d989d682abae81162d7fe9ee3e9360fc3e4d2c8cb02eff69c385e0d7c3a26b95

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aa35e4b57c1cffa400252d7c0ed86489_JaffaCakes118.exe
Size

96KB
MD5

aa35e4b57c1cffa400252d7c0ed86489
SHA1

66ff11b0799df69bf02711518197d89f5b09f5c4
SHA256

d989d682abae81162d7fe9ee3e9360fc3e4d2c8cb02eff69c385e0d7c3a26b95
SHA512

1127fd5019cd94f7e15a6109fa274539b64ad676ee12897fa7252ff1f96ae92c9493fa855e94a90685d4be7d2afd5d675e9e882e7879f57a4b80052ac7215c17
SSDEEP

1536:iKY6w0gUYfy8INUt5RonVKwjZ4mJzrVnrmrPfIqBVz/fTT:k0gfy8OUZondp10Iqvz/fTT

Score

10^/10

evasion execution

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Deletes itself 1 IoCs

pid	Process
4260	explorer.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2360	sc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4628	aa35e4b57c1cffa400252d7c0ed86489_JaffaCakes118.exe
4628	aa35e4b57c1cffa400252d7c0ed86489_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4628	aa35e4b57c1cffa400252d7c0ed86489_JaffaCakes118.exe
4260	explorer.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 4260	4628	aa35e4b57c1cffa400252d7c0ed86489_JaffaCakes118.exe	94
PID 4628 wrote to memory of 4260	4628	aa35e4b57c1cffa400252d7c0ed86489_JaffaCakes118.exe	94
PID 4628 wrote to memory of 4260	4628	aa35e4b57c1cffa400252d7c0ed86489_JaffaCakes118.exe	94
PID 4260 wrote to memory of 2728	4260	explorer.exe	95
PID 4260 wrote to memory of 2728	4260	explorer.exe	95
PID 4260 wrote to memory of 2728	4260	explorer.exe	95
PID 4260 wrote to memory of 3496	4260	explorer.exe	96
PID 4260 wrote to memory of 3496	4260	explorer.exe	96
PID 4260 wrote to memory of 3496	4260	explorer.exe	96
PID 4260 wrote to memory of 4584	4260	explorer.exe	99
PID 4260 wrote to memory of 4584	4260	explorer.exe	99
PID 4260 wrote to memory of 4864	4260	explorer.exe	100
PID 4260 wrote to memory of 4864	4260	explorer.exe	100
PID 4260 wrote to memory of 4864	4260	explorer.exe	100
PID 3496 wrote to memory of 2360	3496	cmd.exe	101
PID 3496 wrote to memory of 2360	3496	cmd.exe	101
PID 3496 wrote to memory of 2360	3496	cmd.exe	101
PID 2728 wrote to memory of 4172	2728	cmd.exe	102
PID 2728 wrote to memory of 4172	2728	cmd.exe	102
PID 2728 wrote to memory of 4172	2728	cmd.exe	102
PID 4172 wrote to memory of 4580	4172	net.exe	103
PID 4172 wrote to memory of 4580	4172	net.exe	103
PID 4172 wrote to memory of 4580	4172	net.exe	103

C:\Users\Admin\AppData\Local\Temp\aa35e4b57c1cffa400252d7c0ed86489_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aa35e4b57c1cffa400252d7c0ed86489_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  - Deletes itself
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop mpssvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\SysWOW64\net.exe
      net stop mpssvc
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4172
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop mpssvc
        5⤵
        
        PID:4580
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c sc config mpssvc start= disabled
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Windows\SysWOW64\sc.exe
      sc config mpssvc start= disabled
      4⤵
      Launches sc.exe
      PID:2360
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    3⤵
    PID:4584
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:4864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1284,i,16488180140590516186,11762960689811837350,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
1⤵
PID:4404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4260-2-0x0000000000880000-0x0000000000CB3000-memory.dmp

Filesize
4.2MB

Download
memory/4260-4-0x0000000000880000-0x0000000000CB3000-memory.dmp

Filesize
4.2MB

Download
memory/4260-5-0x0000000000880000-0x0000000000CB3000-memory.dmp

Filesize
4.2MB

Download
memory/4628-0-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/4628-1-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4864-8-0x00000000009E0000-0x00000000009EE000-memory.dmp

Filesize
56KB

Download
memory/4864-6-0x00000000009E0000-0x00000000009EE000-memory.dmp

Filesize
56KB

Download
memory/4864-10-0x00000000009E0000-0x00000000009EE000-memory.dmp

Filesize
56KB

Download