Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20/09/2024, 09:39
General
-
Target
ed511ce684eb3b3dd5f23d1d545120e6_JaffaCakes118.exe
-
Size
14KB
-
MD5
ed511ce684eb3b3dd5f23d1d545120e6
-
SHA1
41fda889ba4aeda72caeab2a6ee018bf9f2ff3b8
-
SHA256
ed422a2cb60fdd4b402839b5bd6ab80f2a7e518b23733234c3bcc315375cfd06
-
SHA512
604ec9b554a36a8a30060de9f479e2c7cff2e6ea6bf48b0d3e69a0259d8d5523defcfd70b712e6441b09ff690cddd86aedcd1853e51d2c7e76348d7f0da84e71
-
SSDEEP
192:W80nffy32NaofZDm9fcfUX987PcImAB8uuNvf4YbZy/4aRBn6jCxKDI4CIlhJPH:W8eyGNaoQ9fRzRNf4KZrMWaiI4Tlhx
Malware Config
Signatures
-
UAC bypass 3 TTPs 1 IoCs
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed511ce684eb3b3dd5f23d1d545120e6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ed511ce684eb3b3dd5f23d1d545120e6_JaffaCakes118.exe"1⤵
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\Netsh.exe"Netsh" Advfirewall set Currentprofile State off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
4.8MB
-
Filesize
9.6MB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
392KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB