57adfd1c9f8ad8fdc831090b84957282ff8ea19c9dd4e6d1f09b91e145926631

Analysis

max time kernel
139s
max time network
147s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 14:36

Target

0e709a922183c646923fd12e5528b37c_JaffaCakes118.exe
Size

35KB
MD5

0e709a922183c646923fd12e5528b37c
SHA1

539fb85c0f75b7c04a8466bdf64227226380a64c
SHA256

57adfd1c9f8ad8fdc831090b84957282ff8ea19c9dd4e6d1f09b91e145926631
SHA512

0ddb6c6b6bdd73e336cbbb4e583748ba3c52d21ad861bd8aa5684c2ee0bc127bb714aa15a89119640138c333235804b07c66767a620fbd3e711bac7c983fb191
SSDEEP

768:mzQYScGrIubHuYtvdxwYHw5FAe2QPncwxma:gQTIubHy5wQPT

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1816	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
2244	0e709a922183c646923fd12e5528b37c_JaffaCakes118.exe
2244	0e709a922183c646923fd12e5528b37c_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\bcfb455c\jusched.exe	0e709a922183c646923fd12e5528b37c_JaffaCakes118.exe
File created	C:\Program Files (x86)\bcfb455c\bcfb455c	0e709a922183c646923fd12e5528b37c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1816	2244	0e709a922183c646923fd12e5528b37c_JaffaCakes118.exe	28
PID 2244 wrote to memory of 1816	2244	0e709a922183c646923fd12e5528b37c_JaffaCakes118.exe	28
PID 2244 wrote to memory of 1816	2244	0e709a922183c646923fd12e5528b37c_JaffaCakes118.exe	28
PID 2244 wrote to memory of 1816	2244	0e709a922183c646923fd12e5528b37c_JaffaCakes118.exe	28

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Program Files (x86)\bcfb455c\bcfb455c

Filesize
13B

MD5
f253efe302d32ab264a76e0ce65be769

SHA1
768685ca582abd0af2fbb57ca37752aa98c9372b

SHA256
49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd

SHA512
1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4

Download Submit
C:\Program Files (x86)\bcfb455c\jusched.exe

Filesize
35KB

MD5
da26fddb78bd0e125ae92c1dc6472971

SHA1
1709db1c56e4c6ac87b204bf371df7243cf136ba

SHA256
9903eb64d274de0f672652f79eec2b9afd25fefeb614527250ac6bdef357e3ae

SHA512
aed53a1dfb480157ea4066f3195b9b581de3c033ddd38f81afe92e5b10b6609436770825941e90e72bdfcf3011982833be8ae7a1d0423e4241741aacdb7a04ae

Download Submit
memory/1816-13-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2244-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2244-6-0x0000000000500000-0x0000000000518000-memory.dmp

Filesize
96KB

Download
memory/2244-12-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download