c9815268f083eda7b9a01a723e65cbdf76918257d9170a0b708db6d3c9bd99a9

Analysis

max time kernel
135s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 08:06

Target

5faeda048b2786305e7124de7092df9c_JaffaCakes118.exe
Size

196KB
MD5

5faeda048b2786305e7124de7092df9c
SHA1

10df80cfe9a60ad235fd24589fdff86a46eccffe
SHA256

c9815268f083eda7b9a01a723e65cbdf76918257d9170a0b708db6d3c9bd99a9
SHA512

019a5e87872d81ba1d755488ded7611f87a5eaf19e0a915e8755375851845aa2b5024693fb940c2dd6b524ed23635d2340f3e8fed9824a44c328a9c8a103f4ad
SSDEEP

768:sRuKKay0WEhlRKWXV4FVpR8a0nMn49spydI8oY8A8/GRR3upi:ta9rxXViPx4XcYbRR3Ai

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2852	5faeda048b2786305e7124de7092df9c_JaffaCakes118.exe
2852	5faeda048b2786305e7124de7092df9c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5faeda048b2786305e7124de7092df9c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5faeda048b2786305e7124de7092df9c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2852

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact