fb9fca4614485b599c5fd80123f43edbdca84110a1fa3a1f07e8e9899949ec7b

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 10:53

Target

28499159f535dabf9ea083af93565ff0_JaffaCakes118.dll
Size

46KB
MD5

28499159f535dabf9ea083af93565ff0
SHA1

2d208a564ac9fdf414cbf7b6719c79cd2ffa3f17
SHA256

fb9fca4614485b599c5fd80123f43edbdca84110a1fa3a1f07e8e9899949ec7b
SHA512

3199011c2c225ed134f4afe1b3887f33a683cb01903a5b21e484577bac0c92eed32a4ecd4da3eb0345ad3118bf56bf62ef5c56bc845b114ec17c48754fdacc75
SSDEEP

768:+cTXETzeHVYbmiNZOv24DFqGGaA3wyhW01O5z4F3REsIlHIJHdR4xkgzWjfL:hETQqbTCTD4GGaA3waDisFhEHlGHEzW

Score

10^/10

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

Windows Service

Disable or Modify System Firewall

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	rundll32.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	rundll32.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateNT = "C:\\Users\\Admin\\AppData\\Local\\Temp\\28499159f535dabf9ea083af93565ff0_JaffaCakes118.exe"	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 4204	4484	rundll32.exe	82
PID 4484 wrote to memory of 4204	4484	rundll32.exe	82
PID 4484 wrote to memory of 4204	4484	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28499159f535dabf9ea083af93565ff0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28499159f535dabf9ea083af93565ff0_JaffaCakes118.dll,#1
  2⤵
  - Modifies firewall policy service
  - Windows security bypass
  - Windows security modification
  - Adds Run key to start application
  PID:4204