a6420a4917f7c8a3c139d1ffbc21ce9a5feef794b6e8fa0b77f7b6187e6d824b

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 04:08

Target

18b950b01ff5f7778c0d090267427efc_JaffaCakes118.exe
Size

2.9MB
MD5

18b950b01ff5f7778c0d090267427efc
SHA1

0b10872b09e05f23722b33878e6000e3d65030de
SHA256

a6420a4917f7c8a3c139d1ffbc21ce9a5feef794b6e8fa0b77f7b6187e6d824b
SHA512

4e9cbefb2dcb9c395c17ffe2521bb628cf1bc06c7c0227c2b2e1d7e1d14a42d26f204b8268b6f1795238a88013daa081f12c0367610f3efcc899fa2afa588e5d
SSDEEP

49152:mVAqU6u6X4ZdVtwNzpEqwOQTD3CVcXeRXL7q3/0n7WZLdWfURzhmminlwr4cwKeC:m5GO4ZDaNzpjwScuRyMaWsR7ksY6R

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2436	18b950b01ff5f7778c0d090267427efc_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\18b950b01ff5f7778c0d090267427efc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\18b950b01ff5f7778c0d090267427efc_JaffaCakes118.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2436

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact