Analysis

  • max time kernel
    143s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/05/2024, 23:49

General

  • Target

    274ba4b9503555799de29cfecf1af7d2_JaffaCakes118.exe

  • Size

    7.6MB

  • MD5

    274ba4b9503555799de29cfecf1af7d2

  • SHA1

    5c6bf712f3548fb7e1210ef0b8b6b5ac81d7b2f4

  • SHA256

    19a0812492b8775875dc06ad0e277cce7eded213c703d28603b8879a4b502d66

  • SHA512

    24abcf03f6ae08d66c75bb8a142a13778ddccc37b90c24bc444f70fa46fff24c63cae0b2d0734d88d94e697ef27bf03e99fb9d278a2b0a4c1af270a9638fc17c

  • SSDEEP

    98304:54jGpZMZgotGO5cseyuzvB0ZbScijRvry8:5SOMLnScIb

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\274ba4b9503555799de29cfecf1af7d2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\274ba4b9503555799de29cfecf1af7d2_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5116

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/5116-0-0x0000000000F60000-0x0000000000F61000-memory.dmp

          Filesize

          4KB

        • memory/5116-3-0x0000000000400000-0x0000000000C42000-memory.dmp

          Filesize

          8.3MB

        • memory/5116-4-0x0000000000400000-0x0000000000C42000-memory.dmp

          Filesize

          8.3MB

        • memory/5116-5-0x0000000000F60000-0x0000000000F61000-memory.dmp

          Filesize

          4KB

        • memory/5116-7-0x0000000000400000-0x0000000000C42000-memory.dmp

          Filesize

          8.3MB

        • memory/5116-9-0x0000000000400000-0x0000000000C42000-memory.dmp

          Filesize

          8.3MB

        • memory/5116-14-0x0000000000400000-0x0000000000C42000-memory.dmp

          Filesize

          8.3MB