7ccb6bf8f0d21d320c43ecc00d50aa1b7903c31b3adc8d799f6256a4c37e8601

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 14:59

Target

9874ac95d4d8f66af46cc850d17d10d0_JaffaCakes118.exe
Size

1.6MB
MD5

9874ac95d4d8f66af46cc850d17d10d0
SHA1

489d263c8397d15f6bb33824ccd8d40796e66210
SHA256

7ccb6bf8f0d21d320c43ecc00d50aa1b7903c31b3adc8d799f6256a4c37e8601
SHA512

5f736788b2c39e97fe5503d845f405c9d39ac9fc016cfc260729deac243b066ba043fac7e195e0015d6fcec6a85048cbe72a5f5f1a6ed5e1cd721af1097fdfdf
SSDEEP

49152:G4c6ZrVLqylMky6fVsKJ5Ndtnh08ZTHxpG:G4chyjSKrtn3NTG

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
2952	poverify.exe

Loads dropped DLL 3 IoCs

pid	Process
1720	9874ac95d4d8f66af46cc850d17d10d0_JaffaCakes118.exe
2952	poverify.exe
1720	9874ac95d4d8f66af46cc850d17d10d0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1720	9874ac95d4d8f66af46cc850d17d10d0_JaffaCakes118.exe
2952	poverify.exe
2952	poverify.exe
2952	poverify.exe
2952	poverify.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2952	1720	9874ac95d4d8f66af46cc850d17d10d0_JaffaCakes118.exe	28
PID 1720 wrote to memory of 2952	1720	9874ac95d4d8f66af46cc850d17d10d0_JaffaCakes118.exe	28
PID 1720 wrote to memory of 2952	1720	9874ac95d4d8f66af46cc850d17d10d0_JaffaCakes118.exe	28
PID 1720 wrote to memory of 2952	1720	9874ac95d4d8f66af46cc850d17d10d0_JaffaCakes118.exe	28

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2536

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\jm_NKIPUINAJX\poverify.exe

Filesize
550KB

MD5
45f9c3bdf7b06a9267594803b9c39f1f

SHA1
2dfddef5bb2378dcbd55822037e6485d7f9d1292

SHA256
7c58572da71caaed2359547ced10b8ebd05866e0e2cc697b84d4c011827fabb9

SHA512
e10e1d4b47a7717e808eeba20a16fabeeb5642d9b7574f9f9fb059f1161876dfe38118720d713973e0ae63c10131f7c0c8085c5fdc17fe88e2b261fae1cdcd42

Download Submit
\Users\Admin\AppData\Local\Temp\CSM1130.tmp

Filesize
190KB

MD5
fc7845d609c081271daadb14d535bd14

SHA1
87ceb17fd4fa8059469c7fa182fad229f2dffa33

SHA256
a06593ae61205c43d63510dd5b4dae6abde8e9b36aa22de96474efe60b58d851

SHA512
0584149fca3c3d964cfa0cfe5cfa9d0df364a9c7614bbe37d7338124809c4d1b014321ef33c499c71394df58392d73baeceaa01e1fbda7fd528cc0491f8defb8

Download Submit
memory/1720-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1720-16-0x0000000003270000-0x0000000003280000-memory.dmp

Filesize
64KB

Download
memory/1720-17-0x0000000000400000-0x00000000005A5000-memory.dmp

Filesize
1.6MB

Download