Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
08-07-2024 21:28
Static task
static1
Behavioral task
behavioral1
Sample
2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe
Resource
win10v2004-20240708-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe
-
Size
786KB
-
MD5
2ddcfd312ae19fe1161fa2726103d952
-
SHA1
97baef571f2812725eb7f1901d2463767bbe9e8f
-
SHA256
f078a336e117939ee99b0f040abb1fc72a6f27deabdd7766004645dc2f5f09a4
-
SHA512
4f67c06829e7d0a3e9bc589b4192f47cd16cca8636ea780134ce06586b8bdaef3317585dec2572561f993506a8af837944fb59be7216b7b02a18316019d21d0a
-
SSDEEP
24576:iRtsgpA45w9Af0/5JAZfdpDY0rqRXHYrmk:uvgP0rYHYr
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 3020 netsh.exe 2492 netsh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1496 wrote to memory of 2408 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 30 PID 1496 wrote to memory of 2408 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 30 PID 1496 wrote to memory of 2408 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 30 PID 1496 wrote to memory of 2408 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 30 PID 1496 wrote to memory of 2172 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 32 PID 1496 wrote to memory of 2172 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 32 PID 1496 wrote to memory of 2172 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 32 PID 1496 wrote to memory of 2172 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 32 PID 1496 wrote to memory of 2804 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 34 PID 1496 wrote to memory of 2804 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 34 PID 1496 wrote to memory of 2804 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 34 PID 1496 wrote to memory of 2804 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 34 PID 2804 wrote to memory of 3020 2804 cmd.exe 36 PID 2804 wrote to memory of 3020 2804 cmd.exe 36 PID 2804 wrote to memory of 3020 2804 cmd.exe 36 PID 2804 wrote to memory of 3020 2804 cmd.exe 36 PID 1496 wrote to memory of 2780 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 37 PID 1496 wrote to memory of 2780 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 37 PID 1496 wrote to memory of 2780 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 37 PID 1496 wrote to memory of 2780 1496 2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe 37 PID 2780 wrote to memory of 2492 2780 cmd.exe 39 PID 2780 wrote to memory of 2492 2780 cmd.exe 39 PID 2780 wrote to memory of 2492 2780 cmd.exe 39 PID 2780 wrote to memory of 2492 2780 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2ddcfd312ae19fe1161fa2726103d952_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\DirectDownloader"2⤵PID:2408
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C echo ifms > "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"2⤵PID:2172
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3020
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE2⤵
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2492
-
-