1163802da97c23d2b3d88a6af9e48ac64119c4d8c2a2bea6a6fb1626a8cf005b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 17:43

Target

84f2f18f7587bc6ee6e32cc16e3f4790_JaffaCakes118.exe
Size

164KB
MD5

84f2f18f7587bc6ee6e32cc16e3f4790
SHA1

b32ea48a8df2a0356ff45a07bef1532643431e76
SHA256

1163802da97c23d2b3d88a6af9e48ac64119c4d8c2a2bea6a6fb1626a8cf005b
SHA512

5fe4dbff1d1212da1c62f4cb19c3558e08ac5a47daefce69605d3775ea37312fd930a70b15bab405a464359a32adcca91c89cbe9923fa2c7ecd21606e5b4b370
SSDEEP

3072:1aOBvudlu7lFxe4aO2daluPWEu3ZQAqIhJV9JsNyYojF3iI5yo:kgWlu7nxe4aF1PHFyhJVnsNbocI5j

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2764	ins3880.exe

Loads dropped DLL 4 IoCs

pid	Process
1868	84f2f18f7587bc6ee6e32cc16e3f4790_JaffaCakes118.exe
1868	84f2f18f7587bc6ee6e32cc16e3f4790_JaffaCakes118.exe
1868	84f2f18f7587bc6ee6e32cc16e3f4790_JaffaCakes118.exe
1868	84f2f18f7587bc6ee6e32cc16e3f4790_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2764	ins3880.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	ins3880.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2764	ins3880.exe
2764	ins3880.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2764	1868	84f2f18f7587bc6ee6e32cc16e3f4790_JaffaCakes118.exe	28
PID 1868 wrote to memory of 2764	1868	84f2f18f7587bc6ee6e32cc16e3f4790_JaffaCakes118.exe	28
PID 1868 wrote to memory of 2764	1868	84f2f18f7587bc6ee6e32cc16e3f4790_JaffaCakes118.exe	28
PID 1868 wrote to memory of 2764	1868	84f2f18f7587bc6ee6e32cc16e3f4790_JaffaCakes118.exe	28
PID 1868 wrote to memory of 2764	1868	84f2f18f7587bc6ee6e32cc16e3f4790_JaffaCakes118.exe	28
PID 1868 wrote to memory of 2764	1868	84f2f18f7587bc6ee6e32cc16e3f4790_JaffaCakes118.exe	28
PID 1868 wrote to memory of 2764	1868	84f2f18f7587bc6ee6e32cc16e3f4790_JaffaCakes118.exe	28

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\ins3880\ins3880.exe

Filesize
252KB

MD5
2b8fb03bf38cb33a98d804cfdc2bb2c0

SHA1
962a9850ff0728f80c14878859dc2307f6ab0ff2

SHA256
01053b858d8d24f62c5520fb0255d16e728d27d173c15d2d4082ffdf85adf5e8

SHA512
18b0d66a8152014d8e2ad03b8f1b80c69d9ebb805215735b476643fbd2fdb0e817b89f81beae604c969ad2b94225032f507e911c9874a735f2dfed32cf3925df

Download Submit
memory/1868-0-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1868-6-0x0000000002320000-0x0000000002330000-memory.dmp

Filesize
64KB

Download
memory/1868-22-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2764-17-0x0000000074021000-0x0000000074022000-memory.dmp

Filesize
4KB

Download
memory/2764-18-0x0000000074020000-0x00000000745CB000-memory.dmp

Filesize
5.7MB

Download
memory/2764-19-0x0000000074020000-0x00000000745CB000-memory.dmp

Filesize
5.7MB

Download
memory/2764-20-0x0000000074020000-0x00000000745CB000-memory.dmp

Filesize
5.7MB

Download