Analysis
-
max time kernel
122s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 12:01
Static task
static1
Behavioral task
behavioral1
Sample
1b392f652b111a20742563590351de64_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
1b392f652b111a20742563590351de64_JaffaCakes118.exe
-
Size
512KB
-
MD5
1b392f652b111a20742563590351de64
-
SHA1
98342fadeabd907ad3e9c7f2bea5555019bfc26d
-
SHA256
1e85acf018823342c785dd3c7f092f88a3dd72d65a0dbc436be728d05a270362
-
SHA512
825cf6b82a10372fcce1254309cd1708ffc9d5dc888a5370605997021075545dfc7961c98f181ed96e1331eb215ba885f01a14d87e08af54aba4c56f8577f97f
-
SSDEEP
3072:hr2BBXUqCYS+0ywYB5YdDZrovRorsiXGIRWi4pPXzr:klBpmlWC4xn
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral2/memory/3764-1-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-3-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-5-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-9-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-6-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-10-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-4-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-13-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-15-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-14-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-17-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-16-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-18-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-19-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-20-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-22-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-23-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-24-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-26-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-27-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-29-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-31-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-34-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-36-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-38-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-40-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-42-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-44-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-46-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-48-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-50-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-52-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-54-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-57-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-64-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-66-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-68-0x0000000002400000-0x000000000348E000-memory.dmp upx behavioral2/memory/3764-70-0x0000000002400000-0x000000000348E000-memory.dmp upx -
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription ioc process File opened (read-only) \??\J: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\M: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\R: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\G: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\L: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\P: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\Q: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\V: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\Z: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\I: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\H: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\O: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\S: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\X: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\E: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\N: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\T: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\U: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\W: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\Y: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\K: 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription ioc process File opened for modification F:\autorun.inf 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened for modification C:\autorun.inf 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Drops file in Program Files directory 13 IoCs
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription ioc process File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exepid process 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exepid process 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription pid process target process PID 3764 wrote to memory of 792 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe fontdrvhost.exe PID 3764 wrote to memory of 800 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe fontdrvhost.exe PID 3764 wrote to memory of 316 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe dwm.exe PID 3764 wrote to memory of 3032 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe sihost.exe PID 3764 wrote to memory of 2628 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe svchost.exe PID 3764 wrote to memory of 2088 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe taskhostw.exe PID 3764 wrote to memory of 3420 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Explorer.EXE PID 3764 wrote to memory of 3552 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe svchost.exe PID 3764 wrote to memory of 3752 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe DllHost.exe PID 3764 wrote to memory of 3844 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe StartMenuExperienceHost.exe PID 3764 wrote to memory of 3948 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe RuntimeBroker.exe PID 3764 wrote to memory of 4036 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe SearchApp.exe PID 3764 wrote to memory of 4104 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe RuntimeBroker.exe PID 3764 wrote to memory of 4476 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe RuntimeBroker.exe PID 3764 wrote to memory of 1512 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe TextInputHost.exe PID 3764 wrote to memory of 2244 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe msedge.exe PID 3764 wrote to memory of 4972 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe msedge.exe PID 3764 wrote to memory of 4580 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe msedge.exe PID 3764 wrote to memory of 1620 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe msedge.exe PID 3764 wrote to memory of 2148 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe msedge.exe PID 3764 wrote to memory of 792 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe fontdrvhost.exe PID 3764 wrote to memory of 800 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe fontdrvhost.exe PID 3764 wrote to memory of 316 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe dwm.exe PID 3764 wrote to memory of 3032 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe sihost.exe PID 3764 wrote to memory of 2628 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe svchost.exe PID 3764 wrote to memory of 2088 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe taskhostw.exe PID 3764 wrote to memory of 3420 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Explorer.EXE