96fa5fe026d85ae3c6e65385c8afd7bbe01f12006f69678f97066d1094a27cd4

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 17:47

Target

f655f10c52dba4bd6e81d82573bc41d2_JaffaCakes118.lnk
Size

856B
MD5

f655f10c52dba4bd6e81d82573bc41d2
SHA1

001ea98fdf40d62d0220b0cda39784bd10bb5954
SHA256

96fa5fe026d85ae3c6e65385c8afd7bbe01f12006f69678f97066d1094a27cd4
SHA512

f81c3ace5915a300ce1b78acf205293a860dbcec1c0e7ea6f17b399bfaba67ebafd50328fa44213e7e94c796d81b2113814d22df67ea232f4760ebf7ebc60ab5

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4048	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\f655f10c52dba4bd6e81d82573bc41d2_JaffaCakes118.lnk
1⤵
- Suspicious use of FindShellTrayWindow
PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3096 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:3536

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact