8527e28c3f20d6296a614944510727afdc1f8de7182aa44289151f8905c2fcaf

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 18:56

Target

4297c45b187d127556db164134fc7c5b_JaffaCakes118.exe
Size

12.6MB
MD5

4297c45b187d127556db164134fc7c5b
SHA1

6a8c573d7894dae3d7af47cd3ddf19bb401a2b96
SHA256

8527e28c3f20d6296a614944510727afdc1f8de7182aa44289151f8905c2fcaf
SHA512

4ee95382b4562145ace97bba3e32e991f887f42a426836fa28853e75b1e3da3afd826b50ce28c91984d9d26e8b4f3624a966f55e37bbc9a255fa42adeab605a2
SSDEEP

196608:ucWYR3slUheupJiaIMiRmDj83msPr1pbp3TBV7zRg2zyKhdY1E9cjPcNERi:ukzeuTJfUFWubp3TBVZggycdCUORi

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1500	4297c45b187d127556db164134fc7c5b_JaffaCakes118.exe
1500	4297c45b187d127556db164134fc7c5b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4297c45b187d127556db164134fc7c5b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4297c45b187d127556db164134fc7c5b_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1500

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1500-0-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/1500-11-0x0000000000400000-0x00000000006ED000-memory.dmp

Filesize
2.9MB

Download
memory/1500-13-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download