Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30-03-2024 10:37
Static task
static1
Behavioral task
behavioral1
Sample
3a71e06b5682fcb566d0311ef0508123_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3a71e06b5682fcb566d0311ef0508123_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
3a71e06b5682fcb566d0311ef0508123_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
3a71e06b5682fcb566d0311ef0508123
-
SHA1
4f5842dbedd58e9833f661fb9cca693493c9a01d
-
SHA256
5d222087e9cc1a6dc153e8f69ddd1288badf5793442922f413af394fffc7ab38
-
SHA512
cd3024c5b8dc2c8217bd4c6ffcd3573a112a70d0ae2e6b4f21ad7fd2f352c670edf9d2b0a7097fe155bc938091a90bdc7dca8db0c148ac5a3c94014d5e76da0f
-
SSDEEP
12288:d716fd+H6mAn3HMHQKOfmv4SBZaRtkuyQrioUaDBfLSpQOhygGyBjPVP+PVPXP04:t16fdIAiHOfgDaRt/HeoUaDBfLoxcjy
Malware Config
Extracted
metasploit
windows/shell_reverse_tcp
73.61.110.191:4444
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
3a71e06b5682fcb566d0311ef0508123_JaffaCakes118.exedescription ioc process File opened for modification \??\PhysicalDrive0 3a71e06b5682fcb566d0311ef0508123_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1460-1-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1460-2-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1460-3-0x0000000000400000-0x0000000000514000-memory.dmpFilesize
1.1MB
-
memory/1460-5-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1460-6-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB