1ad04444db1add15f5332e9f63e9b52f54709a2cfe51b691df89dc6687ff054e

Analysis

max time kernel
142s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef18a9a4061501cf648fa02698df1d47_JaffaCakes118.exe
Size

84KB
MD5

ef18a9a4061501cf648fa02698df1d47
SHA1

6fc7034a4673cbe4f8462ac2ba81bedb2bc6f19b
SHA256

1ad04444db1add15f5332e9f63e9b52f54709a2cfe51b691df89dc6687ff054e
SHA512

e7b095db1eab8ccec17beafe3e8b0f7072a7dbc81762a54a3cf18121eafeacd194558c554fcc36e3a2fa5c1ef4393bf565674c3b684293f1e41647c2e4c851de
SSDEEP

1536:tC2VAQKy9C7qC7r/DSv7jPyzkWODMdnx3MsJZjoQ10JwU6g/212d2yCSf+CR:kECmC7rGvnPyzk/s5MsJZCqw2YiSWQ

Score

10^/10

discovery evasion upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	150105.exe

Executes dropped EXE 2 IoCs

pid	Process
2548	150105.exe
2364	150105.exe

Loads dropped DLL 2 IoCs

pid	Process
2908	ef18a9a4061501cf648fa02698df1d47_JaffaCakes118.exe
2908	ef18a9a4061501cf648fa02698df1d47_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000800000001688f-7.dat	upx
behavioral1/memory/2548-17-0x0000000000400000-0x000000000047F000-memory.dmp	upx
behavioral1/memory/2548-16-0x0000000000400000-0x000000000047F000-memory.dmp	upx
behavioral1/memory/2364-23-0x0000000000400000-0x000000000047F000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	150105.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\150105.exe	ef18a9a4061501cf648fa02698df1d47_JaffaCakes118.exe
File created	C:\Windows\web\ddid	ef18a9a4061501cf648fa02698df1d47_JaffaCakes118.exe
File created	C:\Windows\web\ddnm	ef18a9a4061501cf648fa02698df1d47_JaffaCakes118.exe
File created	C:\Windows\web\ddsn	ef18a9a4061501cf648fa02698df1d47_JaffaCakes118.exe
File created	C:\Windows\system\150105.exe	ef18a9a4061501cf648fa02698df1d47_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef18a9a4061501cf648fa02698df1d47_JaffaCakes118.exe

Modifies data under HKEY_USERS 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ECD8A8C1-E138-492D-AA7C-91C36501195A}\WpadNetworkName = "Network 3"	150105.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	150105.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	150105.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	150105.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	150105.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-66-11-35-7d-66\WpadDecisionTime = c00318d7e10bdb01	150105.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	150105.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ECD8A8C1-E138-492D-AA7C-91C36501195A}	150105.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ECD8A8C1-E138-492D-AA7C-91C36501195A}\WpadDecisionTime = a06f1dd1e10bdb01	150105.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-66-11-35-7d-66	150105.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ECD8A8C1-E138-492D-AA7C-91C36501195A}\96-66-11-35-7d-66	150105.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	150105.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	150105.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-66-11-35-7d-66\WpadDetectedUrl	150105.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	150105.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ECD8A8C1-E138-492D-AA7C-91C36501195A}\WpadDecisionTime = c00318d7e10bdb01	150105.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ECD8A8C1-E138-492D-AA7C-91C36501195A}\WpadDecisionReason = "1"	150105.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	150105.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-66-11-35-7d-66\WpadDecision = "0"	150105.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	150105.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ECD8A8C1-E138-492D-AA7C-91C36501195A}\WpadDecision = "0"	150105.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	150105.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	150105.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	150105.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-66-11-35-7d-66\WpadDecisionReason = "1"	150105.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	150105.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	150105.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-66-11-35-7d-66\WpadDecisionTime = a06f1dd1e10bdb01	150105.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2548	2908	ef18a9a4061501cf648fa02698df1d47_JaffaCakes118.exe	30
PID 2908 wrote to memory of 2548	2908	ef18a9a4061501cf648fa02698df1d47_JaffaCakes118.exe	30
PID 2908 wrote to memory of 2548	2908	ef18a9a4061501cf648fa02698df1d47_JaffaCakes118.exe	30
PID 2908 wrote to memory of 2548	2908	ef18a9a4061501cf648fa02698df1d47_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\ef18a9a4061501cf648fa02698df1d47_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ef18a9a4061501cf648fa02698df1d47_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\system\150105.exe
  "C:\Windows\system\150105.exe" /start
  2⤵
  - Executes dropped EXE
  PID:2548

C:\Windows\system\150105.exe
C:\Windows\system\150105.exe
1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\web\ddid

Filesize
6B

MD5
ca504eec9c363347d772f7890b4b2a56

SHA1
16abf96a531f661f0c815fe4ecd981aa8142683b

SHA256
97a7783741de12242b6d1f220ce0831ce1137b3ff5d620737ddc4859d7ac699c

SHA512
8f14600642aed0a3ecd362e4a1f876c93ee53764964c2a6761e86b0010c489badfbfb91daa6425998299f9fed30bd684dc14f09f2499885abb5c345fa4215a0f

Download Submit
C:\Windows\web\ddnm

Filesize
10B

MD5
f158a44688c6d5a5a1d57630166b73d8

SHA1
08971607e2f2e0e32769fc179b61407ecd04e190

SHA256
95d5ad8a138aa3e7af6fe45415b7dcd01db97140e3292a36e3adbf478ddd06d3

SHA512
f19f40f9cc917d842447948b7aeffbc1ee0501df50e870aeb2ef91e2edc9ff9fac79e60740163f0d1d075b46bf2984bcc99eb37ab5fff678b19d70158e1937e9

Download Submit
C:\Windows\web\ddsn

Filesize
5B

MD5
0b70b95deb2dfeeb11aa462c44169894

SHA1
c910b57b3b3b2a613e623c0101fbd8d6601ed957

SHA256
9acec3bdc2a2cda7b170a12131b4965cf2bbce227620db3c3ce6a29dc3f76c2a

SHA512
2fefc2a5e04081a7e8725c023cc2ed6f1065ed89d8126ec3ab4cbb3e5599249f0f2fb1c20caaa9ba07b6a0a8607d73d9849848976a39f518859f5f6943d9fb70

Download Submit
\Windows\system\150105.exe

Filesize
84KB

MD5
ef18a9a4061501cf648fa02698df1d47

SHA1
6fc7034a4673cbe4f8462ac2ba81bedb2bc6f19b

SHA256
1ad04444db1add15f5332e9f63e9b52f54709a2cfe51b691df89dc6687ff054e

SHA512
e7b095db1eab8ccec17beafe3e8b0f7072a7dbc81762a54a3cf18121eafeacd194558c554fcc36e3a2fa5c1ef4393bf565674c3b684293f1e41647c2e4c851de

Download Submit
memory/2364-24-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2364-23-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2364-25-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2364-28-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2364-30-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2548-16-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2548-17-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2548-21-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2548-27-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-15-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-3-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-4-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads