Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14/10/2024, 18:52
General
-
Target
43b02f4d23f5345c08848f393784c4f5_JaffaCakes118.exe
-
Size
2.4MB
-
MD5
43b02f4d23f5345c08848f393784c4f5
-
SHA1
1ad20e65522a3d2f8ae60bd818a6fc994f3af6a7
-
SHA256
b2f93f83f31b369a3c068ecf4b1cd7d7122d8f4889f8d71d64dc48557b9d5fa2
-
SHA512
fbb26728a3b74a0ba9136da92b172ff366e95de6aa3102fd9f0cd223e1c9ad90b6fdf9fa835fd78d0155b3111b30af27ac656e0438cc3036af146125df799fdf
-
SSDEEP
49152:I2uUUvW8kjsKlrfnS4V8DN+6zg0BTdD0xpCKB+3UTnU2TpRZBJxjWI:y6lrnFgN+RETipCKB+3OpRZBJxl
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\43b02f4d23f5345c08848f393784c4f5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\43b02f4d23f5345c08848f393784c4f5_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram program = "c:\users\admin\appdata\local\temp\43b02f4d23f5345c08848f393784c4f5_jaffacakes118.exe" name = 43b02f4d23f5345c08848f393784c4f5_jaffacakes118.exe mode = ENABLE scope = ALL2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-