cd4d29b138b75a9d1a10fa7d724168ae155ef7779d97c042e8014b9ae6f93087

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-04-2024 01:49

Target

ac52db0c62fac74e6708635ac3db5f46_JaffaCakes118.exe
Size

343KB
MD5

ac52db0c62fac74e6708635ac3db5f46
SHA1

0f35104cb6938b60cabbaf6257975792d5399024
SHA256

cd4d29b138b75a9d1a10fa7d724168ae155ef7779d97c042e8014b9ae6f93087
SHA512

95953124e75a38ed27ad6e60cbe0f9e952d5d367237784a3c0b47ed7d5fa30846f61a575458e3880b8f0539924cfd029983aa46a137db5ff5152e82140df7925
SSDEEP

6144:b8LxBBXsxzzxq3YgkqzS7M3TJcEghkLd199Tx5KN/Dv+JffuK1IDBgdugb:ysRzxq3wqzSmTJ9L5KNCfWK1cBxgb

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

ac52db0c62fac74e6708635ac3db5f46_JaffaCakes118.exe

pid process

4736 ac52db0c62fac74e6708635ac3db5f46_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4736	ac52db0c62fac74e6708635ac3db5f46_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ac52db0c62fac74e6708635ac3db5f46_JaffaCakes118.exe

description	pid	process	target process
PID 4736 wrote to memory of 3712	4736	ac52db0c62fac74e6708635ac3db5f46_JaffaCakes118.exe	ac52db0c62fac74e6708635ac3db5f46_JaffaCakes118.exe
PID 4736 wrote to memory of 3712	4736	ac52db0c62fac74e6708635ac3db5f46_JaffaCakes118.exe	ac52db0c62fac74e6708635ac3db5f46_JaffaCakes118.exe
PID 4736 wrote to memory of 3712	4736	ac52db0c62fac74e6708635ac3db5f46_JaffaCakes118.exe	ac52db0c62fac74e6708635ac3db5f46_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ac52db0c62fac74e6708635ac3db5f46_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ac52db0c62fac74e6708635ac3db5f46_JaffaCakes118.exe"
2⤵
PID:3712

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsz4576.tmp\lqwipxz.dll

Filesize
17KB

MD5
148e2440033d4c9c35f68f4072ba5d1e

SHA1
480b6d0a378fa7e785e79de7e0f757dd7e8124e3

SHA256
47094fa8accf250c8df2021a0180140be6f1091415d44e9927e5ed6ba6c60bb4

SHA512
1a272ef57ad29b3481a1f18530168d1af7cc6a20bef32249412e0eadcc7dbd306157c3b8fca971ac21bde9cf7229370124cce29038bd3cc1ef93a03008c0367d

Download Submit
memory/4736-6-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download