15ba9a974098b9296957875083062b1113c0615a943d8897ec2758c965e68d65

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/08/2024, 18:53

Target

945217ff6a2a54d759730eb17b17a663_JaffaCakes118.exe
Size

48KB
MD5

945217ff6a2a54d759730eb17b17a663
SHA1

9acb38c6531f2edb4bf6eb070451a4d6506a3886
SHA256

15ba9a974098b9296957875083062b1113c0615a943d8897ec2758c965e68d65
SHA512

a9bcba5ae9d643c55586a6c8970f4422500b03aa46eb233889a8fb1cd4acfd81c4c24afd82251548f8a99911777359e4c94b5b55bc7a015b0a4db4876b2d8c64
SSDEEP

384:E+/knl/RuGqiNAd+uVETXQTASlu5aXtHou/5nNbRQiGNdDSsFqJS+Dryd8p+u:ZWM5d+uVETXQegXlxzW6p+u

Score

8^/10

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2544	sc.exe
1448	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	945217ff6a2a54d759730eb17b17a663_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2116	945217ff6a2a54d759730eb17b17a663_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 1680	2116	945217ff6a2a54d759730eb17b17a663_JaffaCakes118.exe	30
PID 2116 wrote to memory of 1680	2116	945217ff6a2a54d759730eb17b17a663_JaffaCakes118.exe	30
PID 2116 wrote to memory of 1680	2116	945217ff6a2a54d759730eb17b17a663_JaffaCakes118.exe	30
PID 2116 wrote to memory of 1680	2116	945217ff6a2a54d759730eb17b17a663_JaffaCakes118.exe	30
PID 2116 wrote to memory of 2400	2116	945217ff6a2a54d759730eb17b17a663_JaffaCakes118.exe	31
PID 2116 wrote to memory of 2400	2116	945217ff6a2a54d759730eb17b17a663_JaffaCakes118.exe	31
PID 2116 wrote to memory of 2400	2116	945217ff6a2a54d759730eb17b17a663_JaffaCakes118.exe	31
PID 2116 wrote to memory of 2400	2116	945217ff6a2a54d759730eb17b17a663_JaffaCakes118.exe	31
PID 2400 wrote to memory of 1448	2400	cmd.exe	34
PID 2400 wrote to memory of 1448	2400	cmd.exe	34
PID 2400 wrote to memory of 1448	2400	cmd.exe	34
PID 2400 wrote to memory of 1448	2400	cmd.exe	34
PID 1680 wrote to memory of 2544	1680	cmd.exe	35
PID 1680 wrote to memory of 2544	1680	cmd.exe	35
PID 1680 wrote to memory of 2544	1680	cmd.exe	35
PID 1680 wrote to memory of 2544	1680	cmd.exe	35