Overview

overview

10

Static

static

10

ffef1d0a7d...18.exe

windows7-x64

7

ffef1d0a7d...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/04/2024, 18:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    ffef1d0a7d54768be1cac2c5ea0e5257_JaffaCakes118.exe

  • Size

    956KB

  • MD5

    ffef1d0a7d54768be1cac2c5ea0e5257

  • SHA1

    61fbc477681b29d9c7dfa57c2f6003656865995a

  • SHA256

    6b78e196ed33cc518474ba995482dd9e38fcd76b44c65019d13e6f26aefebcf2

  • SHA512

    6d1ce202d90bbd5057646c0bffc98cc82722138ac67d22cb9fab771768684451dcac45d4b007c118403f382266bbed004822d2bfe11e8c18cf207af6166059da

  • SSDEEP

    24576:yBgfFUqV89IQ48LVZyRx5zzbCDOnkkoqbWadw4BagBzu+l:y3TnkoZ+l

Score
7/10
bootkitpersistenceupx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ffef1d0a7d54768be1cac2c5ea0e5257_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ffef1d0a7d54768be1cac2c5ea0e5257_JaffaCakes118.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    PID:5024
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 580
      2⤵
      • Program crash
      PID:1056
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5024 -ip 5024
    1⤵
      PID:2184

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/5024-0-0x0000000010000000-0x000000001000B000-memory.dmp

            Filesize

            44KB

            Download

          • memory/5024-1-0x0000000010000000-0x000000001000B000-memory.dmp

            Filesize

            44KB

            Download