06cb7880195c0bc56cc6591510909a2cb58614346ccbf00f14faa64a3ba1bf17

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe
Size

268KB
MD5

375afb23dd50b2b4775b85e5b451aad6
SHA1

78b2e3ca1d87fb64db55dcf8992bfeebaccfbfa5
SHA256

06cb7880195c0bc56cc6591510909a2cb58614346ccbf00f14faa64a3ba1bf17
SHA512

f68fa6b55486677b8d415c3fe767327a1c837808b27ef609b3b3d2d734c117727776598d6dacef304d8e6e52f2d3d059f1aec9bd1e05216cbfb0cfdcfa5eaf14
SSDEEP

6144:VwaMaNHn2vMw1OVCD03U2u9YyVsQywXJj8A3s/QKS/21hJfu:SaXNHnsMwukfOVQRp8/QKI2Zm

Score

10^/10

evasion upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 10 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\black.exe = "C:\\Users\\Admin\\AppData\\Roaming\\black.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe

Executes dropped EXE 1 IoCs

pid	Process
3384	svchost.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3384-26-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/3384-27-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/3384-25-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/3384-34-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/3384-20-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/3384-35-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/3384-38-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/3384-39-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/3384-42-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/3384-44-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/3384-47-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/3384-50-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/3384-53-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/3384-56-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/3384-59-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/3384-62-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/3384-68-0x0000000000400000-0x000000000045C000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3456 set thread context of 3384	3456	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	89

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
3416	reg.exe
1064	reg.exe
4612	reg.exe
2236	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: 1	3384	svchost.exe
Token: SeCreateTokenPrivilege	3384	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3384	svchost.exe
Token: SeLockMemoryPrivilege	3384	svchost.exe
Token: SeIncreaseQuotaPrivilege	3384	svchost.exe
Token: SeMachineAccountPrivilege	3384	svchost.exe
Token: SeTcbPrivilege	3384	svchost.exe
Token: SeSecurityPrivilege	3384	svchost.exe
Token: SeTakeOwnershipPrivilege	3384	svchost.exe
Token: SeLoadDriverPrivilege	3384	svchost.exe
Token: SeSystemProfilePrivilege	3384	svchost.exe
Token: SeSystemtimePrivilege	3384	svchost.exe
Token: SeProfSingleProcessPrivilege	3384	svchost.exe
Token: SeIncBasePriorityPrivilege	3384	svchost.exe
Token: SeCreatePagefilePrivilege	3384	svchost.exe
Token: SeCreatePermanentPrivilege	3384	svchost.exe
Token: SeBackupPrivilege	3384	svchost.exe
Token: SeRestorePrivilege	3384	svchost.exe
Token: SeShutdownPrivilege	3384	svchost.exe
Token: SeDebugPrivilege	3384	svchost.exe
Token: SeAuditPrivilege	3384	svchost.exe
Token: SeSystemEnvironmentPrivilege	3384	svchost.exe
Token: SeChangeNotifyPrivilege	3384	svchost.exe
Token: SeRemoteShutdownPrivilege	3384	svchost.exe
Token: SeUndockPrivilege	3384	svchost.exe
Token: SeSyncAgentPrivilege	3384	svchost.exe
Token: SeEnableDelegationPrivilege	3384	svchost.exe
Token: SeManageVolumePrivilege	3384	svchost.exe
Token: SeImpersonatePrivilege	3384	svchost.exe
Token: SeCreateGlobalPrivilege	3384	svchost.exe
Token: 31	3384	svchost.exe
Token: 32	3384	svchost.exe
Token: 33	3384	svchost.exe
Token: 34	3384	svchost.exe
Token: 35	3384	svchost.exe
Token: SeDebugPrivilege	3384	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3384	svchost.exe
3384	svchost.exe
3384	svchost.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 2248	3456	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	86
PID 3456 wrote to memory of 2248	3456	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	86
PID 3456 wrote to memory of 2248	3456	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	86
PID 2248 wrote to memory of 1920	2248	csc.exe	88
PID 2248 wrote to memory of 1920	2248	csc.exe	88
PID 2248 wrote to memory of 1920	2248	csc.exe	88
PID 3456 wrote to memory of 3384	3456	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	89
PID 3456 wrote to memory of 3384	3456	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	89
PID 3456 wrote to memory of 3384	3456	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	89
PID 3456 wrote to memory of 3384	3456	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	89
PID 3456 wrote to memory of 3384	3456	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	89
PID 3456 wrote to memory of 3384	3456	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	89
PID 3456 wrote to memory of 3384	3456	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	89
PID 3456 wrote to memory of 3384	3456	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	89
PID 3384 wrote to memory of 4688	3384	svchost.exe	90
PID 3384 wrote to memory of 4688	3384	svchost.exe	90
PID 3384 wrote to memory of 4688	3384	svchost.exe	90
PID 3384 wrote to memory of 436	3384	svchost.exe	91
PID 3384 wrote to memory of 436	3384	svchost.exe	91
PID 3384 wrote to memory of 436	3384	svchost.exe	91
PID 3384 wrote to memory of 1972	3384	svchost.exe	92
PID 3384 wrote to memory of 1972	3384	svchost.exe	92
PID 3384 wrote to memory of 1972	3384	svchost.exe	92
PID 3384 wrote to memory of 1368	3384	svchost.exe	93
PID 3384 wrote to memory of 1368	3384	svchost.exe	93
PID 3384 wrote to memory of 1368	3384	svchost.exe	93
PID 436 wrote to memory of 4612	436	cmd.exe	98
PID 436 wrote to memory of 4612	436	cmd.exe	98
PID 436 wrote to memory of 4612	436	cmd.exe	98
PID 4688 wrote to memory of 2236	4688	cmd.exe	99
PID 4688 wrote to memory of 2236	4688	cmd.exe	99
PID 4688 wrote to memory of 2236	4688	cmd.exe	99
PID 1972 wrote to memory of 3416	1972	cmd.exe	100
PID 1972 wrote to memory of 3416	1972	cmd.exe	100
PID 1972 wrote to memory of 3416	1972	cmd.exe	100
PID 1368 wrote to memory of 1064	1368	cmd.exe	101
PID 1368 wrote to memory of 1064	1368	cmd.exe	101
PID 1368 wrote to memory of 1064	1368	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ufnd7q1k.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES91B2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC91B1.tmp"
    3⤵
    PID:1920
- C:\Users\Admin\AppData\Roaming\svchost.exe
  C:\Users\Admin\AppData\Roaming\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:2236
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:436
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:4612
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:3416
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\black.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\black.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\black.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\black.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES91B2.tmp

