1ad9dd8b7807f6af92186dc317651aa659c516db2f9c73962d19a6bfa911fdb5

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe
Size

127KB
MD5

67b68538e71290fd8398012ba33388bc
SHA1

ee934b857263094143722a5576d101fec8ac91b9
SHA256

1ad9dd8b7807f6af92186dc317651aa659c516db2f9c73962d19a6bfa911fdb5
SHA512

6fefe9e0ae31e7c246b078578eec22e6cf212ce250520016726645ee424d24322e151b0ec916362285cad25852a7b72799c7fd42772eb7971bcdc68b63127611
SSDEEP

3072:3Wu8RRyv6TDhOqqw4cBkor8QAi8t2dIaGwTF:3We6f7qw4cKor8QAi/IaG+F

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2704	netsh.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ujwak.exe	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ujwak.exe	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ujwak.exe	wvgiwx.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ujwak.exe	wvgiwx.exe

Executes dropped EXE 6 IoCs

pid	Process
2904	wvgiwx.exe
2836	wvgiwx.exe
2768	wvgiwx.exe
2612	wvgiwx.exe
1676	wvgiwx.exe
1836	wvgiwx.exe

Loads dropped DLL 6 IoCs

pid	Process
584	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe
2904	wvgiwx.exe
2836	wvgiwx.exe
2768	wvgiwx.exe
2612	wvgiwx.exe
1676	wvgiwx.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\xhuropdh = "C:\\Users\\Admin\\AppData\\Local\\wvgiwx.exe"	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\xhuropdh = "C:\\Users\\Admin\\AppData\\Local\\wvgiwx.exe"	wvgiwx.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\xhuropdh = "C:\\Users\\Admin\\AppData\\Local\\wvgiwx.exe"	wvgiwx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\xhuropdh = "C:\\Users\\Admin\\AppData\\Local\\wvgiwx.exe"	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2896 set thread context of 584	2896	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	34
PID 1676 set thread context of 1836	1676	wvgiwx.exe	41

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 1792	2564	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	30
PID 2564 wrote to memory of 1792	2564	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	30
PID 2564 wrote to memory of 1792	2564	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	30
PID 2564 wrote to memory of 1792	2564	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	30
PID 1792 wrote to memory of 1788	1792	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	31
PID 1792 wrote to memory of 1788	1792	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	31
PID 1792 wrote to memory of 1788	1792	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	31
PID 1792 wrote to memory of 1788	1792	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	31
PID 1788 wrote to memory of 536	1788	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	32
PID 1788 wrote to memory of 536	1788	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	32
PID 1788 wrote to memory of 536	1788	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	32
PID 1788 wrote to memory of 536	1788	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	32
PID 536 wrote to memory of 2896	536	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	33
PID 536 wrote to memory of 2896	536	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	33
PID 536 wrote to memory of 2896	536	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	33
PID 536 wrote to memory of 2896	536	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	33
PID 2896 wrote to memory of 584	2896	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	34
PID 2896 wrote to memory of 584	2896	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	34
PID 2896 wrote to memory of 584	2896	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	34
PID 2896 wrote to memory of 584	2896	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	34
PID 2896 wrote to memory of 584	2896	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	34
PID 2896 wrote to memory of 584	2896	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	34
PID 2896 wrote to memory of 584	2896	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	34
PID 2896 wrote to memory of 584	2896	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	34
PID 584 wrote to memory of 2704	584	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	35
PID 584 wrote to memory of 2704	584	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	35
PID 584 wrote to memory of 2704	584	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	35
PID 584 wrote to memory of 2704	584	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	35
PID 584 wrote to memory of 2904	584	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	36
PID 584 wrote to memory of 2904	584	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	36
PID 584 wrote to memory of 2904	584	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	36
PID 584 wrote to memory of 2904	584	67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe	36
PID 2904 wrote to memory of 2836	2904	wvgiwx.exe	37
PID 2904 wrote to memory of 2836	2904	wvgiwx.exe	37
PID 2904 wrote to memory of 2836	2904	wvgiwx.exe	37
PID 2904 wrote to memory of 2836	2904	wvgiwx.exe	37
PID 2836 wrote to memory of 2768	2836	wvgiwx.exe	38
PID 2836 wrote to memory of 2768	2836	wvgiwx.exe	38
PID 2836 wrote to memory of 2768	2836	wvgiwx.exe	38
PID 2836 wrote to memory of 2768	2836	wvgiwx.exe	38
PID 2768 wrote to memory of 2612	2768	wvgiwx.exe	39
PID 2768 wrote to memory of 2612	2768	wvgiwx.exe	39
PID 2768 wrote to memory of 2612	2768	wvgiwx.exe	39
PID 2768 wrote to memory of 2612	2768	wvgiwx.exe	39
PID 2612 wrote to memory of 1676	2612	wvgiwx.exe	40
PID 2612 wrote to memory of 1676	2612	wvgiwx.exe	40
PID 2612 wrote to memory of 1676	2612	wvgiwx.exe	40
PID 2612 wrote to memory of 1676	2612	wvgiwx.exe	40
PID 1676 wrote to memory of 1836	1676	wvgiwx.exe	41
PID 1676 wrote to memory of 1836	1676	wvgiwx.exe	41
PID 1676 wrote to memory of 1836	1676	wvgiwx.exe	41
PID 1676 wrote to memory of 1836	1676	wvgiwx.exe	41
PID 1676 wrote to memory of 1836	1676	wvgiwx.exe	41
PID 1676 wrote to memory of 1836	1676	wvgiwx.exe	41
PID 1676 wrote to memory of 1836	1676	wvgiwx.exe	41
PID 1676 wrote to memory of 1836	1676	wvgiwx.exe	41

C:\Users\Admin\AppData\Local\Temp\67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Users\Admin\AppData\Local\Temp\67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe
  1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Users\Admin\AppData\Local\Temp\67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe
    2
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe
      3
      4⤵
      Suspicious use of WriteProcessMemory
      PID:536
    - - C:\Users\Admin\AppData\Local\Temp\67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe
        
        4
        5⤵
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\67b68538e71290fd8398012ba33388bc_JaffaCakes118.exe
        6⤵
        Drops startup file
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:584
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram 1.exe 1 ENABLE
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\wvgiwx.exe
        
        "C:\Users\Admin\AppData\Local\wvgiwx.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\wvgiwx.exe
        
        1
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\wvgiwx.exe
        
        2
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\wvgiwx.exe
        
        3
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\wvgiwx.exe
        
        4
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\wvgiwx.exe
        
        C:\Users\Admin\AppData\Local\wvgiwx.exe
        12⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\wvgiwx.exe

Filesize
127KB

MD5
67b68538e71290fd8398012ba33388bc

SHA1
ee934b857263094143722a5576d101fec8ac91b9

SHA256
1ad9dd8b7807f6af92186dc317651aa659c516db2f9c73962d19a6bfa911fdb5

SHA512
6fefe9e0ae31e7c246b078578eec22e6cf212ce250520016726645ee424d24322e151b0ec916362285cad25852a7b72799c7fd42772eb7971bcdc68b63127611

Download Submit
memory/536-18-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/536-19-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/584-37-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/584-49-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/584-47-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/584-35-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/584-103-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/584-39-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/584-41-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/584-57-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1676-117-0x00000000005E0000-0x00000000006E0000-memory.dmp

Filesize
1024KB

Download
memory/1676-115-0x00000000005E0000-0x00000000006E0000-memory.dmp

Filesize
1024KB

Download
memory/1676-116-0x00000000005E0000-0x00000000006E0000-memory.dmp

Filesize
1024KB

Download
memory/1792-7-0x00000000004D0000-0x00000000005D0000-memory.dmp

Filesize
1024KB

Download
memory/1792-8-0x00000000004D0000-0x00000000005D0000-memory.dmp

Filesize
1024KB

Download
memory/1836-126-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1836-131-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1836-122-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1836-130-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1836-129-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1836-128-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1836-123-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1836-127-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1836-125-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2564-1-0x0000000000260000-0x0000000000360000-memory.dmp

Filesize
1024KB

Download
memory/2564-0-0x0000000000260000-0x0000000000360000-memory.dmp

Filesize
1024KB

Download
memory/2768-76-0x0000000000560000-0x0000000000660000-memory.dmp

Filesize
1024KB

Download
memory/2768-77-0x0000000000560000-0x0000000000660000-memory.dmp

Filesize
1024KB

Download
memory/2896-124-0x00000000002C0000-0x00000000003C0000-memory.dmp

Filesize
1024KB

Download
memory/2896-44-0x00000000002C0000-0x00000000003C0000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads