0fda34381a6912a8eda1b55044e1aa8f8d3378eeedfb49e8f6996a626790256e

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2025, 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
Size

202KB
MD5

506fd91045e61a746e3a6582df0d3020
SHA1

528a7cc0ea65b4c4341e7bbac4672611eca3ab1e
SHA256

0fda34381a6912a8eda1b55044e1aa8f8d3378eeedfb49e8f6996a626790256e
SHA512

0eb05d1e2abc7bf76bc6d4d82e06565ee42d5b81fa0a384f8e96833a63e52cbfc5dad9873e87323f1d2478348c51ef768c0a3f384dfced829de9f280e20cfbb6
SSDEEP

6144:+St1Febl8qPzJNJy/KINFBJNYtGucZOLv8pgHg:+StKbl8mJtMFzNYtk4j8yHg

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
File opened (read-only)	\??\R:	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
File opened (read-only)	\??\V:	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
File opened (read-only)	\??\Y:	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
File opened (read-only)	\??\G:	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
File opened (read-only)	\??\J:	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
File opened (read-only)	\??\K:	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
File opened (read-only)	\??\N:	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
File opened (read-only)	\??\T:	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
File opened (read-only)	\??\W:	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
File opened (read-only)	\??\B:	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
File opened (read-only)	\??\E:	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
File opened (read-only)	\??\H:	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
File opened (read-only)	\??\I:	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
File opened (read-only)	\??\L:	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
File opened (read-only)	\??\P:	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
File opened (read-only)	\??\U:	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
File opened (read-only)	\??\X:	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
File opened (read-only)	\??\O:	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
File opened (read-only)	\??\Q:	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
File opened (read-only)	\??\S:	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
File opened (read-only)	\??\Z:	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_506fd91045e61a746e3a6582df0d3020.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads