Analysis

  • max time kernel
    121s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19-04-2024 07:07

General

  • Target

    f9c597c97d77f09e97c9da1ec95d0391_JaffaCakes118.exe

  • Size

    260KB

  • MD5

    f9c597c97d77f09e97c9da1ec95d0391

  • SHA1

    082a444af84db2feaf8cf30e128cce1da035ba4e

  • SHA256

    5c31c87e2cd36382e4dce5559a1f79d9b96d2f952e7ceef69daa6907f1d9ac05

  • SHA512

    faeb1b275109a305aea53618cfa5441c95d11fceb5e44395434868c6d3d4b593c5a6fe96eab43d4e57f69822834c02f24ec789e63b3befde0007c18518b09650

  • SSDEEP

    6144:uLr5atHtCAIdgVPFPVsRoDr4RshX6AL0dDUSC+u2mMp+h:W5atTLP12R7itgdu+u2mMp+h

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f9c597c97d77f09e97c9da1ec95d0391_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f9c597c97d77f09e97c9da1ec95d0391_JaffaCakes118.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    PID:2220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2220-0-0x0000000000400000-0x0000000000497000-memory.dmp

    Filesize

    604KB

  • memory/2220-1-0x0000000000400000-0x0000000000497000-memory.dmp

    Filesize

    604KB

  • memory/2220-2-0x0000000000400000-0x0000000000497000-memory.dmp

    Filesize

    604KB