763060247e08ba76835b2b4940236415b53f1f3d35784e0bd72b10f0213c67e0

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 06:26

Target

38b7183330f7d0ddde8e288e15abb0ce_JaffaCakes118.exe
Size

33.8MB
MD5

38b7183330f7d0ddde8e288e15abb0ce
SHA1

84d9e8033caf54006470099c56fd984592684380
SHA256

763060247e08ba76835b2b4940236415b53f1f3d35784e0bd72b10f0213c67e0
SHA512

ccf9c2ada67d8c4d2b801ecc62951f33c86ae0d2b8c149c8454def081a5d96ff4ccf3c57ee5284729b82c06ea7579828da67f510bc3bb21f131f8b577713af03
SSDEEP

786432:sDebuWNHEDddtJZH86BAj+8Kszz0jOvASGJJ0IBPmqptFeV:syCZc62CHO6+ASSxmGM

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2864	38b7183330f7d0ddde8e288e15abb0ce_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\38b7183330f7d0ddde8e288e15abb0ce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\38b7183330f7d0ddde8e288e15abb0ce_JaffaCakes118.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2864

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact