cca18cd7d8da5add8f7f5b01e9cb57ca4ee87f828acd4b703dc240812a403a93

Analysis

max time kernel
148s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 02:22

Target

18723027a5c25580eeef6c98ef3752f6_JaffaCakes118.exe
Size

719KB
MD5

18723027a5c25580eeef6c98ef3752f6
SHA1

b48ee5273e0c4b216722d6a12715f55fb8c58ecd
SHA256

cca18cd7d8da5add8f7f5b01e9cb57ca4ee87f828acd4b703dc240812a403a93
SHA512

ee4dc89c0180e9785ee02a613312ba93de81757275a426e183566d66f033a69345a04ef12a5909d7d2bd7b837217baa172e61198e7d0d165416dfe3d49b9b448
SSDEEP

12288:XHAyD1pt7wZJdGQGqliNeFyaEFz79ZjUJIeuBcAUPdydQHYkLvr/JN4BB+x9:XHGZJoQGwiNeFeN79JS2pAydQHTLv/8e

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2116	18723027a5c25580eeef6c98ef3752f6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\18723027a5c25580eeef6c98ef3752f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\18723027a5c25580eeef6c98ef3752f6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2116

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2116-0-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2116-2-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2116-1-0x00000000005C7000-0x00000000005C8000-memory.dmp

Filesize
4KB

Download
memory/2116-3-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download