964c9da06d8d88950168617af6016a1f00949bd984d0c4b68bb0f13538183d4e

Analysis

max time kernel
101s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 16:00

Target

468660005b634c5783d920582af3d32b_JaffaCakes118.exe
Size

471KB
MD5

468660005b634c5783d920582af3d32b
SHA1

1a4b5a0341e3f460364e46d31a2ee1047aa731c2
SHA256

964c9da06d8d88950168617af6016a1f00949bd984d0c4b68bb0f13538183d4e
SHA512

300fecdb1de71f04e27bbc4dd33a457330d90a630ddc3e9149ea884e302a02cf7f443e989d4483d257f03508219cc6993f2b243cc2a1087b1dae17d9d26e44d1
SSDEEP

12288:sTJcGkYjy639E1f2vZsSmERnAzZg+5LbxG57AoYsla5:KJkYjDhbjRANfPu7ANSa5

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1952	468660005b634c5783d920582af3d32b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\468660005b634c5783d920582af3d32b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\468660005b634c5783d920582af3d32b_JaffaCakes118.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1952

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact