06302c1d6200fe1991a2da1a3cc3aa7bf0f15231a52e27438e0959cf71850da6

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 08:28

Target

a4a255000750ba764d20b6ded423bcbb_JaffaCakes118.exe
Size

524KB
MD5

a4a255000750ba764d20b6ded423bcbb
SHA1

fc56945a903155d088983b51839b45ccbaeec4c2
SHA256

06302c1d6200fe1991a2da1a3cc3aa7bf0f15231a52e27438e0959cf71850da6
SHA512

51a8878d958d9a0196aa9ad1ce0fab7038f7429c8b26bd6b269e09f8b26adaaca81654c4dffe9bd5e1826e7a6b26d02ee18760382f761a70018bc623eb5dabbb
SSDEEP

12288:DzllhnfuOxLGOL39G08A8dxnMXgYxZADkFBfxzWg/vm:DpHxykMxnMX3ADOxKg/vm

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2012	a4a255000750ba764d20b6ded423bcbb_JaffaCakes118.exe
2012	a4a255000750ba764d20b6ded423bcbb_JaffaCakes118.exe
2012	a4a255000750ba764d20b6ded423bcbb_JaffaCakes118.exe
2012	a4a255000750ba764d20b6ded423bcbb_JaffaCakes118.exe
2012	a4a255000750ba764d20b6ded423bcbb_JaffaCakes118.exe
2012	a4a255000750ba764d20b6ded423bcbb_JaffaCakes118.exe
2012	a4a255000750ba764d20b6ded423bcbb_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a4a255000750ba764d20b6ded423bcbb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a4a255000750ba764d20b6ded423bcbb_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2012

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact