bcf915a1e8b1e69d83d0f605d2afa2cb19998d52dc3127656f66fa361e8b2124

Analysis

max time kernel
143s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 13:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe
Size

396KB
MD5

86296295f1186642a7150fdca3b51e74
SHA1

887538d7b683c13e4d20dc42ed09926a8bde9f76
SHA256

bcf915a1e8b1e69d83d0f605d2afa2cb19998d52dc3127656f66fa361e8b2124
SHA512

0472b28b6cdccb1c5bdfcaa3b5c6f08f08cb57c6feea1e94f43b424dc87a9d34c62ebe888892367e04336880a8d127aaa9eb75650fba3a85b812468aa0633279
SSDEEP

6144:J+4M+0Iew8nGRoMv/WB8R7js5PrG0+z3:J+Nqt/2G0

Score

10^/10

discovery evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 10 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\raidhost.exe = "C:\\Windows\\raidhost.exe:*:Enabled:Windows Messanger"	reg.exe

Executes dropped EXE 2 IoCs

pid	Process
972	raidhost.exe
1756	raidhost.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3096-6-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/3096-5-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/3096-7-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/3096-3-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/3096-9-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/1756-23-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/1756-32-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/1756-33-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/1756-34-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/1756-35-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/1756-36-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/1756-37-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/1756-38-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/1756-39-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/1756-40-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/1756-41-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/1756-42-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/1756-43-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/1756-44-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/1756-45-0x0000000000400000-0x0000000000457000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\raidhost = "raidhost.exe"	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 244 set thread context of 3096	244	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe	86
PID 972 set thread context of 1756	972	raidhost.exe	94

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\raidhost.exe	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe
File opened for modification	C:\Windows\raidhost.exe	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	raidhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	raidhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
2848	reg.exe
3116	reg.exe
4916	reg.exe
4740	reg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
244	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe
972	raidhost.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 244 wrote to memory of 1468	244	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe	84
PID 244 wrote to memory of 1468	244	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe	84
PID 244 wrote to memory of 1468	244	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe	84
PID 244 wrote to memory of 4840	244	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe	85
PID 244 wrote to memory of 4840	244	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe	85
PID 244 wrote to memory of 4840	244	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe	85
PID 244 wrote to memory of 3096	244	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe	86
PID 244 wrote to memory of 3096	244	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe	86
PID 244 wrote to memory of 3096	244	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe	86
PID 244 wrote to memory of 3096	244	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe	86
PID 244 wrote to memory of 3096	244	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe	86
PID 244 wrote to memory of 3096	244	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe	86
PID 244 wrote to memory of 3096	244	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe	86
PID 244 wrote to memory of 3096	244	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe	86
PID 1468 wrote to memory of 4740	1468	cmd.exe	89
PID 1468 wrote to memory of 4740	1468	cmd.exe	89
PID 1468 wrote to memory of 4740	1468	cmd.exe	89
PID 4840 wrote to memory of 2848	4840	cmd.exe	90
PID 4840 wrote to memory of 2848	4840	cmd.exe	90
PID 4840 wrote to memory of 2848	4840	cmd.exe	90
PID 3096 wrote to memory of 972	3096	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe	91
PID 3096 wrote to memory of 972	3096	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe	91
PID 3096 wrote to memory of 972	3096	86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe	91
PID 972 wrote to memory of 1500	972	raidhost.exe	92
PID 972 wrote to memory of 1500	972	raidhost.exe	92
PID 972 wrote to memory of 1500	972	raidhost.exe	92
PID 972 wrote to memory of 3448	972	raidhost.exe	93
PID 972 wrote to memory of 3448	972	raidhost.exe	93
PID 972 wrote to memory of 3448	972	raidhost.exe	93
PID 972 wrote to memory of 1756	972	raidhost.exe	94
PID 972 wrote to memory of 1756	972	raidhost.exe	94
PID 972 wrote to memory of 1756	972	raidhost.exe	94
PID 972 wrote to memory of 1756	972	raidhost.exe	94
PID 972 wrote to memory of 1756	972	raidhost.exe	94
PID 972 wrote to memory of 1756	972	raidhost.exe	94
PID 972 wrote to memory of 1756	972	raidhost.exe	94
PID 972 wrote to memory of 1756	972	raidhost.exe	94
PID 1500 wrote to memory of 3116	1500	cmd.exe	97
PID 1500 wrote to memory of 3116	1500	cmd.exe	97
PID 1500 wrote to memory of 3116	1500	cmd.exe	97
PID 3448 wrote to memory of 4916	3448	cmd.exe	98
PID 3448 wrote to memory of 4916	3448	cmd.exe	98
PID 3448 wrote to memory of 4916	3448	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:244
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2848
- C:\Users\Admin\AppData\Local\Temp\86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\86296295f1186642a7150fdca3b51e74_JaffaCakes118.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\raidhost.exe
    "C:\Windows\raidhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:972
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1500
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3116
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\raidhost.exe" /t REG_SZ /d "C:\Windows\raidhost.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3448
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\raidhost.exe" /t REG_SZ /d "C:\Windows\raidhost.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4916
  - - C:\Windows\raidhost.exe
      "C:\Windows\raidhost.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\raidhost.exe

Filesize
396KB

MD5
86296295f1186642a7150fdca3b51e74

SHA1
887538d7b683c13e4d20dc42ed09926a8bde9f76

SHA256
bcf915a1e8b1e69d83d0f605d2afa2cb19998d52dc3127656f66fa361e8b2124

SHA512
0472b28b6cdccb1c5bdfcaa3b5c6f08f08cb57c6feea1e94f43b424dc87a9d34c62ebe888892367e04336880a8d127aaa9eb75650fba3a85b812468aa0633279

Download Submit
memory/244-8-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/244-0-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/972-24-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1756-40-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1756-39-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1756-45-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1756-44-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1756-23-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1756-43-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1756-32-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1756-33-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1756-34-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1756-35-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1756-36-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1756-37-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1756-38-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1756-42-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1756-41-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3096-6-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3096-3-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3096-5-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3096-7-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3096-9-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads