Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/01/2025, 12:40
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe
Resource
win10v2004-20250129-en
General
-
Target
JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe
-
Size
180KB
-
MD5
6a4534d55b16e33e76242c55eb6081c6
-
SHA1
62af58275a49062511dfa9eb702af4273e7c3336
-
SHA256
f01c2ded4c1a9924d31e1f3d8e3911863cefe22110cbbffc838e8a097539cd21
-
SHA512
d771a39e3fccbcc42fb83ca4fa1b3b36552cdc40095af6c82c83cfcd8af8f7ef8670b9598b79fda80a2f76e8a6faf040f45b6f61c7839f54dfdff0fd366e2e44
-
SSDEEP
3072:hnUyL7hUEhT5/atC/87CyZARCbU7TrNZl3nTu10:NUhEP/ACE7CEsx7dX3T3
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe -
Sality family
-
UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe -
Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe -
Disables Task Manager via registry modification
-
Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Explorer = "C:\\Windows\\Windows Explorer.exe" JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe -
Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe -
resource yara_rule behavioral1/memory/2780-6-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-8-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-3-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-7-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-9-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-5-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-4-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-11-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-10-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-15-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-14-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-31-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-38-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-39-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-40-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-42-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-45-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-44-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-47-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-51-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-50-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-55-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-56-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-58-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-77-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-79-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral1/memory/2780-81-0x0000000002580000-0x000000000360E000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\BCSSYNC.EXE JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe File created C:\Windows\Windows Explorer.exe JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe File opened for modification C:\Windows\Windows Explorer.exe JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe File opened for modification C:\WINDOWS\WINDOWS EXPLORER.EXE JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Explorer.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe Token: SeDebugPrivilege 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2780 wrote to memory of 2496 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 31 PID 2780 wrote to memory of 2496 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 31 PID 2780 wrote to memory of 2496 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 31 PID 2780 wrote to memory of 2496 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 31 PID 2780 wrote to memory of 1120 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 19 PID 2780 wrote to memory of 1172 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 20 PID 2780 wrote to memory of 1220 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 21 PID 2780 wrote to memory of 1200 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 23 PID 2780 wrote to memory of 1120 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 19 PID 2780 wrote to memory of 1172 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 20 PID 2780 wrote to memory of 1220 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 21 PID 2780 wrote to memory of 1200 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 23 PID 2780 wrote to memory of 1120 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 19 PID 2780 wrote to memory of 1172 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 20 PID 2780 wrote to memory of 1220 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 21 PID 2780 wrote to memory of 1200 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 23 PID 2780 wrote to memory of 1120 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 19 PID 2780 wrote to memory of 1172 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 20 PID 2780 wrote to memory of 1220 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 21 PID 2780 wrote to memory of 1200 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 23 PID 2780 wrote to memory of 1120 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 19 PID 2780 wrote to memory of 1172 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 20 PID 2780 wrote to memory of 1220 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 21 PID 2780 wrote to memory of 1200 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 23 PID 2780 wrote to memory of 1120 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 19 PID 2780 wrote to memory of 1172 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 20 PID 2780 wrote to memory of 1220 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 21 PID 2780 wrote to memory of 1200 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 23 PID 2780 wrote to memory of 1120 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 19 PID 2780 wrote to memory of 1172 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 20 PID 2780 wrote to memory of 1220 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 21 PID 2780 wrote to memory of 1200 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 23 PID 2780 wrote to memory of 1120 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 19 PID 2780 wrote to memory of 1172 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 20 PID 2780 wrote to memory of 1220 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 21 PID 2780 wrote to memory of 1200 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 23 PID 2780 wrote to memory of 1120 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 19 PID 2780 wrote to memory of 1172 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 20 PID 2780 wrote to memory of 1220 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 21 PID 2780 wrote to memory of 1200 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 23 PID 2780 wrote to memory of 1120 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 19 PID 2780 wrote to memory of 1172 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 20 PID 2780 wrote to memory of 1220 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 21 PID 2780 wrote to memory of 1200 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 23 PID 2780 wrote to memory of 1120 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 19 PID 2780 wrote to memory of 1172 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 20 PID 2780 wrote to memory of 1220 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 21 PID 2780 wrote to memory of 1200 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 23 PID 2780 wrote to memory of 1120 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 19 PID 2780 wrote to memory of 1172 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 20 PID 2780 wrote to memory of 1220 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 21 PID 2780 wrote to memory of 1200 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 23 PID 2780 wrote to memory of 1120 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 19 PID 2780 wrote to memory of 1172 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 20 PID 2780 wrote to memory of 1220 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 21 PID 2780 wrote to memory of 1200 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 23 PID 2780 wrote to memory of 1120 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 19 PID 2780 wrote to memory of 1172 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 20 PID 2780 wrote to memory of 1220 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 21 PID 2780 wrote to memory of 1200 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 23 PID 2780 wrote to memory of 1120 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 19 PID 2780 wrote to memory of 1172 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 20 PID 2780 wrote to memory of 1220 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 21 PID 2780 wrote to memory of 1200 2780 JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe 23 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1120
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe"2⤵
- Modifies firewall policy service
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2780 -
C:\Windows\SysWOW64\Explorer.exeExplorer3⤵
- System Location Discovery: System Language Discovery
PID:2496
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1200
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD56a4534d55b16e33e76242c55eb6081c6
SHA162af58275a49062511dfa9eb702af4273e7c3336
SHA256f01c2ded4c1a9924d31e1f3d8e3911863cefe22110cbbffc838e8a097539cd21
SHA512d771a39e3fccbcc42fb83ca4fa1b3b36552cdc40095af6c82c83cfcd8af8f7ef8670b9598b79fda80a2f76e8a6faf040f45b6f61c7839f54dfdff0fd366e2e44