1e4519b90828e71ac7b3f6e6eeb3463a02462640433e6b384206cf852931c4a4

Analysis

max time kernel
93s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 05:12

Target

4ced262b34f360c28c2d580d847fffb0_JaffaCakes118.exe
Size

650KB
MD5

4ced262b34f360c28c2d580d847fffb0
SHA1

e4588ddb8850635e1516e4c7304d75ce104cbc06
SHA256

1e4519b90828e71ac7b3f6e6eeb3463a02462640433e6b384206cf852931c4a4
SHA512

907bf01357565b517172d7a04e6bf33aceadc9d9b54604d2777b35f732aa4329278be3934cd24940070c86b8f81566bbdc1fcfd41a830586f3c57403833ea344
SSDEEP

12288:n2ncfTgXVPOjxm/OHtY41gnRTCJzct+Udd1a+60KnXOFFZ8XC4czsDJMtc:n2nc09YHNuRKQt+Udd1aeuXokJGc

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
3332	4ced262b34f360c28c2d580d847fffb0_JaffaCakes118.exe
3332	4ced262b34f360c28c2d580d847fffb0_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\HBCheckPermission.txt	4ced262b34f360c28c2d580d847fffb0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\HBCheckPermission.txt	4ced262b34f360c28c2d580d847fffb0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3332	4ced262b34f360c28c2d580d847fffb0_JaffaCakes118.exe
3332	4ced262b34f360c28c2d580d847fffb0_JaffaCakes118.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsf9FAD.tmp\Install.dll

Filesize
222KB

MD5
e1ec3d2a9b2cbe5de921cb3c12a509fe

SHA1
416b87df5b8a47c17b3b2e9436ae0b3f007caeaa

SHA256
86fe1c287abdb24f997d31b71849e7c31fffc2c4d58bcf410cc9af8d8b1efd16

SHA512
0192f2cfe18d34a0d8af91078e2b44b5144b0f70331f39aa2dfe207ab3184a5c21417f99a8cc69a02493de9396457ad080f876bc04aaa44a2f1073a7914f4fd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf9FAD.tmp\Setup.dll

Filesize
70KB

MD5
ceb233fa36d2f6dd6a4f4058a453d462

SHA1
c254ab2371c415d956613a2c6acb277c16d906fe

SHA256
1313e4399fcec8c6fd0928a8b9a8814cdc7dc31906bf173edf79adaf2ac2d74c

SHA512
8bbb3f3f9205cc1134484c03ce4623eb7440893707f56ffb79b36eb794d9044d90fbf953445e3c1fe47cc6aa38d4eb4acb8f180096d0ebde0e9b50fea014f734

Download Submit