b34d899d6bcbac620b5c78c03f18996de9e5387c6790859afe2fb583c3300ba8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
Size 70KB
Sample240525-vy5fjscc55
SHA256 b34d899d6bcbac620b5c78c03f18996de9e5387c6790859afe2fb583c3300ba8
MD5 72b51962eae6881872989c6f9b619335
SHA1 05ba65ec13d73b2abbd91e8e22e212d271cc964d
SHA512 5db3c0ed8cd52368c472c50b0414b145e862cebed3f52ec32c59e228097834e4b245740d039d95c73883d05d3ecdfb79b1b9097e2aedd99d0cececdadfb63ca5
SSDEEP 1536:TZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:Cd5BJHMqqDL2/Ovvdr
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\xkknnoxxgrj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\72b51962eae6881872989c6f9b619335_JaffaCakes118.exe"	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
File opened (read-only)	\??\P:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
File opened (read-only)	\??\Q:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
File opened (read-only)	\??\R:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
File opened (read-only)	\??\W:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
File opened (read-only)	\??\X:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
File opened (read-only)	\??\J:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
File opened (read-only)	\??\L:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
File opened (read-only)	\??\Y:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
File opened (read-only)	\??\B:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
File opened (read-only)	\??\K:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
File opened (read-only)	\??\N:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
File opened (read-only)	\??\A:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
File opened (read-only)	\??\E:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
File opened (read-only)	\??\I:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
File opened (read-only)	\??\M:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
File opened (read-only)	\??\S:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
File opened (read-only)	\??\T:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
File opened (read-only)	\??\U:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
File opened (read-only)	\??\V:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
File opened (read-only)	\??\G:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
File opened (read-only)	\??\H:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
File opened (read-only)	\??\Z:	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3076	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
3076	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
3076	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
3076	72b51962eae6881872989c6f9b619335_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\72b51962eae6881872989c6f9b619335_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\72b51962eae6881872989c6f9b619335_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3076