303a9083457e47d857882825d4964982bdf02563383490f2704cc165ab2a6164

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 07:41 UTC

Target

c873297682ade13292f6630a612b6e4f_JaffaCakes118.vbs
Size

758B
MD5

c873297682ade13292f6630a612b6e4f
SHA1

a0ccfe79d08164cf346d1eb3e6b1f4a21ab34e5d
SHA256

303a9083457e47d857882825d4964982bdf02563383490f2704cc165ab2a6164
SHA512

02237291150d94743c47465754fb86342d4ece0ce996ed24502b191e68063a75884b6f36be2075ebc838d5300adb183c238cc9a6a55239bcc340b7f39901e035

Score

8^/10

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

Disable or Modify System Firewall

pid	Process
2364	netsh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2364	2264	WScript.exe	32
PID 2264 wrote to memory of 2364	2264	WScript.exe	32
PID 2264 wrote to memory of 2364	2264	WScript.exe	32

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c873297682ade13292f6630a612b6e4f_JaffaCakes118.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall add allowedprogram program=Shell_Update.exe name=Win32_ShellUpdate
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2364