Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 13:32
Static task
static1
Behavioral task
behavioral1
Sample
0673bd06698f4248376651fc17ae8da3_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0673bd06698f4248376651fc17ae8da3_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0673bd06698f4248376651fc17ae8da3_JaffaCakes118.exe
-
Size
24KB
-
MD5
0673bd06698f4248376651fc17ae8da3
-
SHA1
761693e21848aa8640929177059fe44168fc033b
-
SHA256
d86c9063f777ef8b911605f23794d03e89543e9b1493e242ad2f44fcfb60c82e
-
SHA512
e9cca9b51653edef4e09b1ee200c80b7792298ab2836b8a45c0247e029c01611612fb5708c33f460ed7c11779479185f9aa6b0ee848742db52cc6e68b8b462b8
-
SSDEEP
192:LKn6Mlq9GAhlrmT9r0GTdzt8jp4caXd+AmwW3B3yz8/bdW11oynD3zVviQlv:1MlGGAXm5r0GTFUmcwd+BTBc1B3ZxF
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 0673bd06698f4248376651fc17ae8da3_JaffaCakes118.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AF604EFE-8897-11D1-B944-00A0C90312E1}\InProcServer32\ 0673bd06698f4248376651fc17ae8da3_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2664 0673bd06698f4248376651fc17ae8da3_JaffaCakes118.exe