f0efafa624cd5f05829812dfbfd90fad13974a77187298a680f0d0e1d14112be

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 21:28

Target

1c8f85c01371065706aeaf566960dba1_JaffaCakes118.exe
Size

288KB
MD5

1c8f85c01371065706aeaf566960dba1
SHA1

308f2995eb305f3ba854cbb6a314a62905df87e8
SHA256

f0efafa624cd5f05829812dfbfd90fad13974a77187298a680f0d0e1d14112be
SHA512

86f3b3478fe5372e4ea8600fc9f3a30beed6f5dd862f4cc501ae4181f24127f975ea63236fe6ab56ef81ce71c479b66a7673778e6b42e8a96a45bcbd80b8d0a4
SSDEEP

6144:yDdP8hmysz6ER1zUizyIWh5XhTBUcoPpHJADd:iP8hm1G4zbeJhTixP56Dd

Score

8^/10

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

Disable or Modify System Firewall

pid	Process
3972	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	1c8f85c01371065706aeaf566960dba1_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched.1 = "C:\\WINDOWS\\system32\\drivers\\Descompacx.exe"	1c8f85c01371065706aeaf566960dba1_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 3972	636	1c8f85c01371065706aeaf566960dba1_JaffaCakes118.exe	91
PID 636 wrote to memory of 3972	636	1c8f85c01371065706aeaf566960dba1_JaffaCakes118.exe	91
PID 636 wrote to memory of 3972	636	1c8f85c01371065706aeaf566960dba1_JaffaCakes118.exe	91