254e7a333ecee6d486b4f8892fe292fb7ba1471fe500651c1ba3e7ff5c9e03c8

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 13:51

Target

130392209b8b1e4aa37fd5c8da8fa6d5_JaffaCakes118.exe
Size

210KB
MD5

130392209b8b1e4aa37fd5c8da8fa6d5
SHA1

dacd5b49ac628157fcb9cf8d6e537e851ef29a64
SHA256

254e7a333ecee6d486b4f8892fe292fb7ba1471fe500651c1ba3e7ff5c9e03c8
SHA512

3cd7396f88798846e4fd6f007307a30bcc0d33d5b1f5236e398cedf9901827d0d0cc394941bc623d146f1c5130a97562e259e25f5c1000635e56c3fc4677c636
SSDEEP

3072:tmmCnB8TGfAqM0FhHY1peaKPP4DZEYVyLm5IqPy1tMB/tzvs3NSyw:FC4ChHAs/PMZbYLkby1OKgyw

Score

1^/10

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\130392209b8b1e4aa37fd5c8da8fa6d5_JaffaCakes118.exe:$TASK	130392209b8b1e4aa37fd5c8da8fa6d5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\130392209b8b1e4aa37fd5c8da8fa6d5_JaffaCakes118.exe:$GUID	130392209b8b1e4aa37fd5c8da8fa6d5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\130392209b8b1e4aa37fd5c8da8fa6d5_JaffaCakes118.exe:$FILE	130392209b8b1e4aa37fd5c8da8fa6d5_JaffaCakes118.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\130392209b8b1e4aa37fd5c8da8fa6d5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\130392209b8b1e4aa37fd5c8da8fa6d5_JaffaCakes118.exe"
1⤵
- NTFS ADS
PID:2848

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact