6218253ec1999f05af953538af4c05f2fe82bad422d263e474a3107c3c2e05b8

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 13:20

Target

636f206f9d4baae10a097dd4b0b8b9cd_JaffaCakes118.exe
Size

80KB
MD5

636f206f9d4baae10a097dd4b0b8b9cd
SHA1

aa35f21902b4f49f97038e72d2d5082bfb480dbe
SHA256

6218253ec1999f05af953538af4c05f2fe82bad422d263e474a3107c3c2e05b8
SHA512

d2b5520257e294301cc3394ee160e571951cdadf2b30dfe610a7078ce275c5c6ae9acadbf4f8f215b135f8b375c439e729da7735768c7e45afd0b61ca388897c
SSDEEP

1536:8sCSOnbpCbu1UqzCsX+sTt5u34Romu/nezyh4G3uoaG5K0xfLZLHgZr7skQtw2e0:8RSasbGzCs/Tt5u345/zyhN3uEK2jZLh

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1612	636f206f9d4baae10a097dd4b0b8b9cd_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\636f206f9d4baae10a097dd4b0b8b9cd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\636f206f9d4baae10a097dd4b0b8b9cd_JaffaCakes118.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1612

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact