Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 05:03
Static task
static1
Behavioral task
behavioral1
Sample
f9914ab510dde9e87b599edcd6809fe6_JaffaCakes118.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
f9914ab510dde9e87b599edcd6809fe6_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f9914ab510dde9e87b599edcd6809fe6_JaffaCakes118.exe
-
Size
848KB
-
MD5
f9914ab510dde9e87b599edcd6809fe6
-
SHA1
f91fc67489a1460534031bcafe03b6c39f7e8f77
-
SHA256
bcf51fb499b7e5214c625319435406e693050b7b9f0ac725ac992fde3b4dd302
-
SHA512
cddcbbef0ac7ad6950108ec539f42894024900803b052e1ac74c4ff45e703c4d4f37c5c41b6371b8e165e562fbaf644871fc80b3e5198f0951ef6b570d727215
-
SSDEEP
12288:zDWOBXq8Fp+UKBI/K9kVCtX4HjYAH84wHA8T6du:zDW+68P+zi/Mk7DYAcfAZw
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
f9914ab510dde9e87b599edcd6809fe6_JaffaCakes118.exedescription ioc process File opened for modification \??\PhysicalDrive0 f9914ab510dde9e87b599edcd6809fe6_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f9914ab510dde9e87b599edcd6809fe6_JaffaCakes118.exepid process 316 f9914ab510dde9e87b599edcd6809fe6_JaffaCakes118.exe 316 f9914ab510dde9e87b599edcd6809fe6_JaffaCakes118.exe