sality | e77808e699f1dfd6dae94a7efcf6f977417d27c42d5178b7b203638b58cd92fd

Analysis

max time kernel
150s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 13:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Size

377KB
MD5

1b6fdab88cea4620c9e5cde65361e914
SHA1

c6c7f637255b4193d7b9afe052b131d427b3cbbb
SHA256

e77808e699f1dfd6dae94a7efcf6f977417d27c42d5178b7b203638b58cd92fd
SHA512

e42a1e089de7bc37e9e8e90016e382abfdbeab6fbc908fb821d08b022ec20b07d8ba85203b401152b47b287344b61ced48461c3a9cb8a47c483f344dafdb077e
SSDEEP

6144:CPUrKuc8ssVpIv4t3+h9omAjxFiOdZmzUac1oNNASIn76U+FmYyzdFi4M8We18B:C8rKucRSpKNhLAVFzD1oNW9nh+FngWeS

Score

10^/10

sality backdoor evasion persistence trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe SSVICHOSST.exe"	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

Disables Task Manager via registry modification
evasion

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2144-0-0x0000000000400000-0x00000000004AA000-memory.dmp	upx
behavioral2/memory/2144-1-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-3-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-8-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-9-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-5-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-4-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-24-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-25-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-26-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-27-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-28-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-29-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-30-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-31-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-33-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-34-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-35-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-37-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-38-0x0000000000400000-0x00000000004AA000-memory.dmp	upx
behavioral2/memory/2144-39-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-40-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-42-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-47-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-48-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-50-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-51-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-53-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-55-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-56-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-59-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-58-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-61-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-62-0x0000000000400000-0x00000000004AA000-memory.dmp	upx
behavioral2/memory/2144-64-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-70-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-72-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-74-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-77-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-78-0x0000000000400000-0x00000000004AA000-memory.dmp	upx
behavioral2/memory/2144-79-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-80-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-81-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
C:\Windows\SysWOW64\SSVICHOSST.exe	upx
behavioral2/memory/2144-86-0x00000000023D0000-0x000000000345E000-memory.dmp	upx
behavioral2/memory/2144-88-0x0000000000400000-0x00000000004AA000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\SSVICHOSST.exe"	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 44 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\r:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\v:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\o:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\x:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\R:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\S:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\m:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\w:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\H:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\K:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\L:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\Q:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\T:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\W:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\Z:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\E:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\h:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\n:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\J:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\N:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\P:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\Y:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\e:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\i:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\q:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\u:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\y:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\G:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\U:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\V:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\a:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\j:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\l:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\p:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\b:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\g:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\k:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\z:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\O:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\s:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\t:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\I:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\M:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened (read-only)	\??\X:	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\autorun.inf	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened for modification	F:\autorun.inf	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

Processes:

1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\SSVICHOSST.exe	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\SSVICHOSST.exe	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\autorun.ini	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

Drops file in Program Files directory 12 IoCs

Processes:

1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

Processes:

1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\SSVICHOSST.exe	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File opened for modification	C:\Windows\SYSTEM.INI	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
File created	C:\Windows\SSVICHOSST.exe	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

pid	process
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.execmd.execmd.exe

description	pid	process	target process
PID 2144 wrote to memory of 772	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	fontdrvhost.exe
PID 2144 wrote to memory of 780	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	fontdrvhost.exe
PID 2144 wrote to memory of 60	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	dwm.exe
PID 2144 wrote to memory of 2620	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	sihost.exe
PID 2144 wrote to memory of 2640	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	svchost.exe
PID 2144 wrote to memory of 2916	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	taskhostw.exe
PID 2144 wrote to memory of 3516	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	Explorer.EXE
PID 2144 wrote to memory of 3636	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	svchost.exe
PID 2144 wrote to memory of 3844	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	DllHost.exe
PID 2144 wrote to memory of 3936	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	StartMenuExperienceHost.exe
PID 2144 wrote to memory of 4004	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	RuntimeBroker.exe
PID 2144 wrote to memory of 4092	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	SearchApp.exe
PID 2144 wrote to memory of 3876	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	RuntimeBroker.exe
PID 2144 wrote to memory of 4032	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	TextInputHost.exe
PID 2144 wrote to memory of 456	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	RuntimeBroker.exe
PID 2144 wrote to memory of 4232	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	backgroundTaskHost.exe
PID 2144 wrote to memory of 2748	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	backgroundTaskHost.exe
PID 2144 wrote to memory of 1484	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	cmd.exe
PID 2144 wrote to memory of 1484	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	cmd.exe
PID 2144 wrote to memory of 1484	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	cmd.exe
PID 1484 wrote to memory of 3136	1484	cmd.exe	at.exe
PID 1484 wrote to memory of 3136	1484	cmd.exe	at.exe
PID 1484 wrote to memory of 3136	1484	cmd.exe	at.exe
PID 2144 wrote to memory of 1368	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	cmd.exe
PID 2144 wrote to memory of 1368	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	cmd.exe
PID 2144 wrote to memory of 1368	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	cmd.exe
PID 1368 wrote to memory of 2680	1368	cmd.exe	at.exe
PID 1368 wrote to memory of 2680	1368	cmd.exe	at.exe
PID 1368 wrote to memory of 2680	1368	cmd.exe	at.exe
PID 2144 wrote to memory of 772	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	fontdrvhost.exe
PID 2144 wrote to memory of 780	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	fontdrvhost.exe
PID 2144 wrote to memory of 60	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	dwm.exe
PID 2144 wrote to memory of 2620	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	sihost.exe
PID 2144 wrote to memory of 2640	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	svchost.exe
PID 2144 wrote to memory of 2916	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	taskhostw.exe
PID 2144 wrote to memory of 3516	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	Explorer.EXE
PID 2144 wrote to memory of 3636	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	svchost.exe
PID 2144 wrote to memory of 3844	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	DllHost.exe
PID 2144 wrote to memory of 3936	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	StartMenuExperienceHost.exe
PID 2144 wrote to memory of 4004	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	RuntimeBroker.exe
PID 2144 wrote to memory of 4092	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	SearchApp.exe
PID 2144 wrote to memory of 3876	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	RuntimeBroker.exe
PID 2144 wrote to memory of 4032	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	TextInputHost.exe
PID 2144 wrote to memory of 456	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	RuntimeBroker.exe
PID 2144 wrote to memory of 4232	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	backgroundTaskHost.exe
PID 2144 wrote to memory of 2684	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	RuntimeBroker.exe
PID 2144 wrote to memory of 3952	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	RuntimeBroker.exe
PID 2144 wrote to memory of 772	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	fontdrvhost.exe
PID 2144 wrote to memory of 780	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	fontdrvhost.exe
PID 2144 wrote to memory of 60	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	dwm.exe
PID 2144 wrote to memory of 2620	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	sihost.exe
PID 2144 wrote to memory of 2640	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	svchost.exe
PID 2144 wrote to memory of 2916	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	taskhostw.exe
PID 2144 wrote to memory of 3516	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	Explorer.EXE
PID 2144 wrote to memory of 3636	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	svchost.exe
PID 2144 wrote to memory of 3844	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	DllHost.exe
PID 2144 wrote to memory of 3936	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	StartMenuExperienceHost.exe
PID 2144 wrote to memory of 4004	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	RuntimeBroker.exe
PID 2144 wrote to memory of 4092	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	SearchApp.exe
PID 2144 wrote to memory of 3876	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	RuntimeBroker.exe
PID 2144 wrote to memory of 4032	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	TextInputHost.exe
PID 2144 wrote to memory of 456	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	RuntimeBroker.exe
PID 2144 wrote to memory of 4232	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	backgroundTaskHost.exe
PID 2144 wrote to memory of 2684	2144	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe	RuntimeBroker.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:772

