5018198754f5f7c082c0ec7df62f89f86403d9075145584a662ba4f0f2141723

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 22:17

Target

03c015e64407a392e0635b6eb8cd33b8_JaffaCakes118.exe
Size

630KB
MD5

03c015e64407a392e0635b6eb8cd33b8
SHA1

24fbefe8790b37ed40606e3095c386277e119906
SHA256

5018198754f5f7c082c0ec7df62f89f86403d9075145584a662ba4f0f2141723
SHA512

a6b1f305d5fbd8e0d1a963401e83a3889dcc3fc9462b4fe8d4b0621570c81d833b682e3ee51f2accf883bdcf94ede0db2b23885a4b7ea7cf368af44ced60170c
SSDEEP

12288:rgUJj98qfQx6AJZpqMwfYHes9tcvYpsXp8/+WtV+SqzupPXK63rRREJ:rgUjNQgAfpqMwfQeK8YrBIPypPpRRS

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

03c015e64407a392e0635b6eb8cd33b8_JaffaCakes118.exe

pid process

2520 03c015e64407a392e0635b6eb8cd33b8_JaffaCakes118.exe

pid	process
2520	03c015e64407a392e0635b6eb8cd33b8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\03c015e64407a392e0635b6eb8cd33b8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03c015e64407a392e0635b6eb8cd33b8_JaffaCakes118.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:2520

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance