ad3c997fea4347b5bf763f478e4d5fa5e4d5f2729ce08c710abccbae855add67

Analysis

max time kernel
95s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 03:12

Target

47f77dbd05a58bf75228485f7989e73a_JaffaCakes118.exe
Size

36KB
MD5

47f77dbd05a58bf75228485f7989e73a
SHA1

2e16c04fe6cc04779128d80a3214e7956d5c0828
SHA256

ad3c997fea4347b5bf763f478e4d5fa5e4d5f2729ce08c710abccbae855add67
SHA512

b20a40211fc0e5332b7651d65b0acde0c8b0383f5c2206a701d3ca52d1cd7cdcb745692ac4a3cdef7b0f0a101a701450d1c7fe3a04b6e12b390128c3c2a4d3ea
SSDEEP

768:Zhl/xisOVKMEW2ICHcvX6OcuC1eKTKdGhqWkVFGCufmJ8EHK9R3Y:Zhl/xtOVKU2wdQKdGA8xfAq9Ro

Score

8^/10

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

Disable or Modify System Firewall

pid	Process
540	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 540	3556	47f77dbd05a58bf75228485f7989e73a_JaffaCakes118.exe	85
PID 3556 wrote to memory of 540	3556	47f77dbd05a58bf75228485f7989e73a_JaffaCakes118.exe	85
PID 3556 wrote to memory of 540	3556	47f77dbd05a58bf75228485f7989e73a_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\47f77dbd05a58bf75228485f7989e73a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\47f77dbd05a58bf75228485f7989e73a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram 'C:\Users\Admin\AppData\Local\Temp\47f77dbd05a58bf75228485f7989e73a_JaffaCakes118.exe' 'MS IE Module' enable
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:540