Analysis
-
max time kernel
147s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-02-2025 01:35
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe
Resource
win10v2004-20250207-en
General
-
Target
JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe
-
Size
296KB
-
MD5
bd9a4982152eb218a8b9edd5f211bf57
-
SHA1
ef587b7e183fc8dbb0efc2b6af5840b7c0aa5a37
-
SHA256
bd3df722b744ebf821ffdd313310c5071266c692ec3211dbda62b9f61c5b1e22
-
SHA512
74e1bd930acba3f18930cb6e1fcd80a49e5999f34a4ec21ae02ea123a90c0f749bd60ad0047671a05de19bcee20beae5aacfa86d1dd519f7ea627214ba3dce31
-
SSDEEP
3072:RQL/bCrWIPe5uL7YK+sEAAKuohJb69AOnxc/vnGDFca3:RQL/bCrT9+fAYoPb69AOnCWR
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe -
Sality family
-
UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe -
Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe -
Disables Task Manager via registry modification
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe -
Executes dropped EXE 2 IoCs
pid Process 2760 cssrs.exe 2836 cssrs.exe -
Loads dropped DLL 4 IoCs
pid Process 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe -
Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TINTIMG = "C:\\Users\\Admin\\AppData\\Roaming\\cssrs.exe" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe -
Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened (read-only) \??\Y: JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened (read-only) \??\E: JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened (read-only) \??\G: JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened (read-only) \??\N: JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened (read-only) \??\P: JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened (read-only) \??\S: JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened (read-only) \??\I: JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened (read-only) \??\M: JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened (read-only) \??\O: JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened (read-only) \??\T: JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened (read-only) \??\V: JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened (read-only) \??\Z: JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened (read-only) \??\K: JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened (read-only) \??\L: JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened (read-only) \??\R: JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened (read-only) \??\U: JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened (read-only) \??\W: JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened (read-only) \??\H: JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened (read-only) \??\J: JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened (read-only) \??\Q: JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened for modification F:\autorun.inf JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe -
resource yara_rule behavioral1/memory/2172-1-0x0000000001D90000-0x0000000002E1E000-memory.dmp upx behavioral1/memory/2172-4-0x0000000001D90000-0x0000000002E1E000-memory.dmp upx behavioral1/memory/2172-5-0x0000000001D90000-0x0000000002E1E000-memory.dmp upx behavioral1/memory/2172-6-0x0000000001D90000-0x0000000002E1E000-memory.dmp upx behavioral1/memory/2172-7-0x0000000001D90000-0x0000000002E1E000-memory.dmp upx behavioral1/memory/2172-3-0x0000000001D90000-0x0000000002E1E000-memory.dmp upx behavioral1/memory/2172-13-0x0000000001D90000-0x0000000002E1E000-memory.dmp upx behavioral1/memory/2172-12-0x0000000001D90000-0x0000000002E1E000-memory.dmp upx behavioral1/memory/2172-14-0x0000000001D90000-0x0000000002E1E000-memory.dmp upx behavioral1/memory/2172-60-0x0000000001D90000-0x0000000002E1E000-memory.dmp upx behavioral1/memory/2172-61-0x0000000001D90000-0x0000000002E1E000-memory.dmp upx behavioral1/memory/2172-62-0x0000000001D90000-0x0000000002E1E000-memory.dmp upx behavioral1/memory/2172-63-0x0000000001D90000-0x0000000002E1E000-memory.dmp upx behavioral1/memory/2172-64-0x0000000001D90000-0x0000000002E1E000-memory.dmp upx behavioral1/memory/2172-67-0x0000000001D90000-0x0000000002E1E000-memory.dmp upx behavioral1/memory/2172-68-0x0000000001D90000-0x0000000002E1E000-memory.dmp upx behavioral1/memory/2172-69-0x0000000001D90000-0x0000000002E1E000-memory.dmp upx behavioral1/memory/2172-71-0x0000000001D90000-0x0000000002E1E000-memory.dmp upx behavioral1/memory/2172-73-0x0000000001D90000-0x0000000002E1E000-memory.dmp upx behavioral1/memory/2172-76-0x0000000001D90000-0x0000000002E1E000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cssrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cssrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\AboutURLs\blank = "http://www.114116.info" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs\Tabs = "http://www.114116.info" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\AboutURLs\Tabs = "http://www.114116.info" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://www.114116.info" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\AboutURLs JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs\blank = "http://www.114116.info" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\AboutURLs JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.114116.info" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.114116.info" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.114116.info" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.exe JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2760 cssrs.exe 2760 cssrs.exe 2836 cssrs.exe 2836 cssrs.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2836 cssrs.exe 2836 cssrs.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2836 cssrs.exe 2836 cssrs.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2836 cssrs.exe 2836 cssrs.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2836 cssrs.exe 2836 cssrs.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2836 cssrs.exe 2836 cssrs.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2836 cssrs.exe 2836 cssrs.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2836 cssrs.exe 2836 cssrs.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2836 cssrs.exe 2836 cssrs.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2836 cssrs.exe 2836 cssrs.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2836 cssrs.exe 2836 cssrs.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe Token: SeDebugPrivilege 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2172 wrote to memory of 1108 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 19 PID 2172 wrote to memory of 1172 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 20 PID 2172 wrote to memory of 1196 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 21 PID 2172 wrote to memory of 1636 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 25 PID 2172 wrote to memory of 2760 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 31 PID 2172 wrote to memory of 2760 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 31 PID 2172 wrote to memory of 2760 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 31 PID 2172 wrote to memory of 2760 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 31 PID 2172 wrote to memory of 2836 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 32 PID 2172 wrote to memory of 2836 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 32 PID 2172 wrote to memory of 2836 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 32 PID 2172 wrote to memory of 2836 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 32 PID 2172 wrote to memory of 1108 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 19 PID 2172 wrote to memory of 1172 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 20 PID 2172 wrote to memory of 1196 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 21 PID 2172 wrote to memory of 1636 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 25 PID 2172 wrote to memory of 2760 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 31 PID 2172 wrote to memory of 2760 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 31 PID 2172 wrote to memory of 2836 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 32 PID 2172 wrote to memory of 2836 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 32 PID 2172 wrote to memory of 1108 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 19 PID 2172 wrote to memory of 1172 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 20 PID 2172 wrote to memory of 1196 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 21 PID 2172 wrote to memory of 1636 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 25 PID 2172 wrote to memory of 1108 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 19 PID 2172 wrote to memory of 1172 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 20 PID 2172 wrote to memory of 1196 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 21 PID 2172 wrote to memory of 1636 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 25 PID 2172 wrote to memory of 1108 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 19 PID 2172 wrote to memory of 1172 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 20 PID 2172 wrote to memory of 1196 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 21 PID 2172 wrote to memory of 1636 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 25 PID 2172 wrote to memory of 1108 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 19 PID 2172 wrote to memory of 1172 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 20 PID 2172 wrote to memory of 1196 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 21 PID 2172 wrote to memory of 1636 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 25 PID 2172 wrote to memory of 1108 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 19 PID 2172 wrote to memory of 1172 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 20 PID 2172 wrote to memory of 1196 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 21 PID 2172 wrote to memory of 1636 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 25 PID 2172 wrote to memory of 1108 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 19 PID 2172 wrote to memory of 1172 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 20 PID 2172 wrote to memory of 1196 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 21 PID 2172 wrote to memory of 1636 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 25 PID 2172 wrote to memory of 1108 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 19 PID 2172 wrote to memory of 1172 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 20 PID 2172 wrote to memory of 1196 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 21 PID 2172 wrote to memory of 1636 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 25 PID 2172 wrote to memory of 1108 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 19 PID 2172 wrote to memory of 1172 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 20 PID 2172 wrote to memory of 1196 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 21 PID 2172 wrote to memory of 1636 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 25 PID 2172 wrote to memory of 1108 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 19 PID 2172 wrote to memory of 1172 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 20 PID 2172 wrote to memory of 1196 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 21 PID 2172 wrote to memory of 1636 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 25 PID 2172 wrote to memory of 1108 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 19 PID 2172 wrote to memory of 1172 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 20 PID 2172 wrote to memory of 1196 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 21 PID 2172 wrote to memory of 1636 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 25 PID 2172 wrote to memory of 1108 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 19 PID 2172 wrote to memory of 1172 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 20 PID 2172 wrote to memory of 1196 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 21 PID 2172 wrote to memory of 1636 2172 JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe 25 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd9a4982152eb218a8b9edd5f211bf57.exe"2⤵
- Modifies firewall policy service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Drops startup file
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2172 -
C:\Users\Admin\AppData\Roaming\cssrs.exeC:\Users\Admin\AppData\Roaming\cssrs.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2760
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2836
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1636
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
10Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD59bde9702ccb28c3749e042e93cdbfb6b
SHA1161e2e5981ef960a5345c5e64188b3294b2e5592
SHA256e12693f934a8da01783010eed4cfae987c31ef3d4d65f6ff892140275f814bf5
SHA5123d4f7daaefd9adf17d179a57b91a3d8718743c346cc2a70b6a7e551fbd217c108120cd8f444b8653000b63bb75298a29c890e9ad71236689811a20b8780a6553
-
Filesize
296KB
MD5bd9a4982152eb218a8b9edd5f211bf57
SHA1ef587b7e183fc8dbb0efc2b6af5840b7c0aa5a37
SHA256bd3df722b744ebf821ffdd313310c5071266c692ec3211dbda62b9f61c5b1e22
SHA51274e1bd930acba3f18930cb6e1fcd80a49e5999f34a4ec21ae02ea123a90c0f749bd60ad0047671a05de19bcee20beae5aacfa86d1dd519f7ea627214ba3dce31
-
Filesize
100KB
MD57739f453b6ec826833d026c2b0c9ffdf
SHA1df4b665fab1246c6197a720ba2bbdf8fe9075110
SHA25661849ae26c62d59c26a2cd41286afd66f51e4281dc491b649d9c25f9a1d5a597
SHA512a5cba9d8979980a29841a308fc4da984adade32a6f62a4809cc0a1192b8dd7a769d101989d728d8a64cba54047e2f9367b1c0fa1230c808c07f3a2873ac753cb