7c1c73ab42696e39505979ff9238b35a3c4bd60dda2576ba8770cd7a297c37d7

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 07:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b0ea51e95974f2df1524a19d798c422_JaffaCakes118.exe
Size

172KB
MD5

5b0ea51e95974f2df1524a19d798c422
SHA1

21e2ffb6e2d230736847548795cbc7fb6e59c136
SHA256

7c1c73ab42696e39505979ff9238b35a3c4bd60dda2576ba8770cd7a297c37d7
SHA512

bf02f4e9b3e4a65dd3f3272168ab88b7ab894a5ecbe72c92f68362953c40f7fb3c116fbd59c41095602ff796084cf0ab313e8a7eb855ee54410ec3e11cb38da0
SSDEEP

3072:H2YOj+Rd/HB7oV7HV3ffDoStyMhV5HRHULEZ3+1/9qOFzk:hOj+rWJffMWhV5HRHUgItFz

Score

8^/10

evasion execution persistence privilege_escalation

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\npi.sys	5b0ea51e95974f2df1524a19d798c422_JaffaCakes118.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1524	netsh.exe
1500	netsh.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\npii\parameters\servicedll = "C:\\Windows\\system32\\npi.dll"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
2696	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\npi.dll	5b0ea51e95974f2df1524a19d798c422_JaffaCakes118.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2744	sc.exe
2896	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\TI = "TI"	svchost.exe
Key created	\REGISTRY\MACHINE\software\Wow6432Node\microsoft\internet explorer\main	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
472	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2696	svchost.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2124	2624	5b0ea51e95974f2df1524a19d798c422_JaffaCakes118.exe	31
PID 2624 wrote to memory of 2124	2624	5b0ea51e95974f2df1524a19d798c422_JaffaCakes118.exe	31
PID 2624 wrote to memory of 2124	2624	5b0ea51e95974f2df1524a19d798c422_JaffaCakes118.exe	31
PID 2624 wrote to memory of 2124	2624	5b0ea51e95974f2df1524a19d798c422_JaffaCakes118.exe	31
PID 2124 wrote to memory of 1524	2124	cmd.exe	33
PID 2124 wrote to memory of 1524	2124	cmd.exe	33
PID 2124 wrote to memory of 1524	2124	cmd.exe	33
PID 2124 wrote to memory of 1524	2124	cmd.exe	33
PID 2124 wrote to memory of 1500	2124	cmd.exe	34
PID 2124 wrote to memory of 1500	2124	cmd.exe	34
PID 2124 wrote to memory of 1500	2124	cmd.exe	34
PID 2124 wrote to memory of 1500	2124	cmd.exe	34
PID 2124 wrote to memory of 2744	2124	cmd.exe	35
PID 2124 wrote to memory of 2744	2124	cmd.exe	35
PID 2124 wrote to memory of 2744	2124	cmd.exe	35
PID 2124 wrote to memory of 2744	2124	cmd.exe	35
PID 2124 wrote to memory of 2756	2124	cmd.exe	36
PID 2124 wrote to memory of 2756	2124	cmd.exe	36
PID 2124 wrote to memory of 2756	2124	cmd.exe	36
PID 2124 wrote to memory of 2756	2124	cmd.exe	36
PID 2124 wrote to memory of 2780	2124	cmd.exe	37
PID 2124 wrote to memory of 2780	2124	cmd.exe	37
PID 2124 wrote to memory of 2780	2124	cmd.exe	37
PID 2124 wrote to memory of 2780	2124	cmd.exe	37
PID 2124 wrote to memory of 2796	2124	cmd.exe	38
PID 2124 wrote to memory of 2796	2124	cmd.exe	38
PID 2124 wrote to memory of 2796	2124	cmd.exe	38
PID 2124 wrote to memory of 2796	2124	cmd.exe	38
PID 2124 wrote to memory of 2896	2124	cmd.exe	39
PID 2124 wrote to memory of 2896	2124	cmd.exe	39
PID 2124 wrote to memory of 2896	2124	cmd.exe	39
PID 2124 wrote to memory of 2896	2124	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\5b0ea51e95974f2df1524a19d798c422_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5b0ea51e95974f2df1524a19d798c422_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "%temp%\npi.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram name="npi" program="C:\Windows\system32\svchost.exe" mode=enable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1524
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add portopening tcp 8085 npi enable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1500
- - C:\Windows\SysWOW64\sc.exe
    sc create "npii" type= share start= auto binpath= "C:\Windows\system32\svchost.exe -k npii"
    3⤵
    - Launches sc.exe
    PID:2744
- - C:\Windows\SysWOW64\reg.exe
    reg add "hklm\system\currentcontrolset\services\npii\parameters" /v servicedll /t reg_expand_sz /d "C:\Windows\system32\npi.dll" /f
    3⤵
    - Server Software Component: Terminal Services DLL
    PID:2756
- - C:\Windows\SysWOW64\reg.exe
    reg add "hklm\system\currentcontrolset\services\npii" /v failureactions /t reg_binary /d 00000000000000000000000003000000140000000100000060ea00000100000060ea00000100000060ea0000 /f
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\reg.exe
    reg add "hklm\software\microsoft\windows nt\currentversion\svchost" /v npii /t reg_multi_sz /d "npii\0" /f
    3⤵
    PID:2796
- - C:\Windows\SysWOW64\sc.exe
    sc start npii
    3⤵
    - Launches sc.exe
    PID:2896

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k npii
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\npi.bat

Filesize
676B

MD5
8a8f907dad97578ff215aa154b8ea057

SHA1
23bf74b5fb95bc4a5d4a12d7b09f5a5f090567e1

SHA256
d839647d36425306ef0c961580d1b978ce72bf0956c1ff7bebc8bcc81b4849a5

SHA512
43aeaf2b9ca0888e513c318a05f30cc516b0d70e96d09429180e7c58772e58a1117b95d6ace80a121fdc8d1fdc8114c3d5a21d447fca7e512181226ffc4e181b

Download Submit
\??\c:\windows\SysWOW64\npi.dll

Filesize
49KB

MD5
4e56104661bb20c34e9c9516ccd9f79c

SHA1
aa9d95a438a019304d03bf097060ce719f883442

SHA256
bf8b85e9f6667ddec0675c354d21080d535f460bc2e1f742e11374ec6609e2a4

SHA512
cb5d392dbf4f55aab04d2bd91a4c55cde3e3d094506b607b78b5fcb4ccca216d2f1560f9afe465f04da4f9a594cfb19c26b354273bc75c98c5c229a3cfae9003

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads