Analysis
-
max time kernel
25s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
07-02-2025 06:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
22 signatures
150 seconds
General
-
Target
JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe
-
Size
282KB
-
MD5
b3e1ae9fe1b23a753b8c47a95a72cf87
-
SHA1
39a50ae818bd076bf904c8a9043b318ad335bfbb
-
SHA256
7cf978cfdc2741c4defb2caefa30f53f2314585619044211eaa588921e88097b
-
SHA512
98754682bb6bdc816e2c8e6e7f7028409c3fde1dd918eefbebd1aef2f177babb337fb9db5530725446d00fab154fe556a2a1513def7498fd7d104045c7b6645c
-
SSDEEP
3072:Cpw+IEitDzUKwCX0k0DJVxPoUNHGN850T6W:2ME88HDPNyT
Malware Config
Extracted
Credentials
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Sality family
-
UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" jusched.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe -
Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" jusched.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" jusched.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" jusched.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" jusched.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" jusched.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" jusched.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Set value (int) \REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" jusched.exe -
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 4456 netsh.exe 4028 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000\Control Panel\International\Geo\Nation JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe -
Deletes itself 1 IoCs
pid Process 1076 jusched.exe -
Executes dropped EXE 1 IoCs
pid Process 1076 jusched.exe -
Windows security modification 2 TTPs 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc jusched.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" jusched.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" jusched.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" jusched.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" jusched.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" jusched.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" jusched.exe -
Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" jusched.exe -
resource yara_rule behavioral2/memory/2808-1-0x0000000000780000-0x00000000017B3000-memory.dmp upx behavioral2/memory/2808-3-0x0000000000780000-0x00000000017B3000-memory.dmp upx behavioral2/memory/2808-5-0x0000000000780000-0x00000000017B3000-memory.dmp upx behavioral2/memory/2808-18-0x0000000000780000-0x00000000017B3000-memory.dmp upx behavioral2/memory/2808-20-0x0000000000780000-0x00000000017B3000-memory.dmp upx behavioral2/memory/1076-50-0x0000000002960000-0x0000000003993000-memory.dmp upx behavioral2/memory/1076-52-0x0000000002960000-0x0000000003993000-memory.dmp upx behavioral2/memory/1076-64-0x0000000002960000-0x0000000003993000-memory.dmp upx behavioral2/memory/1076-70-0x0000000002960000-0x0000000003993000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe jusched.exe File created C:\Program Files (x86)\11ae7a46\jusched.exe JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe File created C:\Program Files (x86)\11ae7a46\11ae7a46 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe 1076 jusched.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Token: SeDebugPrivilege 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2808 wrote to memory of 4456 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 84 PID 2808 wrote to memory of 4456 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 84 PID 2808 wrote to memory of 4456 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 84 PID 2808 wrote to memory of 780 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 8 PID 2808 wrote to memory of 788 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 9 PID 2808 wrote to memory of 332 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 13 PID 2808 wrote to memory of 2760 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 49 PID 2808 wrote to memory of 2820 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 50 PID 2808 wrote to memory of 3036 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 52 PID 2808 wrote to memory of 3424 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 56 PID 2808 wrote to memory of 3532 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 57 PID 2808 wrote to memory of 3716 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 58 PID 2808 wrote to memory of 3812 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 59 PID 2808 wrote to memory of 3880 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 60 PID 2808 wrote to memory of 3956 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 61 PID 2808 wrote to memory of 3576 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 62 PID 2808 wrote to memory of 1016 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 75 PID 2808 wrote to memory of 4552 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 76 PID 2808 wrote to