c731d258550e4d4d39fea06850f46e7e3b9627bf1b5b2f08d1cd60282df74fa7

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 20:37

Target

8f5834b18ed92d1e7c3400b50b0aab41_JaffaCakes118.exe
Size

11.0MB
MD5

8f5834b18ed92d1e7c3400b50b0aab41
SHA1

0290a7e038f2c4841120d108405425fa89a23450
SHA256

c731d258550e4d4d39fea06850f46e7e3b9627bf1b5b2f08d1cd60282df74fa7
SHA512

56d24e85c899e1418629b76b7b16bcf4f13896b1fdaec579fe4e0c5fd09e48414a45854c761745d5c438efc581dda79ce5c603487572bbfcbb98027d09a18c18
SSDEEP

196608:UWXDWftsmihYVAkuJ0zF8HVxfOg45k/nSj6HgjVNtoNZEDb1Mkqo1Ejd4sM2VMC9:UqCftqoA9HVxfOu/nlXN+f17o4UV39

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2600	8f5834b18ed92d1e7c3400b50b0aab41_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8f5834b18ed92d1e7c3400b50b0aab41_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8f5834b18ed92d1e7c3400b50b0aab41_JaffaCakes118.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2600

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact