f4f3052b0203b13066001c11abb294681c1d68afd67bba86ca797810077a6fcf

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 16:04

Target

5ca67d27af169b703cb812e1b655539a_JaffaCakes118.exe
Size

206KB
MD5

5ca67d27af169b703cb812e1b655539a
SHA1

3f795b95696e94aefe986bf147892552557fcd23
SHA256

f4f3052b0203b13066001c11abb294681c1d68afd67bba86ca797810077a6fcf
SHA512

a4d5500a758ba7982535b06e7410cf625b98914ccb96efe8a51b4ca51294ba993cbd7bee19729b087eba87223d4df47b4ca77cafff59b3b97ace7676207db996
SSDEEP

3072:utqnLDJYWNaLzyfXeva3TQIyJka/RDl3VtYr7DVKUtIGfUbkwWxbK/FRbca+v57c:qsxanyfX5k7JlJDlABKUtfU/WQcb5w/R

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2228	1900	5ca67d27af169b703cb812e1b655539a_JaffaCakes118.exe	30
PID 1900 wrote to memory of 2228	1900	5ca67d27af169b703cb812e1b655539a_JaffaCakes118.exe	30
PID 1900 wrote to memory of 2228	1900	5ca67d27af169b703cb812e1b655539a_JaffaCakes118.exe	30
PID 1900 wrote to memory of 2228	1900	5ca67d27af169b703cb812e1b655539a_JaffaCakes118.exe	30
PID 1900 wrote to memory of 2228	1900	5ca67d27af169b703cb812e1b655539a_JaffaCakes118.exe	30
PID 1900 wrote to memory of 2228	1900	5ca67d27af169b703cb812e1b655539a_JaffaCakes118.exe	30
PID 1900 wrote to memory of 2228	1900	5ca67d27af169b703cb812e1b655539a_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\5ca67d27af169b703cb812e1b655539a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5ca67d27af169b703cb812e1b655539a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\fud.bat" "
  2⤵
  PID:2228

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fud.bat

Filesize
34B

MD5
74d629314544b6758e986bb83a168cbf

SHA1
b8e4bda7f40a159f54b341515442bef7bca671af

SHA256
384c31b1700ba81f6bb647f6584b1302b3eeb96b0404a1b2db6f04367a3690fc

SHA512
357f94019a558d0eb3822f77d8bae3226d3a30a8e953fef855d3b4d5e08bebb47d549dc4b1c87c2f555999cd9782292da2cf613d2335fa4b53a77de14ed39c91

Download Submit