memory of 1592 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 81 PID 2808 wrote to memory of 3652 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 82 PID 2808 wrote to memory of 4456 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 84 PID 2808 wrote to memory of 4456 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 84 PID 2808 wrote to memory of 3808 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 85 PID 2808 wrote to memory of 1076 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 89 PID 2808 wrote to memory of 1076 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 89 PID 2808 wrote to memory of 1076 2808 JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe 89 PID 1076 wrote to memory of 4028 1076 jusched.exe 95 PID 1076 wrote to memory of 4028 1076 jusched.exe 95 PID 1076 wrote to memory of 4028 1076 jusched.exe 95 PID 1076 wrote to memory of 780 1076 jusched.exe 8 PID 1076 wrote to memory of 788 1076 jusched.exe 9 PID 1076 wrote to memory of 332 1076 jusched.exe 13 PID 1076 wrote to memory of 2760 1076 jusched.exe 49 PID 1076 wrote to memory of 2820 1076 jusched.exe 50 PID 1076 wrote to memory of 3036 1076 jusched.exe 52 PID 1076 wrote to memory of 3424 1076 jusched.exe 56 PID 1076 wrote to memory of 3532 1076 jusched.exe 57 PID 1076 wrote to memory of 3716 1076 jusched.exe 58 PID 1076 wrote to memory of 3812 1076 jusched.exe 59 PID 1076 wrote to memory of 3880 1076 jusched.exe 60 PID 1076 wrote to memory of 3956 1076 jusched.exe 61 PID 1076 wrote to memory of 3576 1076 jusched.exe 62 PID 1076 wrote to memory of 1016 1076 jusched.exe 75 PID 1076 wrote to memory of 4552 1076 jusched.exe 76 PID 1076 wrote to memory of 3652 1076 jusched.exe 82 PID 1076 wrote to memory of 2992 1076 jusched.exe 87 PID 1076 wrote to memory of 1656 1076 jusched.exe 88 PID 1076 wrote to memory of 4028 1076 jusched.exe 95 PID 1076 wrote to memory of 4028 1076 jusched.exe 95 PID 1076 wrote to memory of 780 1076 jusched.exe 8 PID 1076 wrote to memory of 788 1076 jusched.exe 9 PID 1076 wrote to memory of 332 1076 jusched.exe 13 PID 1076 wrote to memory of 2760 1076 jusched.exe 49 PID 1076 wrote to memory of 2820 1076 jusched.exe 50 PID 1076 wrote to memory of 3036 1076 jusched.exe 52 PID 1076 wrote to memory of 3424 1076 jusched.exe 56 PID 1076 wrote to memory of 3532 1076 jusched.exe 57 PID 1076 wrote to memory of 3716 1076 jusched.exe 58 PID 1076 wrote to memory of 3812 1076 jusched.exe 59 PID 1076 wrote to memory of 3880 1076 jusched.exe 60 PID 1076 wrote to memory of 3956 1076 jusched.exe 61 PID 1076 wrote to memory of 3576 1076 jusched.exe 62 PID 1076 wrote to memory of 1016 1076 jusched.exe 75 PID 1076 wrote to memory of 4552 1076 jusched.exe 76 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" jusched.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:332
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2760
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2820
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3036
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b3e1ae9fe1b23a753b8c47a95a72cf87.exe"2⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2808 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4456 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:3808
-
-
-
C:\Program Files (x86)\11ae7a46\jusched.exe"C:\Program Files (x86)\11ae7a46\jusched.exe"3⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1076 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4028
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3532
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3716
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3812
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3880
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3956
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3576
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1016
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4552
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1592
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:3652
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2992
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1656
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5f253efe302d32ab264a76e0ce65be769
SHA1768685ca582abd0af2fbb57ca37752aa98c9372b
SHA25649dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
SHA5121990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
-
Filesize
282KB
MD53a702a074d5e202a6e440848e0f9030c
SHA14efc3b1a6991be6ac6faa3ea216f37602c480555
SHA2561837c9f924ddd4d29600be0d0ec1871a00a0f4c9db0b1466a8f1fbb85798a896
SHA5129cb72b65dfa1ce5d02df1d910c8adee751f1ba7914b190d61b35f772b9b613113b39926b877cfb226cf561912c0083308ac0e501616641b3b6ca05b0f3504e35
-
Filesize
258B
MD5c962fa4d09c1b9c2a9b469f5eafd59a4
SHA13e4c4d48f4be21c823426ab3a506e5895b0507e6
SHA2561b3d13498c4c9adab491bd5b7236029a7387a44be906408f52ae711fcbbffaf6
SHA512f43f3d80c3f208006396eee003d13bcdd017e903e4f5becb0bbfb01f2708cce09bfdf852dadec2bf0caf7146c14079f29137f6247f5f5e44c3430312cdf0a3f3