Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12-07-2024 00:37
Static task
static1
Behavioral task
behavioral1
Sample
3b583bfc585f0796b4653eac01ef77a6_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3b583bfc585f0796b4653eac01ef77a6_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3b583bfc585f0796b4653eac01ef77a6_JaffaCakes118.exe
-
Size
728KB
-
MD5
3b583bfc585f0796b4653eac01ef77a6
-
SHA1
d003e709142695b8ead148781e1688fa07744ccc
-
SHA256
d0359389dca3cef5fa49d774bb2e554c99e94df3ef015048b7b99bdbd4bdddfc
-
SHA512
ebd8bdd0ea7a18432eb9719ef4a1c2b009a1cf4c4b4cea345bf270875fa92170afe09bf79e208ca5213baf54d9dfb4c139f29c678830025678cc2ba6985ded58
-
SSDEEP
12288:lEcF8D2K53tGcAOYYsLN2Z8bbXK/meGDgGeItoEc9GspWZhASRXHYnrm6:lEc8H5fMLN2Kb7KrGlFtov9GsqRXHYr5
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 1640 netsh.exe 2820 netsh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3064 wrote to memory of 1292 3064 3b583bfc585f0796b4653eac01ef77a6_JaffaCakes118.exe 30 PID 3064 wrote to memory of 1292 3064 3b583bfc585f0796b4653eac01ef77a6_JaffaCakes118.exe 30 PID 3064 wrote to memory of 1292 3064 3b583bfc585f0796b4653eac01ef77a6_JaffaCakes118.exe 30 PID 3064 wrote to memory of 1292 3064 3b583bfc585f0796b4653eac01ef77a6_JaffaCakes118.exe 30 PID 3064 wrote to memory of 2200 3064 3b583bfc585f0796b4653eac01ef77a6_JaffaCakes118.exe 32 PID 3064 wrote to memory of 2200 3064 3b583bfc585f0796b4653eac01ef77a6_JaffaCakes118.exe 32 PID 3064 wrote to memory of 2200 3064 3b583bfc585f0796b4653eac01ef77a6_JaffaCakes118.exe 32 PID 3064 wrote to memory of 2200 3064 3b583bfc585f0796b4653eac01ef77a6_JaffaCakes118.exe 32 PID 3064 wrote to memory of 1940 3064 3b583bfc585f0796b4653eac01ef77a6_JaffaCakes118.exe 34 PID 3064 wrote to memory of 1940 3064 3b583bfc585f0796b4653eac01ef77a6_JaffaCakes118.exe 34 PID 3064 wrote to memory of 1940 3064 3b583bfc585f0796b4653eac01ef77a6_JaffaCakes118.exe 34 PID 3064 wrote to memory of 1940 3064 3b583bfc585f0796b4653eac01ef77a6_JaffaCakes118.exe 34 PID 1940 wrote to memory of 1640 1940 cmd.exe 36 PID 1940 wrote to memory of 1640 1940 cmd.exe 36 PID 1940 wrote to memory of 1640 1940 cmd.exe 36 PID 1940 wrote to memory of 1640 1940 cmd.exe 36 PID 3064 wrote to memory of 2700 3064 3b583bfc585f0796b4653eac01ef77a6_JaffaCakes118.exe 37 PID 3064 wrote to memory of 2700 3064 3b583bfc585f0796b4653eac01ef77a6_JaffaCakes118.exe 37 PID 3064 wrote to memory of 2700 3064 3b583bfc585f0796b4653eac01ef77a6_JaffaCakes118.exe 37 PID 3064 wrote to memory of 2700 3064 3b583bfc585f0796b4653eac01ef77a6_JaffaCakes118.exe 37 PID 2700 wrote to memory of 2820 2700 cmd.exe 39 PID 2700 wrote to memory of 2820 2700 cmd.exe 39 PID 2700 wrote to memory of 2820 2700 cmd.exe 39 PID 2700 wrote to memory of 2820 2700 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b583bfc585f0796b4653eac01ef77a6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3b583bfc585f0796b4653eac01ef77a6_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\DirectDownloader"2⤵PID:1292
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C echo ifms > "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"2⤵PID:2200
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1640
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE2⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2820
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
155KB
MD5e1098470152dc10fb29b3ad7b4e5f5cf
SHA1ae5a796340be8f0912d6c85f81dce21211aaaf15
SHA2563832d19f80a84069c5010266fa3cf11eee5bb1c3d1b2ba278e49519519561b8a
SHA5120ba3a53a3021be99aaf5cf8af54f214feea0f80f112a7ffb209b4c2c0539f8b8b6cd087ba7ed6501c9b79e0a9496494e471ac43f9b7f0aacf58866c01e90e7c6