fefc80fc9abcdaf8130585d40e3ac48fb50ce3fd99dc0a9dbf28a997e9fa5cbb

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 15:41

Target

5c938d165840c35c177cff6f7c745302_JaffaCakes118.exe
Size

527KB
MD5

5c938d165840c35c177cff6f7c745302
SHA1

94a120af13cdd8dc0f40ece2bb82e8a73679b170
SHA256

fefc80fc9abcdaf8130585d40e3ac48fb50ce3fd99dc0a9dbf28a997e9fa5cbb
SHA512

776274db5f6a0c44ca8c5949726531e18a48f0e3c7f6e475fbfc0e890598e342223853211f956ca7da4e9a48c6882df57dc6a9173036374ef2a0819490a7e92f
SSDEEP

6144:gDcOGoLbvxE+kJaIoxsJ1Txtx/nMc34YHdYE6KFxg7BWPvVSkwefn9ZMpoJVk0KL:gfxExJGxsTZB4qdYE6KFx2Byc61bq

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2820	5c938d165840c35c177cff6f7c745302_JaffaCakes118.exe
2820	5c938d165840c35c177cff6f7c745302_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5c938d165840c35c177cff6f7c745302_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5c938d165840c35c177cff6f7c745302_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2820

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact