Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 13:12

General

  • Target

    064d2880d2c86793057053a75b36508e_JaffaCakes118.exe

  • Size

    121KB

  • MD5

    064d2880d2c86793057053a75b36508e

  • SHA1

    bb0a3f273f170ae983cdf751e05c70f9ad74ce70

  • SHA256

    c2627e9d8a5d7f339ae4cc2ae042d32043a07d999f5e826c54628a4cfdc193b3

  • SHA512

    66207260518de3cbc42ed3c9c6850305253af0c751656eed453ff87f955125cdb51c52f63ba5654860b7cf6b86b95381e50dade5f00715325fb3b960d323b94c

  • SSDEEP

    3072:I3QeBGrxSRbbrZ6+m6NiL15+Eq7Kf3Wrar7arBYFoFwuLP:I3Q/+QKN8Q2ZGSty

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Modifies registry class 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\064d2880d2c86793057053a75b36508e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\064d2880d2c86793057053a75b36508e_JaffaCakes118.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Modifies registry class
    PID:1284

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1284-1-0x00000000002F0000-0x0000000000320000-memory.dmp

    Filesize

    192KB

  • memory/1284-0-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/1284-2-0x0000000000450000-0x0000000000452000-memory.dmp

    Filesize

    8KB

  • memory/1284-15-0x0000000001F10000-0x0000000001F11000-memory.dmp

    Filesize

    4KB

  • memory/1284-14-0x0000000001F20000-0x0000000001F21000-memory.dmp

    Filesize

    4KB

  • memory/1284-13-0x0000000001F30000-0x0000000001F31000-memory.dmp

    Filesize

    4KB

  • memory/1284-12-0x0000000001F40000-0x0000000001F41000-memory.dmp

    Filesize

    4KB

  • memory/1284-11-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

    Filesize

    4KB

  • memory/1284-10-0x0000000001F00000-0x0000000001F01000-memory.dmp

    Filesize

    4KB

  • memory/1284-9-0x0000000001E90000-0x0000000001E91000-memory.dmp

    Filesize

    4KB

  • memory/1284-8-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

    Filesize

    4KB

  • memory/1284-7-0x0000000001ED0000-0x0000000001ED1000-memory.dmp

    Filesize

    4KB

  • memory/1284-6-0x0000000001EE0000-0x0000000001EE1000-memory.dmp

    Filesize

    4KB

  • memory/1284-5-0x0000000001E70000-0x0000000001E71000-memory.dmp

    Filesize

    4KB

  • memory/1284-4-0x0000000001E80000-0x0000000001E81000-memory.dmp

    Filesize

    4KB

  • memory/1284-3-0x0000000000440000-0x0000000000441000-memory.dmp

    Filesize

    4KB

  • memory/1284-16-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/1284-17-0x00000000002F0000-0x0000000000320000-memory.dmp

    Filesize

    192KB

  • memory/1284-21-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB