1351b0838ffffd16ade2dbf7ad1debd605dd285a0867c31c1d1a4688478abf4b

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 21:53

Target

735e1245328a511473f7c4401c87f5b7_JaffaCakes118.exe
Size

164KB
MD5

735e1245328a511473f7c4401c87f5b7
SHA1

71383366a572de676614fb926f0c808e4c52215c
SHA256

1351b0838ffffd16ade2dbf7ad1debd605dd285a0867c31c1d1a4688478abf4b
SHA512

fafc959e664262b2c1773a8a2989f5484ab9d80fab9851498c3d15d38590c6f3a861b9121cec791f6349d90795b8fa6683255d12a128924ec82c69e5eeef03a8
SSDEEP

3072:C0erJVUZdoQ+Qaf4Lx5o8TD0kQIbEHYcOzIk8UFsQvgff3lKviI5Tb:feMnoQ+K5o8MME4cO8k3sQIfZI5f

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2396	ins8275.exe

Loads dropped DLL 4 IoCs

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2396	ins8275.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2396	ins8275.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2396	ins8275.exe
2396	ins8275.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2396	2220	735e1245328a511473f7c4401c87f5b7_JaffaCakes118.exe	28
PID 2220 wrote to memory of 2396	2220	735e1245328a511473f7c4401c87f5b7_JaffaCakes118.exe	28
PID 2220 wrote to memory of 2396	2220	735e1245328a511473f7c4401c87f5b7_JaffaCakes118.exe	28
PID 2220 wrote to memory of 2396	2220	735e1245328a511473f7c4401c87f5b7_JaffaCakes118.exe	28
PID 2220 wrote to memory of 2396	2220	735e1245328a511473f7c4401c87f5b7_JaffaCakes118.exe	28
PID 2220 wrote to memory of 2396	2220	735e1245328a511473f7c4401c87f5b7_JaffaCakes118.exe	28
PID 2220 wrote to memory of 2396	2220	735e1245328a511473f7c4401c87f5b7_JaffaCakes118.exe	28

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\ins8275\ins8275.exe

Filesize
252KB

MD5
2b8fb03bf38cb33a98d804cfdc2bb2c0

SHA1
962a9850ff0728f80c14878859dc2307f6ab0ff2

SHA256
01053b858d8d24f62c5520fb0255d16e728d27d173c15d2d4082ffdf85adf5e8

SHA512
18b0d66a8152014d8e2ad03b8f1b80c69d9ebb805215735b476643fbd2fdb0e817b89f81beae604c969ad2b94225032f507e911c9874a735f2dfed32cf3925df

Download Submit
memory/2220-0-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2220-3-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2220-20-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2396-17-0x0000000073D01000-0x0000000073D02000-memory.dmp

Filesize
4KB

Download
memory/2396-18-0x0000000073D00000-0x00000000742AB000-memory.dmp

Filesize
5.7MB

Download
memory/2396-19-0x0000000073D00000-0x00000000742AB000-memory.dmp

Filesize
5.7MB

Download