254e7a333ecee6d486b4f8892fe292fb7ba1471fe500651c1ba3e7ff5c9e03c8

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 13:51

Target

130392209b8b1e4aa37fd5c8da8fa6d5_JaffaCakes118.exe
Size

210KB
MD5

130392209b8b1e4aa37fd5c8da8fa6d5
SHA1

dacd5b49ac628157fcb9cf8d6e537e851ef29a64
SHA256

254e7a333ecee6d486b4f8892fe292fb7ba1471fe500651c1ba3e7ff5c9e03c8
SHA512

3cd7396f88798846e4fd6f007307a30bcc0d33d5b1f5236e398cedf9901827d0d0cc394941bc623d146f1c5130a97562e259e25f5c1000635e56c3fc4677c636
SSDEEP

3072:tmmCnB8TGfAqM0FhHY1peaKPP4DZEYVyLm5IqPy1tMB/tzvs3NSyw:FC4ChHAs/PMZbYLkby1OKgyw

Score

1^/10

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\130392209b8b1e4aa37fd5c8da8fa6d5_JaffaCakes118.exe:$TASK	130392209b8b1e4aa37fd5c8da8fa6d5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\130392209b8b1e4aa37fd5c8da8fa6d5_JaffaCakes118.exe:$GUID	130392209b8b1e4aa37fd5c8da8fa6d5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\130392209b8b1e4aa37fd5c8da8fa6d5_JaffaCakes118.exe:$FILE	130392209b8b1e4aa37fd5c8da8fa6d5_JaffaCakes118.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\130392209b8b1e4aa37fd5c8da8fa6d5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\130392209b8b1e4aa37fd5c8da8fa6d5_JaffaCakes118.exe"
1⤵
- NTFS ADS
PID:2696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:3444

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact