e0f847c7d6e52d0812f4a227a2bbe01e66a2b2ed2926af2d6074ba629ad10b79

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 03:50

Target

5eec14bb7a16ecebd6fd67ac024c32c0_JaffaCakes118.exe
Size

56KB
MD5

5eec14bb7a16ecebd6fd67ac024c32c0
SHA1

37b3b7975564fcb5dfbb7eabccafbbf8f5c11c84
SHA256

e0f847c7d6e52d0812f4a227a2bbe01e66a2b2ed2926af2d6074ba629ad10b79
SHA512

2de12d3b25244c634033dadf837f0119e11781f7e86b790999eb416a97c5ef45ad6e6902af9a383bda0849e20b4b0710599a991f92c42fc398c10eeab4869ec1
SSDEEP

768:/Dki8+mY1wyNJjyT3ic8didTMCdhknkPQVdIi8:/DI3Yk3ic8didTMAhkksd8

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2416	5eec14bb7a16ecebd6fd67ac024c32c0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5eec14bb7a16ecebd6fd67ac024c32c0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5eec14bb7a16ecebd6fd67ac024c32c0_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2416

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2416-5-0x0000000003F80000-0x0000000004A3A000-memory.dmp

Filesize
10.7MB

Download