0e89adff721c44c6057fc3a769e2e0d7db4ef90b9660a9fa16136da1717ee3b5

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 16:29

Target

4a7c666c768ce6f567c59b37cc173ef6_JaffaCakes118.exe
Size

36KB
MD5

4a7c666c768ce6f567c59b37cc173ef6
SHA1

90e9c5c5833fb258b053dff4a8338851a004b44e
SHA256

0e89adff721c44c6057fc3a769e2e0d7db4ef90b9660a9fa16136da1717ee3b5
SHA512

eac1e9b4d937ec0e9b19a8370c24ba6fd3b6eb63eab12451a4bcfa0aed2821f82dbf385a870e0c9767acf57502a41fb1977c23ed96316744f07dc6cf228366ed
SSDEEP

384:+n1NCbcHBZBkKyaowCJllp15Mr89/s18FaGRQauigU:xyZBhyao/JllX5MQ9JF1uigU

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2348	4a7c666c768ce6f567c59b37cc173ef6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4a7c666c768ce6f567c59b37cc173ef6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4a7c666c768ce6f567c59b37cc173ef6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2348

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KJ834MBR\instup[1].htm

Filesize
947B

MD5
6d7084e7857d93dc3ca77c1aa43b167b

SHA1
bea2d3f904aa29095185524165c037e688402260

SHA256
141626dd2c3fbbc10e38e9234170ae3574453a0fc686fcfbef95a266c796ea5d

SHA512
98ef9ec432d27e889fa3a3a198b4233b77fdc0698be817a9cbc0fc5c93abd3e90dc38cab81d157af0307aeaf56e26f71aa7209d40824da4db0cfcffc32ce04cb

Download Submit