Analysis

  • max time kernel
    9s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08/05/2024, 23:49

General

  • Target

    274ba4b9503555799de29cfecf1af7d2_JaffaCakes118.exe

  • Size

    7.6MB

  • MD5

    274ba4b9503555799de29cfecf1af7d2

  • SHA1

    5c6bf712f3548fb7e1210ef0b8b6b5ac81d7b2f4

  • SHA256

    19a0812492b8775875dc06ad0e277cce7eded213c703d28603b8879a4b502d66

  • SHA512

    24abcf03f6ae08d66c75bb8a142a13778ddccc37b90c24bc444f70fa46fff24c63cae0b2d0734d88d94e697ef27bf03e99fb9d278a2b0a4c1af270a9638fc17c

  • SSDEEP

    98304:54jGpZMZgotGO5cseyuzvB0ZbScijRvry8:5SOMLnScIb

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\274ba4b9503555799de29cfecf1af7d2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\274ba4b9503555799de29cfecf1af7d2_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of SetWindowsHookEx
    PID:1900

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1900-0-0x0000000000230000-0x0000000000231000-memory.dmp

          Filesize

          4KB

        • memory/1900-3-0x0000000000400000-0x0000000000C42000-memory.dmp

          Filesize

          8.3MB

        • memory/1900-5-0x0000000000230000-0x0000000000231000-memory.dmp

          Filesize

          4KB

        • memory/1900-7-0x0000000000400000-0x0000000000C42000-memory.dmp

          Filesize

          8.3MB

        • memory/1900-9-0x0000000000400000-0x0000000000C42000-memory.dmp

          Filesize

          8.3MB

        • memory/1900-13-0x0000000000400000-0x0000000000C42000-memory.dmp

          Filesize

          8.3MB

        • memory/1900-17-0x0000000000400000-0x0000000000C42000-memory.dmp

          Filesize

          8.3MB