06a38f85c79270122075be97302d44f94f0e68cb9ce24d738e85665b04a1e9b5

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 06:11

Target

fc1ae52cc4bd82a57aeef0bb747581d1_JaffaCakes118.exe
Size

199KB
MD5

fc1ae52cc4bd82a57aeef0bb747581d1
SHA1

8310e8e641fc1bd6731eb2ee8136699fa56cc98b
SHA256

06a38f85c79270122075be97302d44f94f0e68cb9ce24d738e85665b04a1e9b5
SHA512

12baaf1f494f087f19f599333387fc3330de438fb123e729f54321b21489237fe79be3b5dca54178d6da5df4956dde0f2fa21f4aa4a57d10c5c90e770192407f
SSDEEP

3072:ssBHN/vimy20jbxVDSYGWgAZxuDIn6kCr0w2je/KsFapo8DW3tUIxMHO:ZH1IFJVJGWjZgDIn6kCr0HpsFOoPj

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1656	ins8483.exe

Loads dropped DLL 4 IoCs

pid	Process
2084	fc1ae52cc4bd82a57aeef0bb747581d1_JaffaCakes118.exe
2084	fc1ae52cc4bd82a57aeef0bb747581d1_JaffaCakes118.exe
2084	fc1ae52cc4bd82a57aeef0bb747581d1_JaffaCakes118.exe
2084	fc1ae52cc4bd82a57aeef0bb747581d1_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1656	ins8483.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1656	ins8483.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1656	ins8483.exe
1656	ins8483.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1656	2084	fc1ae52cc4bd82a57aeef0bb747581d1_JaffaCakes118.exe	28
PID 2084 wrote to memory of 1656	2084	fc1ae52cc4bd82a57aeef0bb747581d1_JaffaCakes118.exe	28
PID 2084 wrote to memory of 1656	2084	fc1ae52cc4bd82a57aeef0bb747581d1_JaffaCakes118.exe	28
PID 2084 wrote to memory of 1656	2084	fc1ae52cc4bd82a57aeef0bb747581d1_JaffaCakes118.exe	28

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\ins8483\ins8483.exe

Filesize
200KB

MD5
f44614c6097c832efeda12d2b40e129e

SHA1
efae40dab1e2fcf44e32761004140aad01dc9e89

SHA256
2dc1153ebc776f9e8538fa3e947203e7f0d35d1f42b7aea436d8ac39c55a66e0

SHA512
85e2e06c2e041d22b0ad2e1a97c6d1ab77a91d015d22ca2b4fb72a0e78781ddc8c5c968f9a78f822a02f1484c80a2c1e124c22bd09b1f19d9d14fefe5ce46a38

Download Submit
memory/1656-16-0x0000000000500000-0x000000000050A000-memory.dmp

Filesize
40KB

Download
memory/1656-17-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/1656-18-0x0000000000990000-0x0000000000A10000-memory.dmp

Filesize
512KB

Download
memory/1656-19-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/1656-20-0x0000000000990000-0x0000000000A10000-memory.dmp

Filesize
512KB

Download
memory/1656-21-0x0000000000990000-0x0000000000A10000-memory.dmp

Filesize
512KB

Download
memory/1656-22-0x0000000000990000-0x0000000000A10000-memory.dmp

Filesize
512KB

Download
memory/1656-23-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/2084-0-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2084-5-0x00000000004C0000-0x00000000004D0000-memory.dmp

Filesize
64KB

Download
memory/2084-24-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download