Analysis
-
max time kernel
31s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
21/04/2024, 14:13
General
-
Target
ff7610c6bd197836fe627c73868f1d3c_JaffaCakes118.exe
-
Size
173KB
-
MD5
ff7610c6bd197836fe627c73868f1d3c
-
SHA1
37c2d09aeb4ab1ebbcf783e66b8a0d63e51a8873
-
SHA256
7860c0a2ee26fe52950b261176fe6268444f36d634aefb432cb4f97a3685dcb6
-
SHA512
c650ec4498bc190a80a25c7d86947526335acb62b2ef1babc27f3c0ee3144e98e3274e0fc0d82f6d7c83abb66bab38cd27d661e42bfb3585b1ad7c80ac1f52c6
-
SSDEEP
3072:SqZLBRcAWHQjvN6gvrYaYhty4DjC7enN8AAFabdRZXROTuoHcZVT:7RBRFWw6gvMRhdDjC70ambjZYTuWi
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff7610c6bd197836fe627c73868f1d3c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff7610c6bd197836fe627c73868f1d3c_JaffaCakes118.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
268KB
-
Filesize
268KB
-
Filesize
268KB
-
Filesize
268KB