b32d6b43e7494ada1473329c5452e241aef7d5145a7d2063525e3384bc45aa43

Analysis

max time kernel
145s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 13:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41d2383a2ce05dbde0e4348e1f839b64_JaffaCakes118.exe
Size

38KB
MD5

41d2383a2ce05dbde0e4348e1f839b64
SHA1

fe862d0bf04ff518f95552b23446bc989a69f75a
SHA256

b32d6b43e7494ada1473329c5452e241aef7d5145a7d2063525e3384bc45aa43
SHA512

589e31686f7bf2fd1bb0a79b8ff2c5456774f96b9357e2f31e8e8f02324edf80912637cec01975ece0521bae3816a06450cc06493f594f31405fab1fc05c30f4
SSDEEP

768:+DEIXx51xoUknCkXhcr+tqDzFNUPX25nKm1jaZa:lIXxfrmVXhcrYsXUv6D3

Score

10^/10

evasion upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	rundll.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1368-1-0x0000000000480000-0x000000000049D000-memory.dmp	upx
behavioral1/memory/2104-5-0x0000000000480000-0x000000000049D000-memory.dmp	upx
behavioral1/memory/1368-8-0x0000000000480000-0x000000000049D000-memory.dmp	upx
behavioral1/memory/2104-9-0x0000000000480000-0x000000000049D000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	41d2383a2ce05dbde0e4348e1f839b64_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2692	2104	WerFault.exe	32

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
1368	41d2383a2ce05dbde0e4348e1f839b64_JaffaCakes118.exe
1368	41d2383a2ce05dbde0e4348e1f839b64_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeRestorePrivilege	2104	rundll.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2104	1368	41d2383a2ce05dbde0e4348e1f839b64_JaffaCakes118.exe	32
PID 1368 wrote to memory of 2104	1368	41d2383a2ce05dbde0e4348e1f839b64_JaffaCakes118.exe	32
PID 1368 wrote to memory of 2104	1368	41d2383a2ce05dbde0e4348e1f839b64_JaffaCakes118.exe	32
PID 1368 wrote to memory of 2104	1368	41d2383a2ce05dbde0e4348e1f839b64_JaffaCakes118.exe	32
PID 2104 wrote to memory of 2692	2104	rundll.exe	34
PID 2104 wrote to memory of 2692	2104	rundll.exe	34
PID 2104 wrote to memory of 2692	2104	rundll.exe	34
PID 2104 wrote to memory of 2692	2104	rundll.exe	34

C:\Users\Admin\AppData\Local\Temp\41d2383a2ce05dbde0e4348e1f839b64_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\41d2383a2ce05dbde0e4348e1f839b64_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1368
- C:\windows\rundll.exe
  C:\windows\rundll.exe
  2⤵
  - Modifies firewall policy service
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 576
    3⤵
    - Program crash
    PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win.ini

Filesize
499B

MD5
efa6d048d7f1724b9b1e143f3cfe04b4

SHA1
33876af5e48c482e95e341c04e91d1618f621d8b

SHA256
00dd20839e72a2adc7f07b912702eb1b2152e74eb7fa426f3b0e5cb937532e39

SHA512
e6fb5a1cca7bdca672475ba949a2e0f258724c9307a0f2e5171669af126f2dd2e1d63041776f3dcb15264a82773852708797e728c7485934a078899da773f335

Download Submit
memory/1368-1-0x0000000000480000-0x000000000049D000-memory.dmp

Filesize
116KB

Download
memory/1368-4-0x0000000002740000-0x000000000275D000-memory.dmp

Filesize
116KB

Download
memory/1368-2-0x0000000002740000-0x000000000275D000-memory.dmp

Filesize
116KB

Download
memory/1368-8-0x0000000000480000-0x000000000049D000-memory.dmp

Filesize
116KB

Download
memory/1368-12-0x0000000002740000-0x000000000275D000-memory.dmp

Filesize
116KB

Download
memory/1368-13-0x0000000002740000-0x000000000275D000-memory.dmp

Filesize
116KB

Download
memory/2104-5-0x0000000000480000-0x000000000049D000-memory.dmp

Filesize
116KB

Download
memory/2104-9-0x0000000000480000-0x000000000049D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads