608b57c64e877f56fc24629ae956b0732fc013ac191ff7ffd4d678f59ab87550

Analysis

max time kernel
94s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 23:51

Target

d0acb476e8f40b86a631980c24f5ecc9_JaffaCakes118.exe
Size

40KB
MD5

d0acb476e8f40b86a631980c24f5ecc9
SHA1

59d2cf1f9861c42a337b935683bf8f22ebec39a6
SHA256

608b57c64e877f56fc24629ae956b0732fc013ac191ff7ffd4d678f59ab87550
SHA512

56c31c65155b9449ae3f338917028e7f6bbd3be6787c65bdd3198555d1bedc5eabd794442e0e27670eadaad04793032244497dddb665ac16902529ef3a371aef
SSDEEP

384:6Ekt3u6bAg0DI3IfxcOFimDHqIoy+bR+Nnb7AuUA6gsLwsa8gw5upDm+n/xpkqD+:6Ew3uUcHf9FiqHqW+bR+lTnJpkwWvpF

Score

8^/10

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2288	sc.exe
4932	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0acb476e8f40b86a631980c24f5ecc9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2204	d0acb476e8f40b86a631980c24f5ecc9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 888	2204	d0acb476e8f40b86a631980c24f5ecc9_JaffaCakes118.exe	83
PID 2204 wrote to memory of 888	2204	d0acb476e8f40b86a631980c24f5ecc9_JaffaCakes118.exe	83
PID 2204 wrote to memory of 888	2204	d0acb476e8f40b86a631980c24f5ecc9_JaffaCakes118.exe	83
PID 2204 wrote to memory of 4772	2204	d0acb476e8f40b86a631980c24f5ecc9_JaffaCakes118.exe	84
PID 2204 wrote to memory of 4772	2204	d0acb476e8f40b86a631980c24f5ecc9_JaffaCakes118.exe	84
PID 2204 wrote to memory of 4772	2204	d0acb476e8f40b86a631980c24f5ecc9_JaffaCakes118.exe	84
PID 4772 wrote to memory of 2288	4772	cmd.exe	87
PID 4772 wrote to memory of 2288	4772	cmd.exe	87
PID 4772 wrote to memory of 2288	4772	cmd.exe	87
PID 888 wrote to memory of 4932	888	cmd.exe	88
PID 888 wrote to memory of 4932	888	cmd.exe	88
PID 888 wrote to memory of 4932	888	cmd.exe	88