5018198754f5f7c082c0ec7df62f89f86403d9075145584a662ba4f0f2141723

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 22:17

Target
03c015e64407a392e0635b6eb8cd33b8_JaffaCakes118.exe
Size 630KB
Sample240427-17qxeaaa8w
SHA256 5018198754f5f7c082c0ec7df62f89f86403d9075145584a662ba4f0f2141723
MD5 03c015e64407a392e0635b6eb8cd33b8
SHA1 24fbefe8790b37ed40606e3095c386277e119906
SHA512 a6b1f305d5fbd8e0d1a963401e83a3889dcc3fc9462b4fe8d4b0621570c81d833b682e3ee51f2accf883bdcf94ede0db2b23885a4b7ea7cf368af44ced60170c
SSDEEP 12288:rgUJj98qfQx6AJZpqMwfYHes9tcvYpsXp8/+WtV+SqzupPXK63rRREJ:rgUjNQgAfpqMwfQeK8YrBIPypPpRRS
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2520	03c015e64407a392e0635b6eb8cd33b8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\03c015e64407a392e0635b6eb8cd33b8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03c015e64407a392e0635b6eb8cd33b8_JaffaCakes118.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:2520

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact