e63cf677e6ab388e8cf3c17ed25c7cd41eeb72b3f187afc257d4b1d09596f98f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 14:24

Target

6387d3117b2d326ae165de546688e630_JaffaCakes118.exe
Size

31KB
MD5

6387d3117b2d326ae165de546688e630
SHA1

8e16cbfdf24e3883fc4c90de68c149896eb0d967
SHA256

e63cf677e6ab388e8cf3c17ed25c7cd41eeb72b3f187afc257d4b1d09596f98f
SHA512

c33569b84b2ffd5390d60675aad073186a1d144107bad4bb3ddeddae154e31d4530590bf3d100b8badf41d9bea53d0481517753d21973ebc13610edd232e1743
SSDEEP

768:F9PsKCQ6+VzXixl6Xvftxc1w175+agIFb11dME2kRO:p6+tDXvftx8o5xJfRO

Score

8^/10

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

Disable or Modify System Firewall

pid	Process
2324	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2324	3040	6387d3117b2d326ae165de546688e630_JaffaCakes118.exe	31
PID 3040 wrote to memory of 2324	3040	6387d3117b2d326ae165de546688e630_JaffaCakes118.exe	31
PID 3040 wrote to memory of 2324	3040	6387d3117b2d326ae165de546688e630_JaffaCakes118.exe	31
PID 3040 wrote to memory of 2324	3040	6387d3117b2d326ae165de546688e630_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\6387d3117b2d326ae165de546688e630_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6387d3117b2d326ae165de546688e630_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\netsh.exe
  "netsh.exe" firewall add allowedprogram C:\Windows\system\WindowsUpdater.exe Windows_Update Enable
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2324