PID 3764 wrote to memory of 3552 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe svchost.exe PID 3764 wrote to memory of 3752 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe DllHost.exe PID 3764 wrote to memory of 3844 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe StartMenuExperienceHost.exe PID 3764 wrote to memory of 3948 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe RuntimeBroker.exe PID 3764 wrote to memory of 4036 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe SearchApp.exe PID 3764 wrote to memory of 4104 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe RuntimeBroker.exe PID 3764 wrote to memory of 4476 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe RuntimeBroker.exe PID 3764 wrote to memory of 1512 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe TextInputHost.exe PID 3764 wrote to memory of 2244 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe msedge.exe PID 3764 wrote to memory of 4972 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe msedge.exe PID 3764 wrote to memory of 4580 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe msedge.exe PID 3764 wrote to memory of 1620 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe msedge.exe PID 3764 wrote to memory of 2148 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe msedge.exe PID 3764 wrote to memory of 4896 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe msedge.exe PID 3764 wrote to memory of 792 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe fontdrvhost.exe PID 3764 wrote to memory of 800 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe fontdrvhost.exe PID 3764 wrote to memory of 316 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe dwm.exe PID 3764 wrote to memory of 3032 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe sihost.exe PID 3764 wrote to memory of 2628 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe svchost.exe PID 3764 wrote to memory of 2088 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe taskhostw.exe PID 3764 wrote to memory of 3420 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe Explorer.EXE PID 3764 wrote to memory of 3552 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe svchost.exe PID 3764 wrote to memory of 3752 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe DllHost.exe PID 3764 wrote to memory of 3844 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe StartMenuExperienceHost.exe PID 3764 wrote to memory of 3948 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe RuntimeBroker.exe PID 3764 wrote to memory of 4036 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe SearchApp.exe PID 3764 wrote to memory of 4104 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe RuntimeBroker.exe PID 3764 wrote to memory of 4476 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe RuntimeBroker.exe PID 3764 wrote to memory of 1512 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe TextInputHost.exe PID 3764 wrote to memory of 2244 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe msedge.exe PID 3764 wrote to memory of 4972 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe msedge.exe PID 3764 wrote to memory of 4580 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe msedge.exe PID 3764 wrote to memory of 1620 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe msedge.exe PID 3764 wrote to memory of 2148 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe msedge.exe PID 3764 wrote to memory of 4896 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe msedge.exe PID 3764 wrote to memory of 792 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe fontdrvhost.exe PID 3764 wrote to memory of 800 3764 1b392f652b111a20742563590351de64_JaffaCakes118.exe fontdrvhost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1b392f652b111a20742563590351de64_JaffaCakes118.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\1b392f652b111a20742563590351de64_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1b392f652b111a20742563590351de64_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7fff3a18ceb8,0x7fff3a18cec4,0x7fff3a18ced02⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2292,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1940,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1876,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3964,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:82⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\tcvmca.exeFilesize
100KB
MD5bf239ee53c5abe1807b48f5c5cf8253b
SHA1c1b3c074a9c2d286054b96821beae7728fbd4184
SHA2560b9eebcd69d5fe577db11906a790e1f4eccf67c7d87c01bd70d2d98fc9b288b4
SHA51245b5a099a59b13f5f90d16dc19ee220d1c5b9b2325546fa73fad25ecba1c6311a3896c41c8630c10f93aec9d518be01efa8c26ae3777593463fd0db5f1fa4b94
-
memory/3764-24-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-12-0x0000000005640000-0x0000000005642000-memory.dmpFilesize
8KB
-
memory/3764-8-0x0000000005790000-0x0000000005791000-memory.dmpFilesize
4KB
-
memory/3764-0-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/3764-11-0x0000000005640000-0x0000000005642000-memory.dmpFilesize
8KB
-
memory/3764-5-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-9-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-6-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-10-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-4-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-23-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-13-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-26-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-14-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-17-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-16-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-18-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-19-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-20-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-22-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-7-0x0000000005640000-0x0000000005642000-memory.dmpFilesize
8KB
-
memory/3764-3-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-15-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-27-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-29-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-31-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-34-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-36-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-38-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-40-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-42-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-44-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-46-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-48-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-50-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-52-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-54-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-56-0x0000000005640000-0x0000000005642000-memory.dmpFilesize
8KB
-
memory/3764-57-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-64-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-66-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-68-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-70-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB
-
memory/3764-1-0x0000000002400000-0x000000000348E000-memory.dmpFilesize
16.6MB