Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 07:15
Static task
static1
Behavioral task
behavioral1
Sample
74b544a2dba07ac124285e2ff8a330e5_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
74b544a2dba07ac124285e2ff8a330e5_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
74b544a2dba07ac124285e2ff8a330e5_JaffaCakes118.exe
-
Size
107KB
-
MD5
74b544a2dba07ac124285e2ff8a330e5
-
SHA1
e687f1b15e3b180f44aeaa804a7476b32b765317
-
SHA256
224aaa33d14e22344ace695ae30f54f6fa866d96995e5c655f2a0baa9ff04703
-
SHA512
d5442314ed655b0a4ce3891b6559bc7ff37db8d26c5c98778538ab7999cff953c195bb080d9dd4f39356ad624120b1d98a75ff081d4393f8d027f64900fb7dcf
-
SSDEEP
1536:nDdP8cdnG3eQ8GAaUKtwIxDHB4qWrkkdXpr3GtZO/1tIrre4PV3taDC:nDdkcJGUAB78kk/jN1tIrre4d3Y
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\userinit.lnk 74b544a2dba07ac124285e2ff8a330e5_JaffaCakes118.exe -
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 139.99.66.103 Destination IP 139.99.66.103 Destination IP 139.99.66.103 Destination IP 139.99.66.103 Destination IP 139.99.66.103 Destination IP 139.99.66.103 -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 74b544a2dba07ac124285e2ff8a330e5_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).