Analysis

  • max time kernel
    141s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-04-2024 05:01

General

  • Target

    fbfbb4c13cde3fe93c6d35db644b4010_JaffaCakes118.exe

  • Size

    487KB

  • MD5

    fbfbb4c13cde3fe93c6d35db644b4010

  • SHA1

    838f34070cb05796d5103f9f335961eace70170d

  • SHA256

    bb03dc355e19c6da8474b79e2b70ec93a1d4c3552841e8f86cb9c4054eafc96a

  • SHA512

    89f6521f37b0a65208eda1c31358f6008d2dc313bc07b3aacd58b15ae9349d47f5c94d0bbd0356a7edb125d07533f3cb68e812176633026c857667d1a0877730

  • SSDEEP

    6144:Z/S4ucTcJWzYXUe4bpCWe0oXjXYFFmZNpmjL:EcTcJWEEe4CWe0AXYTmZa/

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fbfbb4c13cde3fe93c6d35db644b4010_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fbfbb4c13cde3fe93c6d35db644b4010_JaffaCakes118.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    PID:2332
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3820 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1976

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Persistence

    Pre-OS Boot

    1
    T1542

    Bootkit

    1
    T1542.003

    Defense Evasion

    Pre-OS Boot

    1
    T1542

    Bootkit

    1
    T1542.003

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2332-0-0x0000000000400000-0x000000000047A000-memory.dmp
      Filesize

      488KB

    • memory/2332-1-0x0000000000400000-0x000000000047A000-memory.dmp
      Filesize

      488KB