Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 07:57
Static task
static1
Behavioral task
behavioral1
Sample
1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe
-
Size
502KB
-
MD5
1a846bcdaf37342e5fac5baef98e9ae9
-
SHA1
e3d37c757d9b50c3a06f66df4803c7a5091d909a
-
SHA256
155e07495229f1426dfaaf45e794afe2bbd7fda7f6b9e467e0449ae8961ea8e7
-
SHA512
82199e252dc1f5e3d53c7db41a3f47ccac9302bd35e02b7061470f3420e07026f8a44419e57c47645f52599215603f9346e0de444d7746b2a086da0e266cea8e
-
SSDEEP
6144:jmDI1LnqsuP1yMpSKHaqyQXSEpSC5Rdh/vGsztc5K6AT:d5qJoMwqLZhflztc5K6AT
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe -
Processes:
1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe -
Processes:
1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe -
Disables Task Manager via registry modification
-
Processes:
resource yara_rule behavioral1/memory/2784-4-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-3-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-10-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-6-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-7-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-5-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-25-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-24-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-26-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-28-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-27-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-29-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-30-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-31-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-33-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-34-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-35-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-38-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-39-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-45-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-46-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-48-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-50-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-52-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-54-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-57-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-70-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-72-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-74-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-80-0x0000000001FF0000-0x000000000307E000-memory.dmp upx behavioral1/memory/2784-83-0x0000000001FF0000-0x000000000307E000-memory.dmp upx -
Processes:
1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe -
Processes:
1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exedescription ioc process File opened (read-only) \??\S: 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened (read-only) \??\V: 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened (read-only) \??\E: 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened (read-only) \??\I: 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened (read-only) \??\K: 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened (read-only) \??\M: 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened (read-only) \??\Q: 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened (read-only) \??\W: 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened (read-only) \??\G: 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened (read-only) \??\H: 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened (read-only) \??\J: 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened (read-only) \??\L: 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened (read-only) \??\N: 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened (read-only) \??\O: 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened (read-only) \??\R: 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened (read-only) \??\Z: 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened (read-only) \??\P: 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened (read-only) \??\T: 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened (read-only) \??\U: 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened (read-only) \??\X: 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened (read-only) \??\Y: 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exedescription ioc process File opened for modification C:\autorun.inf 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened for modification F:\autorun.inf 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe -
Drops file in Program Files directory 9 IoCs
Processes:
1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exedescription ioc process File opened for modification C:\PROGRAM FILES\7-ZIP\UNINSTALL.EXE 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7Z.EXE 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZFM.EXE 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZG.EXE 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
Processes:
1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe File opened for modification C:\Windows\DeskTopBird_K.ini 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exepid process 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exepid process 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe -
Suspicious behavior: MapViewOfSection 21 IoCs
Processes:
1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exepid process 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Token: SeDebugPrivilege 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Token: SeDebugPrivilege 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Token: SeDebugPrivilege 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Token: SeDebugPrivilege 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Token: SeDebugPrivilege 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Token: SeDebugPrivilege 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Token: SeDebugPrivilege 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Token: SeDebugPrivilege 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Token: SeDebugPrivilege 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Token: SeDebugPrivilege 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Token: SeDebugPrivilege 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Token: SeDebugPrivilege 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Token: SeDebugPrivilege 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Token: SeDebugPrivilege 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe Token: SeDebugPrivilege 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exepid process 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exepid process 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exedescription pid process target process PID 2784 wrote to memory of 372 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe wininit.exe PID 2784 wrote to memory of 372 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe wininit.exe PID 2784 wrote to memory of 372 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe wininit.exe PID 2784 wrote to memory of 372 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe wininit.exe PID 2784 wrote to memory of 372 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe wininit.exe PID 2784 wrote to memory of 372 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe wininit.exe PID 2784 wrote to memory of 372 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe wininit.exe PID 2784 wrote to memory of 384 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe csrss.exe PID 2784 wrote to memory of 384 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe csrss.exe PID 2784 wrote to memory of 384 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe csrss.exe PID 2784 wrote to memory of 384 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe csrss.exe PID 2784 wrote to memory of 384 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe csrss.exe PID 2784 wrote to memory of 