29d7bcce549e42be131c7c3d39a46fe884925ceb742dc8cc1da7f6cae804f4cb

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 22:27

Target
09cf08a8763752fc1fef65105d0b4ed7_JaffaCakes118.exe
Size 3.7MB
Sample240620-2dgmbazfqa
SHA256 29d7bcce549e42be131c7c3d39a46fe884925ceb742dc8cc1da7f6cae804f4cb
MD5 09cf08a8763752fc1fef65105d0b4ed7
SHA1 4eec2eda07b08e150fe53c02c160c8c6e91f487a
SHA512 c67a5a144dc7d0c0b37f932f60b6ac715c1b9f46f7bd3c1a20942281881b0616164631668bf4f642930b56adb308ff5e4cd6caff0359c90cd85e85983613b64d
SSDEEP 98304:8s/47Xh1GSSksDKNVpBXTg5XDz/v+YlQCqe:F4lQSSk3VpRTgVDz/vN
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2360	09cf08a8763752fc1fef65105d0b4ed7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\09cf08a8763752fc1fef65105d0b4ed7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09cf08a8763752fc1fef65105d0b4ed7_JaffaCakes118.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2360

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact