Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 23:18
Static task
static1
Behavioral task
behavioral1
Sample
fb647e8912ef19cd649843b18e525e52_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
fb647e8912ef19cd649843b18e525e52_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fb647e8912ef19cd649843b18e525e52_JaffaCakes118.exe
-
Size
188KB
-
MD5
fb647e8912ef19cd649843b18e525e52
-
SHA1
c990defba3f3335efc7a9a779e3ffa20f27ff682
-
SHA256
3b03b0704d4d68080bbf003aa8130fea742916ca4eb1f0d2c5c6a797b940670b
-
SHA512
4cdce476a2b0cb3284a5d8d2d164f777d91a9a81e33c7ba2dd318a7cdb939b92484fef31fb60b6bffe417287c90e6b62c5e691bb37bf1a0763be03574a3f06f4
-
SSDEEP
3072:FU7nhXFN/wA7BkBouB/lsYOtvt3HEbdavHviikClD8R2FCCyTN1slZRv+:MvN/fCBou8xHQdavvyyD8R2FCC4URv+
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2108 cmd.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
fb647e8912ef19cd649843b18e525e52_JaffaCakes118.exedescription ioc process File opened for modification \??\PhysicalDrive0 fb647e8912ef19cd649843b18e525e52_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
fb647e8912ef19cd649843b18e525e52_JaffaCakes118.exepid process 2072 fb647e8912ef19cd649843b18e525e52_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
fb647e8912ef19cd649843b18e525e52_JaffaCakes118.exedescription pid process Token: SeIncBasePriorityPrivilege 2072 fb647e8912ef19cd649843b18e525e52_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
fb647e8912ef19cd649843b18e525e52_JaffaCakes118.exedescription pid process target process PID 2072 wrote to memory of 2108 2072 fb647e8912ef19cd649843b18e525e52_JaffaCakes118.exe cmd.exe PID 2072 wrote to memory of 2108 2072 fb647e8912ef19cd649843b18e525e52_JaffaCakes118.exe cmd.exe PID 2072 wrote to memory of 2108 2072 fb647e8912ef19cd649843b18e525e52_JaffaCakes118.exe cmd.exe PID 2072 wrote to memory of 2108 2072 fb647e8912ef19cd649843b18e525e52_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb647e8912ef19cd649843b18e525e52_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fb647e8912ef19cd649843b18e525e52_JaffaCakes118.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\FB647E~1.EXE > nul2⤵
- Deletes itself