60ce57495995c083a96cf9fe8b29383e5b32ffc70be120da8558296ef755e436

Analysis

max time kernel
141s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4625c8d0063635fb919c7987b4538b05_JaffaCakes118.exe
Size

4.0MB
MD5

4625c8d0063635fb919c7987b4538b05
SHA1

613be6a1d5115746262160c431d3b3354d5d123f
SHA256

60ce57495995c083a96cf9fe8b29383e5b32ffc70be120da8558296ef755e436
SHA512

53da3d409f76c707bffc57e16df324511fb2958d1bb6db4aac76ce2d8e81dabd59f0712345683cb38e8175ef2639c2f950103ef93791402004cfbe7c5547a01f
SSDEEP

98304:0LaK2RUBuroeSo/p3QF7JEgmySJS/63Hlb/:0L/aP/pQFK35/

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2432	4625c8d0063635fb919c7987b4538b05_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2432	4625c8d0063635fb919c7987b4538b05_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4625c8d0063635fb919c7987b4538b05_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4625c8d0063635fb919c7987b4538b05_JaffaCakes118.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2432-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2432-1-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2432-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download