4116dc634bbd33fab1a31b6194ad2ff237912891ecb4fa24dfdc2f257dac68b9

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27-07-2024 06:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe
Size

3.3MB
MD5

773d45b236c51a24defb9a713c0c905c
SHA1

6a3d7eecb062b333424f7ea853dd8a31178b04ce
SHA256

4116dc634bbd33fab1a31b6194ad2ff237912891ecb4fa24dfdc2f257dac68b9
SHA512

5073a1f347c57c151f154ab2a96d85c6b1810a2b283460b8f84a430a0122d1da5188e2f727164a513c458dbbe6641705a2959728a6c4792e7055c73a090fe067
SSDEEP

49152:iGtlq/yIU6iP/GddQoErmuMt33fOktlCi3PwHaw6nIgOR3qQDzbR5IKAhEGiPKu1:u+P/ZMt33flCjjH5IbZBu3fsm

Score

8^/10

evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2476	sc.exe
2984	sc.exe
3848	sc.exe
4948	sc.exe
220	sc.exe
2824	sc.exe

Runs net.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 972	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	85
PID 1776 wrote to memory of 972	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	85
PID 1776 wrote to memory of 768	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	86
PID 1776 wrote to memory of 768	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	86
PID 768 wrote to memory of 724	768	cmd.exe	87
PID 768 wrote to memory of 724	768	cmd.exe	87
PID 724 wrote to memory of 3372	724	net.exe	88
PID 724 wrote to memory of 3372	724	net.exe	88
PID 1776 wrote to memory of 2900	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	89
PID 1776 wrote to memory of 2900	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	89
PID 2900 wrote to memory of 1312	2900	cmd.exe	90
PID 2900 wrote to memory of 1312	2900	cmd.exe	90
PID 1312 wrote to memory of 2528	1312	net.exe	91
PID 1312 wrote to memory of 2528	1312	net.exe	91
PID 1776 wrote to memory of 3480	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	92
PID 1776 wrote to memory of 3480	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	92
PID 3480 wrote to memory of 220	3480	cmd.exe	93
PID 3480 wrote to memory of 220	3480	cmd.exe	93
PID 1776 wrote to memory of 2888	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	94
PID 1776 wrote to memory of 2888	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	94
PID 2888 wrote to memory of 2824	2888	cmd.exe	95
PID 2888 wrote to memory of 2824	2888	cmd.exe	95
PID 1776 wrote to memory of 3620	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	96
PID 1776 wrote to memory of 3620	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	96
PID 3620 wrote to memory of 2476	3620	cmd.exe	97
PID 3620 wrote to memory of 2476	3620	cmd.exe	97
PID 1776 wrote to memory of 944	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	98
PID 1776 wrote to memory of 944	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	98
PID 944 wrote to memory of 2984	944	cmd.exe	99
PID 944 wrote to memory of 2984	944	cmd.exe	99
PID 1776 wrote to memory of 4220	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	100
PID 1776 wrote to memory of 4220	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	100
PID 4220 wrote to memory of 3848	4220	cmd.exe	101
PID 4220 wrote to memory of 3848	4220	cmd.exe	101
PID 1776 wrote to memory of 320	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	102
PID 1776 wrote to memory of 320	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	102
PID 320 wrote to memory of 4948	320	cmd.exe	103
PID 320 wrote to memory of 4948	320	cmd.exe	103
PID 1776 wrote to memory of 1708	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	104
PID 1776 wrote to memory of 1708	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	104
PID 1708 wrote to memory of 5104	1708	cmd.exe	105
PID 1708 wrote to memory of 5104	1708	cmd.exe	105
PID 5104 wrote to memory of 2988	5104	net.exe	106
PID 5104 wrote to memory of 2988	5104	net.exe	106
PID 1776 wrote to memory of 1208	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	107
PID 1776 wrote to memory of 1208	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	107
PID 1208 wrote to memory of 4116	1208	cmd.exe	108
PID 1208 wrote to memory of 4116	1208	cmd.exe	108
PID 4116 wrote to memory of 4268	4116	net.exe	109
PID 4116 wrote to memory of 4268	4116	net.exe	109
PID 1776 wrote to memory of 1748	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	118
PID 1776 wrote to memory of 1748	1776	773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe	118

C:\Users\Admin\AppData\Local\Temp\773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\773d45b236c51a24defb9a713c0c905c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop FACEIT >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:768
- - C:\Windows\system32\net.exe
    net stop FACEIT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:724
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop FACEIT
      4⤵
      PID:3372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop ESEADriver2 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\system32\net.exe
    net stop ESEADriver2
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1312
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop ESEADriver2
      4⤵
      PID:2528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:2824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    - Launches sc.exe
    PID:2476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    - Launches sc.exe
    PID:2984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    - Launches sc.exe
    PID:3848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    - Launches sc.exe
    PID:4948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop capsom >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\system32\net.exe
    net stop capsom
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop capsom
      4⤵
      PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop capsom.sys >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\system32\net.exe
    net stop capsom.sys
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop capsom.sys
      4⤵
      PID:4268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1748