1c158db04b4efc7e8440d25c4a4e16658bc43a0f084c3c16d9fa80f5fb9cfc95

Analysis

max time kernel
66s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2024 06:03

Target

0930b4b48c0b81a15cf832743da7f70d_JaffaCakes118.exe
Size

277KB
MD5

0930b4b48c0b81a15cf832743da7f70d
SHA1

3f04cf61baec2df50961ac845d24e12623455cbb
SHA256

1c158db04b4efc7e8440d25c4a4e16658bc43a0f084c3c16d9fa80f5fb9cfc95
SHA512

8c11c1e78811686ca3dd6c3abea125c72c95675d14800ccdf2bf63714ba6b6082575c1f8154b549fa15ade3f2462e1f3928fc48373e7906d42ec651304fd947c
SSDEEP

6144:eW+7+eM+M4aaZYy+ZZAIor1K3UC0A9ePfUZw1Ubu1:eRFM3aZYy+3horVV91

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

0930b4b48c0b81a15cf832743da7f70d_JaffaCakes118.exe

pid process

1596 0930b4b48c0b81a15cf832743da7f70d_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1596	0930b4b48c0b81a15cf832743da7f70d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0930b4b48c0b81a15cf832743da7f70d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0930b4b48c0b81a15cf832743da7f70d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
PID:1596

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\nss4028.tmp\System.dll
Filesize
11KB

MD5
3e6bf00b3ac976122f982ae2aadb1c51

SHA1
caab188f7fdc84d3fdcb2922edeeb5ed576bd31d

SHA256
4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe

SHA512
1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706

Download Submit