48d034ee95da86bd284da54211326597e374709453d6dead503a0c18f7838953

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 20:13

Target

5d8014c88c1ea1a67455856c3bd81f1e_JaffaCakes118.exe
Size

3.9MB
MD5

5d8014c88c1ea1a67455856c3bd81f1e
SHA1

77b39d4b62a36c168a58be2a12038c837526246f
SHA256

48d034ee95da86bd284da54211326597e374709453d6dead503a0c18f7838953
SHA512

cc95a7d76c86d733d9dc9e723911e14ad04614962cf9e61d08adb67d0de48781d84caae3cace33ed04a203be5f33cecfd2c8e9f3a4f889987cc9da0c3c360a10
SSDEEP

49152:mohlsCzzF/BGhWUCBSEvFYmGSY6hEeeA0aVeCDmd4574rY1TtKt7mwAtTGywBYMw:VxPGhXCoCLDXeANGrYilV4wSAlwy/b+

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
976	5d8014c88c1ea1a67455856c3bd81f1e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5d8014c88c1ea1a67455856c3bd81f1e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5d8014c88c1ea1a67455856c3bd81f1e_JaffaCakes118.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:976

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact