fde2d6aeea9d796ae5019daba8ecf331306c0ace409ab71caa642a2e77872890

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 21:07

Target

36623c75ffec2417bc61e1af9ecf96ac_JaffaCakes118.exe
Size

68KB
MD5

36623c75ffec2417bc61e1af9ecf96ac
SHA1

54c718c55c9eff2091cc634a70ebe36545f73da9
SHA256

fde2d6aeea9d796ae5019daba8ecf331306c0ace409ab71caa642a2e77872890
SHA512

55106a735e2190a8041b667d6146e72730977e06a053e1566d60426a335c3242d88a5198de0632d88a31090600d6a4183911755247746337b84c2a79bc86a449
SSDEEP

384:/TDlE8ZB2xrnDN8VshTLUv/CMwE3hT8UqaIWOEuhThUVQqWCEZV:/VB6DNKe3e/CLERoTaIWOE0l4QqWCEX

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

tmp.exe

pid process

3044 tmp.exe
Loads dropped DLL 2 IoCs

Processes:

36623c75ffec2417bc61e1af9ecf96ac_JaffaCakes118.exe

pid process

1236 36623c75ffec2417bc61e1af9ecf96ac_JaffaCakes118.exe
1236 36623c75ffec2417bc61e1af9ecf96ac_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

36623c75ffec2417bc61e1af9ecf96ac_JaffaCakes118.exetmp.exe

pid process

1236 36623c75ffec2417bc61e1af9ecf96ac_JaffaCakes118.exe
3044 tmp.exe

pid	process
3044	tmp.exe

pid	process
1236	36623c75ffec2417bc61e1af9ecf96ac_JaffaCakes118.exe
1236	36623c75ffec2417bc61e1af9ecf96ac_JaffaCakes118.exe

pid	process
1236	36623c75ffec2417bc61e1af9ecf96ac_JaffaCakes118.exe
3044	tmp.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

36623c75ffec2417bc61e1af9ecf96ac_JaffaCakes118.exe

description	pid	process	target process
PID 1236 wrote to memory of 3044	1236	36623c75ffec2417bc61e1af9ecf96ac_JaffaCakes118.exe	tmp.exe
PID 1236 wrote to memory of 3044	1236	36623c75ffec2417bc61e1af9ecf96ac_JaffaCakes118.exe	tmp.exe
PID 1236 wrote to memory of 3044	1236	36623c75ffec2417bc61e1af9ecf96ac_JaffaCakes118.exe	tmp.exe
PID 1236 wrote to memory of 3044	1236	36623c75ffec2417bc61e1af9ecf96ac_JaffaCakes118.exe	tmp.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\tmp.exe

Filesize
16KB

MD5
400b692bfbb5ba938d33370dc2e36923

SHA1
8d9d7c560fe4c66661640cfbb1c80cdd948715a0

SHA256
6cfc91d77a0d2926b5ce5dedb6705a9325bfd0a6bf51c2d7c2f3ff4135761d04

SHA512
bc87f24876ce3a0e39893ae32046799549a82ce812df5819664a40b2f617fc3925193e5527cbabaafb7f56b582acadb148dbc1e48241e6fca74cce48eaf50938

Download Submit