89e841cecfc56e3d38b2d4d98c16d0c712ff18b9902ef11e294e6ff84de95981

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 23:17

Target

26981a8e91b4ea7443855550b5d306e8_JaffaCakes118.exe
Size

157KB
MD5

26981a8e91b4ea7443855550b5d306e8
SHA1

f1967741592613ac4ca09a4fc5b6c67bbe3ee69f
SHA256

89e841cecfc56e3d38b2d4d98c16d0c712ff18b9902ef11e294e6ff84de95981
SHA512

ab9b6c43d899c1349a2e9deb40b1839d7074c5b816f90fac9a843273a056ab45ed3a6b63fb003a26143d7500270ef418681d14cf0eef924e5a3036f8dc449813
SSDEEP

1536:zuizFjRkiQlLTATns/fJQG+8Y96s1rXUNKIGvMm926MqiVI0IKCSfm4Zythf5m:zuSdvns/fJQZ93S6smtm

Score

4^/10

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\EXttyz445.txt	26981a8e91b4ea7443855550b5d306e8_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 2544	4928	26981a8e91b4ea7443855550b5d306e8_JaffaCakes118.exe	84
PID 4928 wrote to memory of 2544	4928	26981a8e91b4ea7443855550b5d306e8_JaffaCakes118.exe	84
PID 4928 wrote to memory of 2544	4928	26981a8e91b4ea7443855550b5d306e8_JaffaCakes118.exe	84
PID 4928 wrote to memory of 1360	4928	26981a8e91b4ea7443855550b5d306e8_JaffaCakes118.exe	85
PID 4928 wrote to memory of 1360	4928	26981a8e91b4ea7443855550b5d306e8_JaffaCakes118.exe	85
PID 4928 wrote to memory of 1360	4928	26981a8e91b4ea7443855550b5d306e8_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\26981a8e91b4ea7443855550b5d306e8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26981a8e91b4ea7443855550b5d306e8_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Del "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsFileStarter.exe"
  2⤵
  PID:2544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c move C:\Users\Public\AppData\Local\Programs\WindowsFileStarter.exe "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsFileStarter.exe"
  2⤵
  PID:1360

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact