7a34a8374f396206511c8cb00d80a5817293afa93bfb464d50515a6597eff93c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 20:08

Target

e4a117a0311714ea836ce7564256d9b8_JaffaCakes118.exe
Size

208KB
MD5

e4a117a0311714ea836ce7564256d9b8
SHA1

2f7b2b88ffd5b5efa9d145bcf5b0134678c9483a
SHA256

7a34a8374f396206511c8cb00d80a5817293afa93bfb464d50515a6597eff93c
SHA512

5557709ed7382b2e34f842a823b4424fa2bf504e2b0f235988aa04454ecff338ef9a484085c35eced308575f875d0bca8a969f969374a32339ff9047b124c274
SSDEEP

3072:gaJUoAbFDs6HdqpQj8u7DcYuHwTs9CLkeaqM7OBvi4NLthEjQT6:7ajFIyqpm8ukYTs9skLqMSBviQEj

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2804	YDM.exe

Loads dropped DLL 2 IoCs

pid	Process
2612	cmd.exe
2612	cmd.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\windows\system\YDM.exe	e4a117a0311714ea836ce7564256d9b8_JaffaCakes118.exe
File opened for modification	C:\windows\system\YDM.exe	e4a117a0311714ea836ce7564256d9b8_JaffaCakes118.exe
File created	C:\windows\system\YDM.exe.bat	e4a117a0311714ea836ce7564256d9b8_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2696	e4a117a0311714ea836ce7564256d9b8_JaffaCakes118.exe
2804	YDM.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2612	2696	e4a117a0311714ea836ce7564256d9b8_JaffaCakes118.exe	28
PID 2696 wrote to memory of 2612	2696	e4a117a0311714ea836ce7564256d9b8_JaffaCakes118.exe	28
PID 2696 wrote to memory of 2612	2696	e4a117a0311714ea836ce7564256d9b8_JaffaCakes118.exe	28
PID 2696 wrote to memory of 2612	2696	e4a117a0311714ea836ce7564256d9b8_JaffaCakes118.exe	28
PID 2612 wrote to memory of 2804	2612	cmd.exe	30
PID 2612 wrote to memory of 2804	2612	cmd.exe	30
PID 2612 wrote to memory of 2804	2612	cmd.exe	30
PID 2612 wrote to memory of 2804	2612	cmd.exe	30

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\system\YDM.exe.bat

Filesize
66B

MD5
4d8c134e4c23d77d97cc846476ca3177

SHA1
4b6b23c067ffab2f28eb5ecd043bad32b2a6b666

SHA256
79626cb07934293eaa33e03c15b68089f02adf9f5115802e2f449c010142644a

SHA512
baf96472051d060e01652789562a1f7d70a02a438adddf2644170a0866714150d858cb11305eb9fc57aecff9c05ab6ebd16b8667405e41ea2ecb2952dca5396b

Download Submit
\Windows\system\YDM.exe

Filesize
208KB

MD5
8f22c475aee0d2362f9e26660b8c538d

SHA1
c5d1f71f82b759e42a9ebb91dbc76a458c51e691

SHA256
125f0ab66701ebd00c4eb1bc0f4a1bbeb4300ad2bd7819243b626deb3f0c8f90

SHA512
2908d0b80954f25f3cadca212537c1cd24c666ec3fbe4b177affb3c0671b16f4cf6a6eb274eb93b9aa9e46b7c6d8db6834ab0e649a8833dcac4ce308727abd29

Download Submit
memory/2612-16-0x0000000000310000-0x0000000000348000-memory.dmp

Filesize
224KB

Download
memory/2696-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2696-12-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2804-19-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download