Analysis

  • max time kernel
    148s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/07/2024, 18:03

General

  • Target

    46ea99b7cc127192f343f421f3471462_JaffaCakes118.exe

  • Size

    1.9MB

  • MD5

    46ea99b7cc127192f343f421f3471462

  • SHA1

    7f751140c3813ed26681e261d896451f08ecc51e

  • SHA256

    7f0f4868b12001237dd75e360ae392f6b174a1998e40d25b4926bafe2774f36d

  • SHA512

    0d4f80d5e8a0c946e13d6e1d36a8c4cf8bfd4b15cedc1ca78b135198f69d48c05787541a99013545e1fe92b1bc863f37ee17d22d400d8be9bcc61f8dfb420612

  • SSDEEP

    49152:Tx50eHsaHqe9AQhlPiTPi/3OQBipYI46GUA:Nuetqe9AQhlPiTPi/3OQBipYI46GUA

Score
10/10

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 10 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\46ea99b7cc127192f343f421f3471462_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\46ea99b7cc127192f343f421f3471462_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3964
    • C:\Users\Admin\AppData\Roaming\updater\windll32.exe
      "C:\Users\Admin\AppData\Roaming\updater\windll32.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3248
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3496
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies firewall policy service
          • Modifies registry key
          PID:1060
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\updater\windll32.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\updater\windll32.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4712
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\updater\windll32.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\updater\windll32.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • Modifies firewall policy service
          • Modifies registry key
          PID:1796
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3076
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies firewall policy service
          • Modifies registry key
          PID:1600
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\windll72.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\windll72.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1124
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\windll72.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\windll72.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • Modifies firewall policy service
          • Modifies registry key
          PID:232

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\updater\windll32.exe

    Filesize

    1.9MB

    MD5

    46ea99b7cc127192f343f421f3471462

    SHA1

    7f751140c3813ed26681e261d896451f08ecc51e

    SHA256

    7f0f4868b12001237dd75e360ae392f6b174a1998e40d25b4926bafe2774f36d

    SHA512

    0d4f80d5e8a0c946e13d6e1d36a8c4cf8bfd4b15cedc1ca78b135198f69d48c05787541a99013545e1fe92b1bc863f37ee17d22d400d8be9bcc61f8dfb420612

  • memory/3248-4-0x0000000000400000-0x000000000065E000-memory.dmp

    Filesize

    2.4MB

  • memory/3248-10-0x0000000000400000-0x000000000065E000-memory.dmp

    Filesize

    2.4MB

  • memory/3248-11-0x0000000000400000-0x000000000065E000-memory.dmp

    Filesize

    2.4MB

  • memory/3248-13-0x0000000000400000-0x000000000065E000-memory.dmp

    Filesize

    2.4MB

  • memory/3248-14-0x0000000000400000-0x000000000065E000-memory.dmp

    Filesize

    2.4MB

  • memory/3248-15-0x0000000000400000-0x000000000065E000-memory.dmp

    Filesize

    2.4MB

  • memory/3248-17-0x0000000000400000-0x000000000065E000-memory.dmp

    Filesize

    2.4MB

  • memory/3248-18-0x0000000000400000-0x000000000065E000-memory.dmp

    Filesize

    2.4MB

  • memory/3248-19-0x0000000000400000-0x000000000065E000-memory.dmp

    Filesize

    2.4MB