1964432ca1af473893d804ca11c746f611eb1a1854efab16dc20eeb6a297ebe2

Analysis

max time kernel
148s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe
Size

700KB
MD5

1c4432e4819d40ee50ec3e257016b3fa
SHA1

d550295bcd5d52d580ea8e0688f37bd5c5b4e0a8
SHA256

1964432ca1af473893d804ca11c746f611eb1a1854efab16dc20eeb6a297ebe2
SHA512

e93e0e6957aabef915e7a1ba0e375a1b42dec203872875da88eccd096e6f5863e03ab3dd2dcdb7dbc0253a1866c108052c127d5c25e0733b27205c172b0c440f
SSDEEP

12288:5gXuycBnb0uafX0iKM1wIOXSTfP9/v1QL8lpKB:5gfcBnLGBOizPxvGolpO

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 10 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\PKONJCSCPM.exe = "C:\\Users\\Admin\\AppData\\Roaming\\PKONJCSCPM.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Executes dropped EXE 1 IoCs

pid	Process
1756	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe = "C:\\Users\\Admin\\AppData\\Roaming\\nb5.exe"	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4492 set thread context of 1756	4492	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe	85

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1324	reg.exe
3804	reg.exe
1792	reg.exe
316	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: 1	1756	svchost.exe
Token: SeCreateTokenPrivilege	1756	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1756	svchost.exe
Token: SeLockMemoryPrivilege	1756	svchost.exe
Token: SeIncreaseQuotaPrivilege	1756	svchost.exe
Token: SeMachineAccountPrivilege	1756	svchost.exe
Token: SeTcbPrivilege	1756	svchost.exe
Token: SeSecurityPrivilege	1756	svchost.exe
Token: SeTakeOwnershipPrivilege	1756	svchost.exe
Token: SeLoadDriverPrivilege	1756	svchost.exe
Token: SeSystemProfilePrivilege	1756	svchost.exe
Token: SeSystemtimePrivilege	1756	svchost.exe
Token: SeProfSingleProcessPrivilege	1756	svchost.exe
Token: SeIncBasePriorityPrivilege	1756	svchost.exe
Token: SeCreatePagefilePrivilege	1756	svchost.exe
Token: SeCreatePermanentPrivilege	1756	svchost.exe
Token: SeBackupPrivilege	1756	svchost.exe
Token: SeRestorePrivilege	1756	svchost.exe
Token: SeShutdownPrivilege	1756	svchost.exe
Token: SeDebugPrivilege	1756	svchost.exe
Token: SeAuditPrivilege	1756	svchost.exe
Token: SeSystemEnvironmentPrivilege	1756	svchost.exe
Token: SeChangeNotifyPrivilege	1756	svchost.exe
Token: SeRemoteShutdownPrivilege	1756	svchost.exe
Token: SeUndockPrivilege	1756	svchost.exe
Token: SeSyncAgentPrivilege	1756	svchost.exe
Token: SeEnableDelegationPrivilege	1756	svchost.exe
Token: SeManageVolumePrivilege	1756	svchost.exe
Token: SeImpersonatePrivilege	1756	svchost.exe
Token: SeCreateGlobalPrivilege	1756	svchost.exe
Token: 31	1756	svchost.exe
Token: 32	1756	svchost.exe
Token: 33	1756	svchost.exe
Token: 34	1756	svchost.exe
Token: 35	1756	svchost.exe
Token: SeDebugPrivilege	1756	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1756	svchost.exe
1756	svchost.exe
1756	svchost.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 1756	4492	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe	85
PID 4492 wrote to memory of 1756	4492	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe	85
PID 4492 wrote to memory of 1756	4492	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe	85
PID 4492 wrote to memory of 1756	4492	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe	85
PID 4492 wrote to memory of 1756	4492	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe	85
PID 4492 wrote to memory of 1756	4492	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe	85
PID 4492 wrote to memory of 1756	4492	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe	85
PID 4492 wrote to memory of 1756	4492	1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe	85
PID 1756 wrote to memory of 2944	1756	svchost.exe	87
PID 1756 wrote to memory of 2944	1756	svchost.exe	87
PID 1756 wrote to memory of 2944	1756	svchost.exe	87
PID 1756 wrote to memory of 5036	1756	svchost.exe	88
PID 1756 wrote to memory of 5036	1756	svchost.exe	88
PID 1756 wrote to memory of 5036	1756	svchost.exe	88
PID 1756 wrote to memory of 1988	1756	svchost.exe	89
PID 1756 wrote to memory of 1988	1756	svchost.exe	89
PID 1756 wrote to memory of 1988	1756	svchost.exe	89
PID 1756 wrote to memory of 876	1756	svchost.exe	90
PID 1756 wrote to memory of 876	1756	svchost.exe	90
PID 1756 wrote to memory of 876	1756	svchost.exe	90
PID 1988 wrote to memory of 1324	1988	cmd.exe	95
PID 1988 wrote to memory of 1324	1988	cmd.exe	95
PID 1988 wrote to memory of 1324	1988	cmd.exe	95
PID 5036 wrote to memory of 3804	5036	cmd.exe	96
PID 5036 wrote to memory of 3804	5036	cmd.exe	96
PID 5036 wrote to memory of 3804	5036	cmd.exe	96
PID 2944 wrote to memory of 1792	2944	cmd.exe	97
PID 2944 wrote to memory of 1792	2944	cmd.exe	97
PID 2944 wrote to memory of 1792	2944	cmd.exe	97
PID 876 wrote to memory of 316	876	cmd.exe	98
PID 876 wrote to memory of 316	876	cmd.exe	98
PID 876 wrote to memory of 316	876	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c4432e4819d40ee50ec3e257016b3fa_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Users\Admin\AppData\Roaming\svchost.exe
  C:\Users\Admin\AppData\Roaming\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:1792
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:3804
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:1324
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\PKONJCSCPM.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\PKONJCSCPM.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:876
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\PKONJCSCPM.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\PKONJCSCPM.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
1KB

MD5
a019fc6d1d5c8003f63aba2f78f11377

SHA1
a6125958cae6b8414f9b7a73c340a14b1e68626d

SHA256
7237db025309d754c54c461685e82fcdf1971dc91d252aa0fea9c2fad4ec92c7

SHA512
50c90e406e0db55ccd820ab608d4e02659066f67e0cae177b5abbed1ec0e5122152cbf232777a79fe787ff0b1f0eaec2fd11c36661fac31485bf910c2c36b24a

Download Submit
memory/1756-16-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1756-31-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1756-51-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1756-11-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1756-20-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1756-6-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1756-41-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1756-26-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1756-17-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1756-23-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1756-38-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4492-12-0x0000000075060000-0x0000000075611000-memory.dmp

Filesize
5.7MB

Download
memory/4492-0-0x0000000075062000-0x0000000075063000-memory.dmp

Filesize
4KB

Download
memory/4492-2-0x0000000075060000-0x0000000075611000-memory.dmp

Filesize
5.7MB

Download
memory/4492-1-0x0000000075060000-0x0000000075611000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads