Overview

overview

7

Static

static

1

9eb51e1e61...18.exe

windows7-x64

7

9eb51e1e61...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/06/2024, 15:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9eb51e1e61836355b2f58940d17df047_JaffaCakes118.exe
  • Size 14.9MB
  • Sample240611-s94bhssdkf
  • SHA256 7130b2d0fa07e86d96edde99e4df456f37196109df17edcb8e7aa6ac9e4a2e55
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
bootkitpersistence

Malware Config

Signatures

  • Loads dropped DLL 25 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\9eb51e1e61836355b2f58940d17df047_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9eb51e1e61836355b2f58940d17df047_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    PID:672

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        BaseUI.xar
        • Path C:\Users\Admin\AppData\Local\Temp\showinstalltmp240615250\installui\UI\BaseUI.xar
        • Size 277KB
        • SHA256 e31e6a04d563acdec9c5a6f4cb034f7335ce6ee3afafb17d5495560e48f425ff
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        InstallUI.xar
        • Path C:\Users\Admin\AppData\Local\Temp\showinstalltmp240615250\installui\UI\InstallUI.xar
        • Size 65KB
        • SHA256 8b1ab8bdf16c7e2c4cbda04e4e97d05d434a2894e1bad7053250a641aa5986ab
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SkinInstall.xar
        • Path C:\Users\Admin\AppData\Local\Temp\showinstalltmp240615250\installui\UI\SkinInstall.xar
        • Size 1.5MB
        • SHA256 0d3b877c566fc9f917ece2352bdcdff8bac10fba3b77acf5c06ab14f5e0b4c72
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        XLFSIO.dll
        • Path C:\Users\Admin\AppData\Local\Temp\showinstalltmp240615250\installui\XLFSIO.dll
        • Size 210KB
        • SHA256 904acdc9e58fb025b1b6ccbedcaa60cc84a80f4e6f1f181f265f8de847803ea0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        XLGraphic.dll
        • Path C:\Users\Admin\AppData\Local\Temp\showinstalltmp240615250\installui\XLGraphic.dll
        • Size 714KB
        • SHA256 a95a2b2fdedb4c5fd47dccc1b5538d266038b00671a613550525202e54713712
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        XLGraphicPlus.dll
        • Path C:\Users\Admin\AppData\Local\Temp\showinstalltmp240615250\installui\XLGraphicPlus.dll
        • Size 206KB
        • SHA256 54aa0c55fbcdf7c36a52a34335dac26ea202dd5a2be175714b7363fe47515d3d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        XLLuaRuntime.dll
        • Path C:\Users\Admin\AppData\Local\Temp\showinstalltmp240615250\installui\XLLuaRuntime.dll
        • Size 242KB
        • SHA256 b4bcbf707e03c8d9b5861dd5085abafab9d1ba7d73c6785be13374dd0110b7c3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        XLTS.dll
        • Path C:\Users\Admin\AppData\Local\Temp\showinstalltmp240615250\installui\XLTS.dll
        • Size 102KB
        • SHA256 defc745864ea79b9d356e4c7c1c18a18b8325a55bec7dd0eb64eb548e7ac1513
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        XLUE.dll
        • Path C:\Users\Admin\AppData\Local\Temp\showinstalltmp240615250\installui\XLUE.dll
        • Size 1.8MB
        • SHA256 868a5e7f4f94c677ea781ccf335c6b95fa360dfdaee9e9bb74bad46b39f8bdbc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        atl71.dll
        • Path C:\Users\Admin\AppData\Local\Temp\showinstalltmp240615250\installui\atl71.dll
        • Size 87KB
        • SHA256 a68e1297fae2bcf854b47ffa444f490353028de1fa2ca713b6cf6cc5aa22b88a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        installUI.dll
        • Path C:\Users\Admin\AppData\Local\Temp\showinstalltmp240615250\installui\installUI.dll
        • Size 246KB
        • SHA256 a79d318b27e8657c638d11ad77a56f64b21c8c857c52de00cb564d662bfddfd5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        installcfg.ini
        • Path C:\Users\Admin\AppData\Local\Temp\showinstalltmp240615250\installui\installcfg.ini
        • Size 20B
        • SHA256 36ef12e48c94c55dc4d8770591c5cea28e64340f9f71c3183c587bf3b4c206e9
        • MD5 SHA1 SHA512
        Submit Download

        libexpat.dll
        • Path C:\Users\Admin\AppData\Local\Temp\showinstalltmp240615250\installui\libexpat.dll
        • Size 140KB
        • SHA256 2810a1e3eb3bb8ff1e64fc34dd9485ffeda6a8e0b510f2879c65afa5a0ed0381
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libpng13.dll
        • Path C:\Users\Admin\AppData\Local\Temp\showinstalltmp240615250\installui\libpng13.dll
        • Size 224KB
        • SHA256 cba3b634236d173993e541f789b666d972a5437fecf04fb94036f48fff79611e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msvcp71.dll
        • Path C:\Users\Admin\AppData\Local\Temp\showinstalltmp240615250\installui\msvcp71.dll
        • Size 492KB
        • SHA256 6c483cbe349863c7dcf6f8cb7334e7d28c299e7d5aa063297ea2f62352f6bdd9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msvcr71.dll
        • Path C:\Users\Admin\AppData\Local\Temp\showinstalltmp240615250\installui\msvcr71.dll
        • Size 340KB
        • SHA256 c4d4339df314a27ff75a38967b7569d9962337b8d4cd4b0db3aba5ff72b2bfbb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\showinstalltmp240615250\installui\zlib1.dll
        • Size 105KB
        • SHA256 92b4e943a1cd10dda4f171ec767c37158ad3792c723802aad391e4e6c58057b4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/672-116-0x0000000003140000-0x0000000003316000-memory.dmp
        Download

        memory/672-117-0x0000000003320000-0x000000000335B000-memory.dmp
        Download

        memory/672-194-0x0000000000500000-0x0000000000600000-memory.dmp
        Download

        memory/672-192-0x0000000000500000-0x0000000000600000-memory.dmp
        Download

        memory/672-191-0x0000000000500000-0x0000000000600000-memory.dmp
        Download

        memory/672-190-0x0000000000500000-0x0000000000600000-memory.dmp
        Download

        memory/672-189-0x0000000000500000-0x0000000000600000-memory.dmp
        Download

        memory/672-188-0x0000000000500000-0x0000000000600000-memory.dmp
        Download

        memory/672-173-0x00000000039F0000-0x0000000003A08000-memory.dmp
        Download

        memory/672-107-0x00000000030C0000-0x00000000030F3000-memory.dmp
        Download

        memory/672-112-0x0000000003100000-0x0000000003132000-memory.dmp
        Download

        memory/672-193-0x0000000000500000-0x0000000000600000-memory.dmp
        Download

        memory/672-145-0x00000000033A0000-0x00000000033C4000-memory.dmp
        Download

        memory/672-103-0x0000000003000000-0x00000000030B9000-memory.dmp
        Download

        memory/672-141-0x0000000003360000-0x0000000003399000-memory.dmp
        Download

        memory/672-196-0x0000000000500000-0x0000000000600000-memory.dmp
        Download

        memory/672-677-0x0000000062E80000-0x0000000062EA2000-memory.dmp
        Download

        memory/672-679-0x0000000000500000-0x0000000000600000-memory.dmp
        Download

        memory/672-680-0x0000000000500000-0x0000000000600000-memory.dmp
        Download

        memory/672-681-0x0000000000500000-0x0000000000600000-memory.dmp
        Download

        memory/672-682-0x0000000000500000-0x0000000000600000-memory.dmp
        Download