1964432ca1af473893d804ca11c746f611eb1a1854efab16dc20eeb6a297ebe2

Analysis

max time kernel
147s
max time network
146s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe
Size

700KB
MD5

1c4432e4819d40ee50ec3e257016b3fa
SHA1

d550295bcd5d52d580ea8e0688f37bd5c5b4e0a8
SHA256

1964432ca1af473893d804ca11c746f611eb1a1854efab16dc20eeb6a297ebe2
SHA512

e93e0e6957aabef915e7a1ba0e375a1b42dec203872875da88eccd096e6f5863e03ab3dd2dcdb7dbc0253a1866c108052c127d5c25e0733b27205c172b0c440f
SSDEEP

12288:5gXuycBnb0uafX0iKM1wIOXSTfP9/v1QL8lpKB:5gfcBnLGBOizPxvGolpO

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 8 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\PKONJCSCPM.exe = "C:\\Users\\Admin\\AppData\\Roaming\\PKONJCSCPM.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe

Executes dropped EXE 1 IoCs

pid	Process
2816	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
2240	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe
2240	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe = "C:\\Users\\Admin\\AppData\\Roaming\\nb5.exe"	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2240 set thread context of 2816	2240	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe	28

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
2764	reg.exe
2580	reg.exe
2472	reg.exe
3024	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: 1	2816	svchost.exe
Token: SeCreateTokenPrivilege	2816	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2816	svchost.exe
Token: SeLockMemoryPrivilege	2816	svchost.exe
Token: SeIncreaseQuotaPrivilege	2816	svchost.exe
Token: SeMachineAccountPrivilege	2816	svchost.exe
Token: SeTcbPrivilege	2816	svchost.exe
Token: SeSecurityPrivilege	2816	svchost.exe
Token: SeTakeOwnershipPrivilege	2816	svchost.exe
Token: SeLoadDriverPrivilege	2816	svchost.exe
Token: SeSystemProfilePrivilege	2816	svchost.exe
Token: SeSystemtimePrivilege	2816	svchost.exe
Token: SeProfSingleProcessPrivilege	2816	svchost.exe
Token: SeIncBasePriorityPrivilege	2816	svchost.exe
Token: SeCreatePagefilePrivilege	2816	svchost.exe
Token: SeCreatePermanentPrivilege	2816	svchost.exe
Token: SeBackupPrivilege	2816	svchost.exe
Token: SeRestorePrivilege	2816	svchost.exe
Token: SeShutdownPrivilege	2816	svchost.exe
Token: SeDebugPrivilege	2816	svchost.exe
Token: SeAuditPrivilege	2816	svchost.exe
Token: SeSystemEnvironmentPrivilege	2816	svchost.exe
Token: SeChangeNotifyPrivilege	2816	svchost.exe
Token: SeRemoteShutdownPrivilege	2816	svchost.exe
Token: SeUndockPrivilege	2816	svchost.exe
Token: SeSyncAgentPrivilege	2816	svchost.exe
Token: SeEnableDelegationPrivilege	2816	svchost.exe
Token: SeManageVolumePrivilege	2816	svchost.exe
Token: SeImpersonatePrivilege	2816	svchost.exe
Token: SeCreateGlobalPrivilege	2816	svchost.exe
Token: 31	2816	svchost.exe
Token: 32	2816	svchost.exe
Token: 33	2816	svchost.exe
Token: 34	2816	svchost.exe
Token: 35	2816	svchost.exe
Token: SeDebugPrivilege	2816	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2816	2240	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2816	2240	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2816	2240	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2816	2240	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2816	2240	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2816	2240	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2816	2240	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2816	2240	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2816	2240	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe	28
PID 2816 wrote to memory of 3008	2816	svchost.exe	29
PID 2816 wrote to memory of 3008	2816	svchost.exe	29
PID 2816 wrote to memory of 3008	2816	svchost.exe	29
PID 2816 wrote to memory of 3008	2816	svchost.exe	29
PID 2816 wrote to memory of 2556	2816	svchost.exe	30
PID 2816 wrote to memory of 2556	2816	svchost.exe	30
PID 2816 wrote to memory of 2556	2816	svchost.exe	30
PID 2816 wrote to memory of 2556	2816	svchost.exe	30
PID 2816 wrote to memory of 2604	2816	svchost.exe	32
PID 2816 wrote to memory of 2604	2816	svchost.exe	32
PID 2816 wrote to memory of 2604	2816	svchost.exe	32
PID 2816 wrote to memory of 2604	2816	svchost.exe	32
PID 2816 wrote to memory of 2672	2816	svchost.exe	34
PID 2816 wrote to memory of 2672	2816	svchost.exe	34
PID 2816 wrote to memory of 2672	2816	svchost.exe	34
PID 2816 wrote to memory of 2672	2816	svchost.exe	34
PID 3008 wrote to memory of 2580	3008	cmd.exe	39
PID 3008 wrote to memory of 2580	3008	cmd.exe	39
PID 3008 wrote to memory of 2580	3008	cmd.exe	39
PID 3008 wrote to memory of 2580	3008	cmd.exe	39
PID 2556 wrote to memory of 2764	2556	cmd.exe	40
PID 2556 wrote to memory of 2764	2556	cmd.exe	40
PID 2556 wrote to memory of 2764	2556	cmd.exe	40
PID 2556 wrote to memory of 2764	2556	cmd.exe	40
PID 2672 wrote to memory of 3024	2672	cmd.exe	37
PID 2672 wrote to memory of 3024	2672	cmd.exe	37
PID 2672 wrote to memory of 3024	2672	cmd.exe	37
PID 2672 wrote to memory of 3024	2672	cmd.exe	37
PID 2604 wrote to memory of 2472	2604	cmd.exe	38
PID 2604 wrote to memory of 2472	2604	cmd.exe	38
PID 2604 wrote to memory of 2472	2604	cmd.exe	38
PID 2604 wrote to memory of 2472	2604	cmd.exe	38

C:\Users\Admin\AppData\Local\Temp\1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Roaming\svchost.exe
  C:\Users\Admin\AppData\Roaming\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:2580
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:2764
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:2472
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\PKONJCSCPM.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\PKONJCSCPM.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\PKONJCSCPM.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\PKONJCSCPM.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\svchost.exe

Filesize
1KB

MD5
a019fc6d1d5c8003f63aba2f78f11377

SHA1
a6125958cae6b8414f9b7a73c340a14b1e68626d

SHA256
7237db025309d754c54c461685e82fcdf1971dc91d252aa0fea9c2fad4ec92c7

SHA512
50c90e406e0db55ccd820ab608d4e02659066f67e0cae177b5abbed1ec0e5122152cbf232777a79fe787ff0b1f0eaec2fd11c36661fac31485bf910c2c36b24a

Download Submit
memory/2240-19-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/2240-1-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/2240-2-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/2240-0-0x0000000074291000-0x0000000074292000-memory.dmp

Filesize
4KB

Download
memory/2816-24-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2816-20-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2816-23-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2816-11-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2816-27-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2816-28-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2816-31-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2816-32-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2816-33-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2816-35-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2816-37-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads