Analysis
-
max time kernel
140s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 04:02
Behavioral task
behavioral1
Sample
1f6309f73422b2c6b9842ecc762c3af7_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
1f6309f73422b2c6b9842ecc762c3af7_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
1f6309f73422b2c6b9842ecc762c3af7_JaffaCakes118.exe
-
Size
411KB
-
MD5
1f6309f73422b2c6b9842ecc762c3af7
-
SHA1
952ce9b908eaa19939c5f10aa6d77084df5bff09
-
SHA256
8bcedd975286df6a6d4a50c022d646c62a6c3fe904e2d0d524e4d59c263e7cc8
-
SHA512
460228bcb451c647422ab7ae578b56714b222d99ea0b8abdf5934922956d895012ab00a0266bf61590dc0bd221219fd5a2524901c9b2f0687fb54c136c1dfad4
-
SSDEEP
6144:Kzg9hGPXBXDp4aufkZx5/Txkis+4sukqH8x7RhtNGLM2cKhkGW9zD3oqEoxJGaaz:iZXVufk1GEFqHgaw2ZkZ9n3o8xJc6AH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1524-0-0x0000000000400000-0x000000000052B000-memory.dmp upx behavioral2/memory/1524-14-0x0000000000400000-0x000000000052B000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 1f6309f73422b2c6b9842ecc762c3af7_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1524 1f6309f73422b2c6b9842ecc762c3af7_JaffaCakes118.exe 1524 1f6309f73422b2c6b9842ecc762c3af7_JaffaCakes118.exe 1524 1f6309f73422b2c6b9842ecc762c3af7_JaffaCakes118.exe 1524 1f6309f73422b2c6b9842ecc762c3af7_JaffaCakes118.exe 1524 1f6309f73422b2c6b9842ecc762c3af7_JaffaCakes118.exe 1524 1f6309f73422b2c6b9842ecc762c3af7_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 1524 1f6309f73422b2c6b9842ecc762c3af7_JaffaCakes118.exe 1524 1f6309f73422b2c6b9842ecc762c3af7_JaffaCakes118.exe 1524 1f6309f73422b2c6b9842ecc762c3af7_JaffaCakes118.exe 1524 1f6309f73422b2c6b9842ecc762c3af7_JaffaCakes118.exe 1524 1f6309f73422b2c6b9842ecc762c3af7_JaffaCakes118.exe 1524 1f6309f73422b2c6b9842ecc762c3af7_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1524 1f6309f73422b2c6b9842ecc762c3af7_JaffaCakes118.exe 1524 1f6309f73422b2c6b9842ecc762c3af7_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f6309f73422b2c6b9842ecc762c3af7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1f6309f73422b2c6b9842ecc762c3af7_JaffaCakes118.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1524