ac49604609ddde1e0541aac87ba39ceec14fc91b4d8ae590bc8f0dbebeedbf22

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 08:51

Target

451e4ccd9a51708816f51f217605e9b1_JaffaCakes118.exe
Size

3.1MB
MD5

451e4ccd9a51708816f51f217605e9b1
SHA1

6c82b306b84735300a88b938d0e2ab89e5ae5626
SHA256

ac49604609ddde1e0541aac87ba39ceec14fc91b4d8ae590bc8f0dbebeedbf22
SHA512

d71b5c8184e8016bd20d07a0ddb095e71603afddd6f55a253c7ffd2ec8ad206bc24729a3b811fe7590e2ba822891e06e6863931690ad837d2f1033ee81b9cfb5
SSDEEP

49152:TwH0uyKA0gvyEVLfZ5rll3o31pyhK7E16LVpnZuRYYQYfWnnCq2LzgWYtpVu:TwUVXUOYQ0cfanwLMNa

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4292	451e4ccd9a51708816f51f217605e9b1_JaffaCakes118.exe
4292	451e4ccd9a51708816f51f217605e9b1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\451e4ccd9a51708816f51f217605e9b1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\451e4ccd9a51708816f51f217605e9b1_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4292

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4292-23-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4292-24-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download