5c201478354fcb5fa862bdb04ed1f66d75072a27ae3917a3ca781d7f8e7c9643

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 08:51

Target

4d9a85750ae4df06bcdbdac7890d81f4_JaffaCakes118.dll
Size

42KB
MD5

4d9a85750ae4df06bcdbdac7890d81f4
SHA1

26a05a1fc48a64236792235b1d799f66c32dbeb1
SHA256

5c201478354fcb5fa862bdb04ed1f66d75072a27ae3917a3ca781d7f8e7c9643
SHA512

fe1b07ced936271a087a57c0d630f1e839f7e661f7ddd6ab27fa27b76c7d6716490f2ac004de4bf507589e76fbd88043759e13752035bcff2b1476482a5c7b85
SSDEEP

768:xk5+mjZObvE9HwtAz4vsbTOiQf677po6nfWLRbKHFC3RmIKDKu+9+PwRO:x/IZObvE9H8Az4vsXOiQf677pjnfWNUy

Score

10^/10

Modifies firewall policy service 3 TTPs 2 IoCs

evasion

Modify Registry

Windows Service

Disable or Modify System Firewall

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\regsvr32.exe = "C:\\Windows\\SysWOW64\\regsvr32.exe:*:Enabled:Windows Update"	regsvr32.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2872-0-0x00000000001D0000-0x0000000000200000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

Bootkit

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	regsvr32.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EA3775F2-28BE-11D3-9C8D-00105A24ED29}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EA3775F2-28BE-11D3-9C8D-00105A24ED29}\ = "Sample Shell Icon Overlay Identifier"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EA3775F2-28BE-11D3-9C8D-00105A24ED29}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EA3775F2-28BE-11D3-9C8D-00105A24ED29}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4d9a85750ae4df06bcdbdac7890d81f4_JaffaCakes118.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EA3775F2-28BE-11D3-9C8D-00105A24ED29}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2872	2088	regsvr32.exe	30
PID 2088 wrote to memory of 2872	2088	regsvr32.exe	30
PID 2088 wrote to memory of 2872	2088	regsvr32.exe	30
PID 2088 wrote to memory of 2872	2088	regsvr32.exe	30
PID 2088 wrote to memory of 2872	2088	regsvr32.exe	30
PID 2088 wrote to memory of 2872	2088	regsvr32.exe	30
PID 2088 wrote to memory of 2872	2088	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4d9a85750ae4df06bcdbdac7890d81f4_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4d9a85750ae4df06bcdbdac7890d81f4_JaffaCakes118.dll
  2⤵
  - Modifies firewall policy service
  - Writes to the Master Boot Record (MBR)
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:2872