94a72ff1a92b192a8fdadf281ad95d3fa8210be18e57428d59ddc27fade7a1f8

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 03:06

Target

3bc4f3d0eb9f8dfe418438409904d195_JaffaCakes118.exe
Size

24KB
MD5

3bc4f3d0eb9f8dfe418438409904d195
SHA1

5ecde9e52bda0cced5842544763c7e28c8745b70
SHA256

94a72ff1a92b192a8fdadf281ad95d3fa8210be18e57428d59ddc27fade7a1f8
SHA512

1dc7a47fa15dc3029c6de10685f533e1a22658f442ed1b2cd4214c2dd211a1b673013b23738c81d8e74ecbda141e31da5f4c4c152bb4c25da78d298116c0a342
SSDEEP

192:gnscEZJ2su+Euuv6uc2+ixRxDlZjktFlxQOD30suiWQgE3:YlI0uuFc4hlZjeFMOD30suiWQgE3

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1624	3bc4f3d0eb9f8dfe418438409904d195_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3bc4f3d0eb9f8dfe418438409904d195_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3bc4f3d0eb9f8dfe418438409904d195_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1624

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact