737e4ae6c39dd96e875655679e107d5175df6f9be6dfe32fab9d08bc40a5e55d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 20:34

Target

614c6197e9fe3a7c14be3b38006ab7c8_JaffaCakes118.exe
Size

632KB
MD5

614c6197e9fe3a7c14be3b38006ab7c8
SHA1

aa2c4a85a8bbc8edf376a25c378c4fb5cdeff1ea
SHA256

737e4ae6c39dd96e875655679e107d5175df6f9be6dfe32fab9d08bc40a5e55d
SHA512

b512d2cc4b006510ab84a8e1d96df393c6a4ea105417e7a6700993bc015a0a4707f8a7db002c6a6655bf35bd82d5c15a649ee7dce033c3bf44b1299b33cc5f12
SSDEEP

12288:HLn4YYvncgVhfc8otjGDC0i1SwLbBVpkksxFmJMPs:HPYnFoIDC0i1BbBnkLg

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1596	614c6197e9fe3a7c14be3b38006ab7c8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\614c6197e9fe3a7c14be3b38006ab7c8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\614c6197e9fe3a7c14be3b38006ab7c8_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1596

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1596-0-0x0000000000400000-0x00000000006F5000-memory.dmp

Filesize
3.0MB

Download
memory/1596-1-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1596-2-0x0000000000400000-0x00000000006F5000-memory.dmp

Filesize
3.0MB

Download
memory/1596-3-0x0000000000400000-0x00000000006F5000-memory.dmp

Filesize
3.0MB

Download