Filesize
1KB

MD5
7276cc275f18d97fa159fede8ff0119c

SHA1
04dda80cd3c93fe0dd5dcbed1a0ac31a6da3ed8d

SHA256
479bc05ad41210db7751374e7b7ba34107bddea717233f7d1caa0af510daa05c

SHA512
d8a622247064ef00cf76600a9b979868020eea482ad2fbdd8efa73ee80f7e81dda116f07372fdb196ac115f68a05fda407b5a4e555833733fd6b2c98bf6f0468

Download Submit
C:\Users\Admin\AppData\Local\Temp\ufnd7q1k.dll

Filesize
5KB

MD5
c21884f75563cbf3dbce11193ccc48af

SHA1
ef0199bd7baedc5d3a1f387f940efb4b0ab3428c

SHA256
1bac0c139ba68ca5898673a7ae89abe37ff926179ee507cde83841d9b9d2a0be

SHA512
1022ba01494149c6daf14af3dd5b83f1010d2a743362f3b5f53c2d50b3bee599c4e4f91ce2933a5c0a15641ea70aa072fda5871642b4e49f3fa54bee98215337

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
12KB

MD5
bb5b2961567e68995464801d3bb2a964

SHA1
5d82ae2b8d24208418bfb09cbb3074c056e790dc

SHA256
a2d3d892c68a84208a9887cb34ecae820e59c4aa25c22db5c23379df344df004

SHA512
050550640a7bf2b65b3cd537f252b64465ec451555ff1831a9d799922e8c3382e83a52bc46015c5ed1ac79ebb233616f72aa8ed72f01e8be578ca383a304ff7a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC91B1.tmp

Filesize
652B

MD5
25e1802d2692c4941c0f1ed2220ace54

SHA1
5f162e14d460e6ed7443606c40a7d534e8d73611

SHA256
2e480b200f02ca648be0e0c74ecb44e34541134482c9fc9c8e75de2462d99edf

SHA512
a82a2f06b251e070bd5bc3f00f6c5f4b94dd3124aa4d2a2c86fa97847f1a44d11aa0231d11ac9853372e345b3c0da23a0d041f01922dc40eaad93d41d4f3132e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ufnd7q1k.0.cs

Filesize
4KB

MD5
2216d197bc442e875016eba15c07a937

SHA1
37528e21ea3271b85d276c6bd003e6c60c81545d

SHA256
2e9e3da7bfa1334706550bb4d6269bf3e64cbbc09fa349af52eb22f32aebb4af

SHA512
7d7bdc3bf83ac0a29e917ead899dcaa1b47ee2660f405fe4883ca2a2546f7924265e1d75a2ea02c0e34fac4d2bb82bbaaa88d06c240afad4e9fd49337cd04d3f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ufnd7q1k.cmdline

Filesize
206B

MD5
fee70d18cc88428cfab54c90503fade9

SHA1
6d8f3be87bd8bfcd008c5377676455cafdd9f7fd

SHA256
2fbd8ae2d49cafb75622b42dcd088cb1c79c09141651024dee30a118b84a4f49

SHA512
626c08a484801f65f534253498e689bc6997dfdd8c5c5fe2d7aa01f180d0e8c16abac6024e90713ce57878bda14e43383d96e8b0ebfb4573f8882c9816789a84

Download Submit
memory/2248-16-0x0000000074920000-0x0000000074ED1000-memory.dmp

Filesize
5.7MB

Download
memory/2248-11-0x0000000074920000-0x0000000074ED1000-memory.dmp

Filesize
5.7MB

Download
memory/3384-25-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3384-53-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3384-68-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3384-26-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3384-27-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3384-62-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3384-59-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3384-34-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3384-20-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3384-35-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3384-38-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3384-39-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3384-42-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3384-44-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3384-47-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3384-50-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3384-56-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3456-2-0x0000000074920000-0x0000000074ED1000-memory.dmp

Filesize
5.7MB

Download
memory/3456-0-0x0000000074922000-0x0000000074923000-memory.dmp

Filesize
4KB

Download
memory/3456-29-0x0000000074920000-0x0000000074ED1000-memory.dmp

Filesize
5.7MB

Download
memory/3456-1-0x0000000074920000-0x0000000074ED1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads