 748 wrote to memory of 432 748 svchost.exe 5 PID 748 wrote to memory of 432 748 svchost.exe 5 PID 748 wrote to memory of 432 748 svchost.exe 5 PID 748 wrote to memory of 432 748 svchost.exe 5 PID 748 wrote to memory of 432 748 svchost.exe 5 PID 748 wrote to memory of 476 748 svchost.exe 6 PID 748 wrote to memory of 476 748 svchost.exe 6 PID 748 wrote to memory of 476 748 svchost.exe 6 PID 748 wrote to memory of 476 748 svchost.exe 6 PID 748 wrote to memory of 476 748 svchost.exe 6 PID 748 wrote to memory of 492 748 svchost.exe 7 PID 748 wrote to memory of 492 748 svchost.exe 7 PID 748 wrote to memory of 492 748 svchost.exe 7 PID 748 wrote to memory of 492 748 svchost.exe 7 PID 748 wrote to memory of 492 748 svchost.exe 7 PID 748 wrote to memory of 500 748 svchost.exe 8 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:256
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:336
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:608
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1624
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵PID:2524
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:684
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:756
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:824
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1164
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:864
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵PID:2780
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:976
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:268
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:352
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1072
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1120
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2116
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2996
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:396
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_67f7f42b6afc0a1c6406f376e3b84320.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2428 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2044
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
MD567f7f42b6afc0a1c6406f376e3b84320
SHA1415f8ae10bbe301c20adb03c7e058725e926fa73
SHA2565968cc9cf000bc3de800e8f24f052835c05b82104d8297a7ad2902bad8dc7860
SHA512cdb8c4a7444942d452e279d9faec4198b7323b6781332420e962828216cc3066d6199351bb65a87cba7ee751700e339c3caae18c9ccaff1093a42f623d387e98
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize335KB
MD55ab7e5424c114a845eba771294dda345
SHA1def0db31dd6dcffa5e04ad30d83fc402e7a832f8
SHA256eb91538303e75058aab1cb0a1580bebb118b3cc4a51bfd76dfdefdfcb49f2dc0
SHA51269b9d0fd0aa3cc1efb693bd026c5afd55890e99799de11e6f19ae78f9a61a8bacb980a86dbe6c6b89d48b550e5d45bd0d4e9385150228b7bb90c8de1470cfd5f
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize331KB
MD56b0f75ab326f5be008f5424bcdd688fb
SHA11520b619e582d0c36cebd64ca81f31781a2becdd
SHA2560a9d754a2faf770505ae77e3fb6639bacffb72bca9c95b159948c3ab00066e7a
SHA512ddbd7bc977ffefb4c85a09c14a99b4a2c1161e20f2d576aef4c98d217ec486b2b09b0bbd5417d8a09893cf7f7307716c6a54c77021045d6d638263f88f1ce2ee