66e0249562fc0c925e389c63f01cf9b1db19ed55150d407d9549c9b82254cb7f

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 21:18

Target

17904d7cbd8e723dd3433b8bb7ed43f8_JaffaCakes118.exe
Size

851KB
MD5

17904d7cbd8e723dd3433b8bb7ed43f8
SHA1

53dd557192dd7984947fd0fdfcae23d659ea0b2e
SHA256

66e0249562fc0c925e389c63f01cf9b1db19ed55150d407d9549c9b82254cb7f
SHA512

db6ebf1c84991d9f976667e07cb3af22f9749093cb08b1d7142b0afd334ad148423944c87b3e351cc7f70d983a8f952dc445a23b0b5138eff4cc960c09f46f40
SSDEEP

12288:ERoMU4k+X8VeMRH0bzzWzN4YcYztmoY/sbO4t9i49gLlDHWV6mnqmDSPpZ:/MU4/AyeaYc2tmTUbO4tAxLlHWV5qpf

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

17904d7cbd8e723dd3433b8bb7ed43f8_JaffaCakes118.exe

pid process

2916 17904d7cbd8e723dd3433b8bb7ed43f8_JaffaCakes118.exe

pid	process
2916	17904d7cbd8e723dd3433b8bb7ed43f8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\17904d7cbd8e723dd3433b8bb7ed43f8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17904d7cbd8e723dd3433b8bb7ed43f8_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2916

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

memory/2916-0-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/2916-1-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/2916-3-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/2916-2-0x0000000000401000-0x0000000000418000-memory.dmp

Filesize
92KB

Download
memory/2916-4-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/2916-10-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download