Analysis
-
max time kernel
135s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
08/04/2024, 22:43
General
-
Target
e898a462e17b7b76a28c6bb532449533_JaffaCakes118.exe
-
Size
471KB
-
MD5
e898a462e17b7b76a28c6bb532449533
-
SHA1
4b72c687640960fe9196d62ac8c7705067b4a093
-
SHA256
e17313e548adeb9f0dcb5a05af7e98fed2d2a36f9ec27e74997e06e1b50e0d08
-
SHA512
795e095c2a7d15fc01d98b3532a3b325ac2d22f66b5b232e7d443c6d575745616000903feb31d1d6c64c1af431af3711d95c622b3ba594de22b3ec7c87f1d618
-
SSDEEP
6144:2FP5KmElEoV9a8nEobA8hIuuxLbKMHy4GcIFC6SHFEm9+wuOtVUuaJy0PAEIrtAX:2SPxa4EUP0nKMHy4LHFEm9+wFV/axIe
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Windows directory 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e898a462e17b7b76a28c6bb532449533_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e898a462e17b7b76a28c6bb532449533_JaffaCakes118.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\windos.exeC:\Windows\windos.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD54bc5193cb394e7aeb08ddbc0d99e0053
SHA18e34152d1a6ef18be7e0fc933ae19d885efb0b1b
SHA256058048474aac6bdf29cbc4a6b10ed600636fb53e6b5f569f2b24cd42a13546f8
SHA512b00118bc3bb95664a1a05fb3d5cddbf6bb6dd8b69cec39f81929b9b1d7c71d146531c93a9d92d6feabf416529247bd67c73feec5fac4b505be10a89313a4c439
-
Filesize
471KB
MD5e898a462e17b7b76a28c6bb532449533
SHA14b72c687640960fe9196d62ac8c7705067b4a093
SHA256e17313e548adeb9f0dcb5a05af7e98fed2d2a36f9ec27e74997e06e1b50e0d08
SHA512795e095c2a7d15fc01d98b3532a3b325ac2d22f66b5b232e7d443c6d575745616000903feb31d1d6c64c1af431af3711d95c622b3ba594de22b3ec7c87f1d618
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
268KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
68KB