384 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe csrss.exe PID 2784 wrote to memory of 384 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe csrss.exe PID 2784 wrote to memory of 420 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe winlogon.exe PID 2784 wrote to memory of 420 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe winlogon.exe PID 2784 wrote to memory of 420 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe winlogon.exe PID 2784 wrote to memory of 420 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe winlogon.exe PID 2784 wrote to memory of 420 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe winlogon.exe PID 2784 wrote to memory of 420 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe winlogon.exe PID 2784 wrote to memory of 420 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe winlogon.exe PID 2784 wrote to memory of 468 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe services.exe PID 2784 wrote to memory of 468 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe services.exe PID 2784 wrote to memory of 468 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe services.exe PID 2784 wrote to memory of 468 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe services.exe PID 2784 wrote to memory of 468 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe services.exe PID 2784 wrote to memory of 468 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe services.exe PID 2784 wrote to memory of 468 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe services.exe PID 2784 wrote to memory of 476 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe lsass.exe PID 2784 wrote to memory of 476 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe lsass.exe PID 2784 wrote to memory of 476 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe lsass.exe PID 2784 wrote to memory of 476 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe lsass.exe PID 2784 wrote to memory of 476 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe lsass.exe PID 2784 wrote to memory of 476 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe lsass.exe PID 2784 wrote to memory of 476 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe lsass.exe PID 2784 wrote to memory of 484 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe lsm.exe PID 2784 wrote to memory of 484 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe lsm.exe PID 2784 wrote to memory of 484 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe lsm.exe PID 2784 wrote to memory of 484 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe lsm.exe PID 2784 wrote to memory of 484 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe lsm.exe PID 2784 wrote to memory of 484 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe lsm.exe PID 2784 wrote to memory of 484 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe lsm.exe PID 2784 wrote to memory of 596 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe svchost.exe PID 2784 wrote to memory of 596 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe svchost.exe PID 2784 wrote to memory of 596 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe svchost.exe PID 2784 wrote to memory of 596 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe svchost.exe PID 2784 wrote to memory of 596 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe svchost.exe PID 2784 wrote to memory of 596 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe svchost.exe PID 2784 wrote to memory of 596 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe svchost.exe PID 2784 wrote to memory of 676 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe svchost.exe PID 2784 wrote to memory of 676 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe svchost.exe PID 2784 wrote to memory of 676 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe svchost.exe PID 2784 wrote to memory of 676 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe svchost.exe PID 2784 wrote to memory of 676 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe svchost.exe PID 2784 wrote to memory of 676 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe svchost.exe PID 2784 wrote to memory of 676 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe svchost.exe PID 2784 wrote to memory of 756 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe svchost.exe PID 2784 wrote to memory of 756 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe svchost.exe PID 2784 wrote to memory of 756 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe svchost.exe PID 2784 wrote to memory of 756 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe svchost.exe PID 2784 wrote to memory of 756 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe svchost.exe PID 2784 wrote to memory of 756 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe svchost.exe PID 2784 wrote to memory of 756 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe svchost.exe PID 2784 wrote to memory of 800 2784 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe svchost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a846bcdaf37342e5fac5baef98e9ae9_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\uptumq.exeFilesize
124KB
MD5fdd7d92c3dc5340c30b065bfb04a8d58
SHA1a5f4202744df82ef0832673fb3feb3579c2f1283
SHA256d9c4c376b24d0b51fcfefa4324c3d90a165a2d086bd3dcb6c3d7f71f02ee168d
SHA5128bf8fa79ab9efd688d1a6c833bae54f898da17f08a90ce1a960d583af39fe4c7dd524db27460366c8f099bf1624041a1d2bb0d1001c21088636fc6c4cc0b89c5
-
memory/1172-11-0x0000000001CA0000-0x0000000001CA2000-memory.dmpFilesize
8KB
-
memory/2784-29-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-21-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/2784-8-0x0000000077770000-0x0000000077771000-memory.dmpFilesize
4KB
-
memory/2784-31-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-22-0x00000000004D0000-0x00000000004D2000-memory.dmpFilesize
8KB
-
memory/2784-34-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-6-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-33-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-19-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/2784-18-0x00000000004D0000-0x00000000004D2000-memory.dmpFilesize
8KB
-
memory/2784-9-0x000000007776F000-0x0000000077770000-memory.dmpFilesize
4KB
-
memory/2784-7-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-5-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-25-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-24-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-26-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-28-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-27-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-0-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/2784-30-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-23-0x00000000004D0000-0x00000000004D2000-memory.dmpFilesize
8KB
-
memory/2784-3-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-10-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-35-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-38-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-39-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-45-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-46-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-48-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-50-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-52-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-54-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-55-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/2784-57-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-70-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-72-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-74-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-80-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-83-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB
-
memory/2784-87-0x00000000004D0000-0x00000000004D2000-memory.dmpFilesize
8KB
-
memory/2784-4-0x0000000001FF0000-0x000000000307E000-memory.dmpFilesize
16.6MB