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:60

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2640

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2916

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3516

C:\Users\Admin\AppData\Local\Temp\1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b6fdab88cea4620c9e5cde65361e914_JaffaCakes118.exe"
2⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2144

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
3⤵
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\SysWOW64\at.exe
AT /delete /yes
4⤵
PID:3136

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\SSVICHOSST.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\SSVICHOSST.exe
4⤵
PID:2680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3636

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3844

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3936

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4004

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4092

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3876

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:4032

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:456

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:4232

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:2748

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2684

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3952

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:3388

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:680

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Disable or Modify System Firewall

T1562.004

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Lateral Movement

Replication Through Removable Media

T1091

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\SSVICHOSST.exe
Filesize
377KB

MD5
1b6fdab88cea4620c9e5cde65361e914

SHA1
c6c7f637255b4193d7b9afe052b131d427b3cbbb

SHA256
e77808e699f1dfd6dae94a7efcf6f977417d27c42d5178b7b203638b58cd92fd

SHA512
e42a1e089de7bc37e9e8e90016e382abfdbeab6fbc908fb821d08b022ec20b07d8ba85203b401152b47b287344b61ced48461c3a9cb8a47c483f344dafdb077e

Download Submit
C:\Windows\SysWOW64\autorun.ini
Filesize
109B

MD5
43b9dfd6e61eba0dda808ab0f5f966aa

SHA1
ffdca1842198d91dae7c98e862704ea80235894b

SHA256
de6a46a45c6fb7c6e3ef68bba4d706b2f398dc961fbdbd2b23a5067c5faff406

SHA512
40f1c2597ad182c5e4c2fd6e3bf63e5683f1f9acdd3021eaee5d7c20f39dfc525736bd73ad7955a770b23ce1eb419a3c346095b31573bb9aea9558fd07494981

Download Submit
C:\rgshbm.exe
Filesize
100KB

MD5
5c990e6413f25bd5b21908ad934deb85

SHA1
0a62ec1b4e6313c03398cb00b7a28b37295db087

SHA256
c6622a39c823291dde0515a91f91242f81f2785d5fa3565237db745963419f9d

SHA512
c516ff81a3ac74e5cbfee80124b07d75a20f625eef87c26178f753829db3e103f0702cdd050dd280cb76f6bd3033e6ab0b4758c910673c75d337cdffa929fc34

Download Submit
memory/2144-0-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2144-1-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-3-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-10-0x0000000000650000-0x0000000000652000-memory.dmp

Filesize
8KB

Download
memory/2144-8-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-9-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-14-0x0000000000650000-0x0000000000652000-memory.dmp

Filesize
8KB

Download
memory/2144-5-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-4-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-7-0x00000000039A0000-0x00000000039A1000-memory.dmp

Filesize
4KB

Download
memory/2144-6-0x0000000000650000-0x0000000000652000-memory.dmp

Filesize
8KB

Download
memory/2144-24-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-25-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-26-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-27-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-28-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-29-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-30-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-31-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-33-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-34-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-35-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-37-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-38-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2144-39-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-40-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-42-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-47-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-48-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-50-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-51-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-53-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-55-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-56-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-59-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-58-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-61-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-62-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2144-64-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-70-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-72-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-74-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-77-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-78-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2144-79-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-80-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-81-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-86-0x00000000023D0000-0x000000000345E000-memory.dmp

Filesize
16.6MB

Download
memory/2144-88-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2144-89-0x0000000000650000-0x0000000000652000-memory.dmp

Filesize
8KB

Download