223478415259b7a65fd2cb706287f94f337eb1d9a5d80a5720155ecf24495f0b

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 22:29

Target

4855bcbdf1b822b5c195795ac111a7da_JaffaCakes118.exe
Size

164KB
MD5

4855bcbdf1b822b5c195795ac111a7da
SHA1

d269145b26bc2f5d2006c45d7564198379407f05
SHA256

223478415259b7a65fd2cb706287f94f337eb1d9a5d80a5720155ecf24495f0b
SHA512

7a25980c03f7a808072d292d032434d271f2e84d07ae62786679c2e89198f60250dd6616f407277e7f4a258de41b32e229431e1f08333d100b206172c5cff384
SSDEEP

3072:70erJVUZdoQ+Qaf4Lx5o8TD0kQIbEHYcOzIk8UFsQvgff3lKviI5Tb:geMnoQ+K5o8MME4cO8k3sQIfZI5f

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1704	ins1936.exe

Loads dropped DLL 4 IoCs

pid	Process
2168	4855bcbdf1b822b5c195795ac111a7da_JaffaCakes118.exe
2168	4855bcbdf1b822b5c195795ac111a7da_JaffaCakes118.exe
2168	4855bcbdf1b822b5c195795ac111a7da_JaffaCakes118.exe
2168	4855bcbdf1b822b5c195795ac111a7da_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1704	ins1936.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1704	ins1936.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1704	ins1936.exe
1704	ins1936.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1704	2168	4855bcbdf1b822b5c195795ac111a7da_JaffaCakes118.exe	28
PID 2168 wrote to memory of 1704	2168	4855bcbdf1b822b5c195795ac111a7da_JaffaCakes118.exe	28
PID 2168 wrote to memory of 1704	2168	4855bcbdf1b822b5c195795ac111a7da_JaffaCakes118.exe	28
PID 2168 wrote to memory of 1704	2168	4855bcbdf1b822b5c195795ac111a7da_JaffaCakes118.exe	28
PID 2168 wrote to memory of 1704	2168	4855bcbdf1b822b5c195795ac111a7da_JaffaCakes118.exe	28
PID 2168 wrote to memory of 1704	2168	4855bcbdf1b822b5c195795ac111a7da_JaffaCakes118.exe	28
PID 2168 wrote to memory of 1704	2168	4855bcbdf1b822b5c195795ac111a7da_JaffaCakes118.exe	28

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\ins1936\ins1936.exe

Filesize
252KB

MD5
2b8fb03bf38cb33a98d804cfdc2bb2c0

SHA1
962a9850ff0728f80c14878859dc2307f6ab0ff2

SHA256
01053b858d8d24f62c5520fb0255d16e728d27d173c15d2d4082ffdf85adf5e8

SHA512
18b0d66a8152014d8e2ad03b8f1b80c69d9ebb805215735b476643fbd2fdb0e817b89f81beae604c969ad2b94225032f507e911c9874a735f2dfed32cf3925df

Download Submit
memory/1704-17-0x0000000074061000-0x0000000074062000-memory.dmp

Filesize
4KB

Download
memory/1704-18-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/1704-19-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/1704-22-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/2168-0-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2168-5-0x00000000022B0000-0x00000000022C0000-memory.dmp

Filesize
64KB

Download
memory/2168-20-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2168-21-0x00000000022B0000-0x00000000022C0000-memory.dmp

Filesize
64KB

Download
memory/2168-24-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download