fd92f79100c907354c1aa87b5b4046fc29e344948a7540270b38cd40510f861e

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 19:49

Target

4319f3cb700b690e77be828e89f58380_JaffaCakes118.exe
Size

34KB
MD5

4319f3cb700b690e77be828e89f58380
SHA1

f594cf28a07aab5262a0d6195c6c1ddab48e3971
SHA256

fd92f79100c907354c1aa87b5b4046fc29e344948a7540270b38cd40510f861e
SHA512

0d8a8a1ddf3cf304a51b14eb75aa4ef4a84b6340ff4d8ed7fbb1b96589d9cf7306e3feac56f543656b4c5a30d2437d78528f0004dfb2cac8c2444c25fe32a3d1
SSDEEP

768:cflivXrVKpVhKvtxwYHwVFoeAQUmucwUE3S:ylqrVKprVuQU8

Score

10^/10

Credentials

Executes dropped EXE 1 IoCs

pid	Process
2228	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
1288	4319f3cb700b690e77be828e89f58380_JaffaCakes118.exe
1288	4319f3cb700b690e77be828e89f58380_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\d5dc32fa\jusched.exe	4319f3cb700b690e77be828e89f58380_JaffaCakes118.exe
File created	C:\Program Files (x86)\d5dc32fa\d5dc32fa	4319f3cb700b690e77be828e89f58380_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2228	1288	4319f3cb700b690e77be828e89f58380_JaffaCakes118.exe	28
PID 1288 wrote to memory of 2228	1288	4319f3cb700b690e77be828e89f58380_JaffaCakes118.exe	28
PID 1288 wrote to memory of 2228	1288	4319f3cb700b690e77be828e89f58380_JaffaCakes118.exe	28
PID 1288 wrote to memory of 2228	1288	4319f3cb700b690e77be828e89f58380_JaffaCakes118.exe	28

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Program Files (x86)\d5dc32fa\d5dc32fa

Filesize
13B

MD5
f253efe302d32ab264a76e0ce65be769

SHA1
768685ca582abd0af2fbb57ca37752aa98c9372b

SHA256
49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd

SHA512
1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4

Download Submit
\Program Files (x86)\d5dc32fa\jusched.exe

Filesize
34KB

MD5
2b91baa1b13d7ac03229bdbaf090daff

SHA1
9031bc785a646deea06c72354dfb38bc8350f151

SHA256
210aee6f2edf0a9e6dc424e50e3455a84747b588f1ab08fede8e5323be837654

SHA512
5c638b76ef9c177ee9b48a664c49c16eac58323d1c65ef471bd254a5cc0539d740da309c374537fb1c143c3891d8a655ad03a01ef7e11f2b9782fa49098f1a4b

Download Submit