0227f68e278770f25bbaa225bc376dc8f2d08534c3fef718264420dc8b488a7c

Analysis

max time kernel
141s
max time network
157s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 07:09

Target

669aa8332f009d8b41d4e6589797aa11_JaffaCakes118.exe
Size

143KB
MD5

669aa8332f009d8b41d4e6589797aa11
SHA1

28f311c2e0e9d2390d569a8ebef813821ee3ad24
SHA256

0227f68e278770f25bbaa225bc376dc8f2d08534c3fef718264420dc8b488a7c
SHA512

a4d8b505ba342a9a05361897773d558fa82257a34016dc5b893e279e34aa0deb1904d5944416de002df220ccd4db1c466e35cfe5cacd739205d92251b6c14e0e
SSDEEP

3072:tDZftW3jSH3zhkeTfxHDrPzllDIUVPAi0zn9o/H6JHZry6u7:RZVQ61kcHh+7i0nJHPu

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\msnetcfg.scr	669aa8332f009d8b41d4e6589797aa11_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\669aa8332f009d8b41d4e6589797aa11_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\669aa8332f009d8b41d4e6589797aa11_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
PID:2884

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\SysWOW64\msnetcfg.scr

Filesize
41KB

MD5
4ecb4ab92121d651ed8ba0e64ae14cbb

SHA1
7e4b7e94c3fed14c3d884ba9b049890072dfdde3

SHA256
7f0c04b63501c051bbbd4cdcfb15ffbc07def2f970ae8e91f430b5dd3c0408ae

SHA512
7a295f198f5bf562cac9d4992d1b8a0c8e88423da8667535e173d6237a61b3ea447b46d7ea93bc080c8e6d9cca16b61baf271ff85d96d4e2cb2a493511acd76c

Download Submit
memory/2884-0-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2884-1-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2884-2-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2884-26-0x0000000003A40000-0x0000000003A50000-memory.dmp

Filesize
64KB

Download
memory/2884-29-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2884-31-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2884-33-0x0000000003A40000-0x0000000003A50000-memory.dmp

Filesize
64KB

Download