15ba9a974098b9296957875083062b1113c0615a943d8897ec2758c965e68d65

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 18:53

Target

945217ff6a2a54d759730eb17b17a663_JaffaCakes118.exe
Size

48KB
MD5

945217ff6a2a54d759730eb17b17a663
SHA1

9acb38c6531f2edb4bf6eb070451a4d6506a3886
SHA256

15ba9a974098b9296957875083062b1113c0615a943d8897ec2758c965e68d65
SHA512

a9bcba5ae9d643c55586a6c8970f4422500b03aa46eb233889a8fb1cd4acfd81c4c24afd82251548f8a99911777359e4c94b5b55bc7a015b0a4db4876b2d8c64
SSDEEP

384:E+/knl/RuGqiNAd+uVETXQTASlu5aXtHou/5nNbRQiGNdDSsFqJS+Dryd8p+u:ZWM5d+uVETXQegXlxzW6p+u

Score

8^/10

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4424	sc.exe
2496	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	945217ff6a2a54d759730eb17b17a663_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4100	945217ff6a2a54d759730eb17b17a663_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 5068	4100	945217ff6a2a54d759730eb17b17a663_JaffaCakes118.exe	85
PID 4100 wrote to memory of 5068	4100	945217ff6a2a54d759730eb17b17a663_JaffaCakes118.exe	85
PID 4100 wrote to memory of 5068	4100	945217ff6a2a54d759730eb17b17a663_JaffaCakes118.exe	85
PID 4100 wrote to memory of 624	4100	945217ff6a2a54d759730eb17b17a663_JaffaCakes118.exe	87
PID 4100 wrote to memory of 624	4100	945217ff6a2a54d759730eb17b17a663_JaffaCakes118.exe	87
PID 4100 wrote to memory of 624	4100	945217ff6a2a54d759730eb17b17a663_JaffaCakes118.exe	87
PID 5068 wrote to memory of 4424	5068	cmd.exe	90
PID 5068 wrote to memory of 4424	5068	cmd.exe	90
PID 5068 wrote to memory of 4424	5068	cmd.exe	90
PID 624 wrote to memory of 2496	624	cmd.exe	91
PID 624 wrote to memory of 2496	624	cmd.exe	91
PID 624 wrote to memory of 2496	624	cmd.exe	91