Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 23:17
Static task
static1
Behavioral task
behavioral1
Sample
fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118.exe
-
Size
728KB
-
MD5
fd575edfeb16fb232e226e6bd753bb75
-
SHA1
a399ee49efb8d4ec0cc6535ced3c7f10130d42a1
-
SHA256
cc9097207ef76b80fdb91d1e9428012bf405360de4383e87b3d4e18d58c9002d
-
SHA512
797f1dfd0922e190cb8f5c174e7e08e783058b14187fc3a83e88c7805b1e8968b5f79868799a7eda3b8183cddb3c102245def93e80c3242eb54747480b920f5a
-
SSDEEP
12288:lEcF8D2K53tGcAOYYsLN2Z8bbX7/meGDgGeItoEc9GspWZhASRXHYnrmh:lEc8H5fMLN2Kb77rGlFtov9GsqRXHYrm
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 2608 netsh.exe 2516 netsh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2764 2700 fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118.exe 30 PID 2700 wrote to memory of 2764 2700 fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118.exe 30 PID 2700 wrote to memory of 2764 2700 fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118.exe 30 PID 2700 wrote to memory of 2764 2700 fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118.exe 30 PID 2700 wrote to memory of 2616 2700 fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118.exe 32 PID 2700 wrote to memory of 2616 2700 fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118.exe 32 PID 2700 wrote to memory of 2616 2700 fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118.exe 32 PID 2700 wrote to memory of 2616 2700 fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118.exe 32 PID 2700 wrote to memory of 3048 2700 fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118.exe 34 PID 2700 wrote to memory of 3048 2700 fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118.exe 34 PID 2700 wrote to memory of 3048 2700 fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118.exe 34 PID 2700 wrote to memory of 3048 2700 fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118.exe 34 PID 3048 wrote to memory of 2608 3048 cmd.exe 36 PID 3048 wrote to memory of 2608 3048 cmd.exe 36 PID 3048 wrote to memory of 2608 3048 cmd.exe 36 PID 3048 wrote to memory of 2608 3048 cmd.exe 36 PID 2700 wrote to memory of 2672 2700 fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118.exe 37 PID 2700 wrote to memory of 2672 2700 fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118.exe 37 PID 2700 wrote to memory of 2672 2700 fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118.exe 37 PID 2700 wrote to memory of 2672 2700 fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118.exe 37 PID 2672 wrote to memory of 2516 2672 cmd.exe 39 PID 2672 wrote to memory of 2516 2672 cmd.exe 39 PID 2672 wrote to memory of 2516 2672 cmd.exe 39 PID 2672 wrote to memory of 2516 2672 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\DirectDownloader"2⤵
- System Location Discovery: System Language Discovery
PID:2764
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C echo ifms > "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2616
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2608
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2516
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
249KB
MD5314d18e3f2e3052a4d232992ad89c32e
SHA1d30bbb99cb2cff88138776cef1c896e99dfc984d
SHA256a71031ac4729ed41b345e633b29ce7115c0e1ab3da5203c6e42753105d7c0171
SHA512d1267f14fca001fd49628d536440a5900312dc0e739321fe9ff9c17c6b87cc45d654ee54e095c08dc7ed8f70c2c2d12fc919656ac0324c35c3e0f70a5c90926b