Overview

overview

6

Static

static

3

fd8e73ea45...18.exe

windows7-x64

6

fd8e73ea45...18.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    20-04-2024 20:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fd8e73ea451bef07eb7176097fe41f39_JaffaCakes118.exe

  • Size

    3.5MB

  • MD5

    fd8e73ea451bef07eb7176097fe41f39

  • SHA1

    f11f5cfc76f3b03345ef927c084d2a09f93f6e0a

  • SHA256

    491b1ac5a9acf1afd97dcf53ae502ab99ff1b8b8011c733ad5d3edf98130b9c2

  • SHA512

    98eb821d17c6271c8765d0efd3559013976215f25d380f293dd38f57329e048195924e59bec549ba8e32c977cdf52ce9093cdae3bd6008635ba397458492a38d

  • SSDEEP

    98304:rX/GtNq1S3BWLcsEZVB6v0GGNJ5qwrumis8tJ4:rXutXmcsEnMBG9/kja

Score
6/10
bootkitpersistence

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd8e73ea451bef07eb7176097fe41f39_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fd8e73ea451bef07eb7176097fe41f39_JaffaCakes118.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2912

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2912-0-0x0000000000400000-0x000000000131B000-memory.dmp
    Filesize

    15.1MB

    Download
  • memory/2912-1-0x0000000000230000-0x0000000000232000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2912-2-0x0000000001370000-0x00000000013B3000-memory.dmp
    Filesize

    268KB

    Download
  • memory/2912-7-0x0000000002E60000-0x0000000002E61000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-6-0x0000000002E70000-0x0000000002E72000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2912-5-0x0000000002E30000-0x0000000002E31000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-4-0x0000000000250000-0x0000000000251000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-3-0x0000000000260000-0x0000000000261000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-8-0x0000000002E80000-0x0000000002E81000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-9-0x0000000002E40000-0x0000000002E41000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-10-0x0000000002E50000-0x0000000002E51000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-11-0x0000000002E90000-0x0000000002E91000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-12-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-13-0x0000000002EC0000-0x0000000002EC1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-14-0x0000000002EF0000-0x0000000002EF1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-16-0x0000000003220000-0x0000000003221000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-15-0x0000000002EE0000-0x0000000002EE1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-17-0x0000000002F00000-0x0000000002F01000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-18-0x0000000003240000-0x0000000003241000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-19-0x0000000003230000-0x0000000003231000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-41-0x0000000003490000-0x0000000003491000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-40-0x00000000034A0000-0x00000000034A1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-56-0x00000000043D0000-0x00000000043D1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-55-0x00000000043B0000-0x00000000043B1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-54-0x00000000043C0000-0x00000000043C1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-53-0x0000000003650000-0x0000000003651000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-52-0x0000000003660000-0x0000000003661000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-51-0x0000000003630000-0x0000000003631000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-50-0x0000000003640000-0x0000000003641000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-49-0x0000000003610000-0x0000000003611000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-48-0x0000000003560000-0x0000000003561000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-47-0x0000000003540000-0x0000000003541000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-46-0x0000000003550000-0x0000000003551000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-45-0x00000000034D0000-0x00000000034D1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-44-0x00000000034E0000-0x00000000034E1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-43-0x00000000034F0000-0x00000000034F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-42-0x00000000034B0000-0x00000000034B1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-39-0x0000000003470000-0x0000000003471000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-38-0x0000000003480000-0x0000000003481000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-62-0x0000000005790000-0x0000000005791000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-61-0x00000000043E0000-0x00000000043E1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-60-0x0000000003620000-0x0000000003621000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-59-0x0000000003570000-0x0000000003571000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-58-0x00000000034C0000-0x00000000034C1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-57-0x00000000013C0000-0x00000000013C1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-63-0x00000000057A0000-0x00000000057A1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-37-0x0000000003450000-0x0000000003451000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-36-0x0000000003460000-0x0000000003461000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-35-0x0000000003430000-0x0000000003431000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-34-0x0000000003440000-0x0000000003441000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-33-0x0000000003410000-0x0000000003411000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-32-0x0000000003420000-0x0000000003421000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-31-0x00000000033F0000-0x00000000033F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-30-0x0000000003400000-0x0000000003401000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-29-0x00000000032D0000-0x00000000032D1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-28-0x00000000032E0000-0x00000000032E1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-27-0x00000000032B0000-0x00000000032B1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-26-0x00000000032C0000-0x00000000032C1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-25-0x0000000003290000-0x0000000003291000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-24-0x00000000032A0000-0x00000000032A1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-23-0x0000000003270000-0x0000000003271000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-22-0x0000000003280000-0x0000000003281000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-21-0x0000000003250000-0x0000000003251000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-20-0x0000000003260000-0x0000000003261000-memory.dmp
    Filesize

    4KB

    Download