330f36e14dc51c710ce266d0a18e15e8f12cd078e3f95bdbbe4925ce0572de2d

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d37c7a4646efa79967339e435ef2f8b_JaffaCakes118.exe
Size

219KB
MD5

2d37c7a4646efa79967339e435ef2f8b
SHA1

44b8c1f35dfeac84e6a664259908c5c4282e2db1
SHA256

330f36e14dc51c710ce266d0a18e15e8f12cd078e3f95bdbbe4925ce0572de2d
SHA512

6a6fa325f48b47590c3c483a85d136eb2177c988b9ae71d503f71f8e67bd9a0942b3a16b65dadb0d88016c4cc2cd4288f935dae0d97298125cd0a7ec082e7a3f
SSDEEP

6144:HOwEvHbqltXFv9IUh3nhGdbNDdT8sbDc8RShZ:uwdlNz3JhGVNDdT8jhZ

Score

10^/10

discovery evasion persistence privilege_escalation trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1572	netsh.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2408-5-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/1916-4-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/1916-2-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/1916-0-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/2408-6-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/2408-7-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/2408-8-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/2408-18-0x0000000000400000-0x000000000047B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\smss = "C:\\Users\\Admin\\smss.exe"	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1916	2d37c7a4646efa79967339e435ef2f8b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2896	1916	2d37c7a4646efa79967339e435ef2f8b_JaffaCakes118.exe	28
PID 1916 wrote to memory of 2896	1916	2d37c7a4646efa79967339e435ef2f8b_JaffaCakes118.exe	28
PID 1916 wrote to memory of 2896	1916	2d37c7a4646efa79967339e435ef2f8b_JaffaCakes118.exe	28
PID 1916 wrote to memory of 2896	1916	2d37c7a4646efa79967339e435ef2f8b_JaffaCakes118.exe	28
PID 1916 wrote to memory of 2456	1916	2d37c7a4646efa79967339e435ef2f8b_JaffaCakes118.exe	30
PID 1916 wrote to memory of 2456	1916	2d37c7a4646efa79967339e435ef2f8b_JaffaCakes118.exe	30
PID 1916 wrote to memory of 2456	1916	2d37c7a4646efa79967339e435ef2f8b_JaffaCakes118.exe	30
PID 1916 wrote to memory of 2456	1916	2d37c7a4646efa79967339e435ef2f8b_JaffaCakes118.exe	30
PID 2896 wrote to memory of 1656	2896	cmd.exe	32
PID 2896 wrote to memory of 1656	2896	cmd.exe	32
PID 2896 wrote to memory of 1656	2896	cmd.exe	32
PID 2896 wrote to memory of 1656	2896	cmd.exe	32
PID 1916 wrote to memory of 2796	1916	2d37c7a4646efa79967339e435ef2f8b_JaffaCakes118.exe	33
PID 1916 wrote to memory of 2796	1916	2d37c7a4646efa79967339e435ef2f8b_JaffaCakes118.exe	33
PID 1916 wrote to memory of 2796	1916	2d37c7a4646efa79967339e435ef2f8b_JaffaCakes118.exe	33
PID 1916 wrote to memory of 2796	1916	2d37c7a4646efa79967339e435ef2f8b_JaffaCakes118.exe	33
PID 2456 wrote to memory of 1668	2456	cmd.exe	35
PID 2456 wrote to memory of 1668	2456	cmd.exe	35
PID 2456 wrote to memory of 1668	2456	cmd.exe	35
PID 2456 wrote to memory of 1668	2456	cmd.exe	35
PID 1916 wrote to memory of 2408	1916	2d37c7a4646efa79967339e435ef2f8b_JaffaCakes118.exe	36
PID 1916 wrote to memory of 2408	1916	2d37c7a4646efa79967339e435ef2f8b_JaffaCakes118.exe	36
PID 1916 wrote to memory of 2408	1916	2d37c7a4646efa79967339e435ef2f8b_JaffaCakes118.exe	36
PID 1916 wrote to memory of 2408	1916	2d37c7a4646efa79967339e435ef2f8b_JaffaCakes118.exe	36
PID 2796 wrote to memory of 1572	2796	cmd.exe	37
PID 2796 wrote to memory of 1572	2796	cmd.exe	37
PID 2796 wrote to memory of 1572	2796	cmd.exe	37
PID 2796 wrote to memory of 1572	2796	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\2d37c7a4646efa79967339e435ef2f8b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2d37c7a4646efa79967339e435ef2f8b_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "smss" /t reg_sz /d "C:\Users\Admin\smss.exe" /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "smss" /t reg_sz /d "C:\Users\Admin\smss.exe" /f
    3⤵
    - Adds Run key to start application
    PID:1656
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t reg_dword /d "0" /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t reg_dword /d "0" /f
    3⤵
    - UAC bypass
    PID:1668
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "netsh firewall set opmode disable"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1572
- C:\Users\Admin\smss.exe
  "C:\Users\Admin\smss.exe"
  2⤵
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1916-4-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1916-2-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1916-1-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/1916-0-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2408-5-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2408-6-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2408-7-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2408-8-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2408-18-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads