235c9e3348e5e40c4d91cdacb63407164b72c2f4009d4b08f20f5fef2c8a7e1a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:42

Target
8fb0e28d5820d3cc262d21872339d03e_JaffaCakes118.exe
Size 630KB
Sample240602-2mn3raag97
SHA256 235c9e3348e5e40c4d91cdacb63407164b72c2f4009d4b08f20f5fef2c8a7e1a
MD5 8fb0e28d5820d3cc262d21872339d03e
SHA1 7abefdafa092bc4f445e6dcc709b2183cf05a443
SHA512 73837be3c6d460ac028f814599c09a613791ed94c10f989b8841b919c5902c83bf8b6306a342b65d5e0fe88677cbe24050ea58f712c7e42b63629cf036ca9594
SSDEEP 12288:8gUJj98qfQx6AJZpqMwfYHes9tcvYpsXp8/+WtV+SqzupPXK63rRRq:8gUjNQgAfpqMwfQeK8YrBIPypPpRRq
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3144	8fb0e28d5820d3cc262d21872339d03e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8fb0e28d5820d3cc262d21872339d03e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8fb0e28d5820d3cc262d21872339d03e_JaffaCakes118.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:3144

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact