7fc72bae2567ce83dabe8aed471c271757073487639ee55c97f0e50bd2b9e53e

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
Size

24KB
MD5

2142d3e84355a0a7a08bf73cdca27196
SHA1

69e5fc131a805e2189d89fda1908de1ec5d246f3
SHA256

7fc72bae2567ce83dabe8aed471c271757073487639ee55c97f0e50bd2b9e53e
SHA512

34e18dd3818c470c6f81dcd97fb8e4da27e8444b4ecb33ec6cce8935d73258f1932ee77339ea77ae1aba997cbe51745ea8818932b223ac300d9edd5b32e6e60e
SSDEEP

384:icBKws3oMdb2pcjFNXudkTtPGI5T7wFPR9X9Loc9DFdrCnjM:icBKZ/dbO+beKhPGId76RP/fr4jM

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
File opened (read-only)	\??\Z:	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
File opened (read-only)	\??\N:	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
File opened (read-only)	\??\O:	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
File opened (read-only)	\??\U:	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
File opened (read-only)	\??\V:	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
File opened (read-only)	\??\J:	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
File opened (read-only)	\??\K:	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
File opened (read-only)	\??\P:	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
File opened (read-only)	\??\E:	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
File opened (read-only)	\??\L:	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
File opened (read-only)	\??\M:	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
File opened (read-only)	\??\R:	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
File opened (read-only)	\??\S:	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
File opened (read-only)	\??\T:	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
File opened (read-only)	\??\W:	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
File opened (read-only)	\??\G:	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
File opened (read-only)	\??\H:	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
File opened (read-only)	\??\I:	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
File opened (read-only)	\??\Q:	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
File opened (read-only)	\??\Y:	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4348	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
Token: SeSecurityPrivilege	4348	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
Token: SeDebugPrivilege	4348	2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2142d3e84355a0a7a08bf73cdca27196_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4272,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
1⤵
PID:3952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads