Analysis
-
max time kernel
1s -
max time network
3s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 14:13
Static task
static1
Behavioral task
behavioral1
Sample
06b792f6ca88035c601a6c2915883d8f_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
06b792f6ca88035c601a6c2915883d8f_JaffaCakes118.exe
Resource
win10v2004-20240611-en
Errors
General
-
Target
06b792f6ca88035c601a6c2915883d8f_JaffaCakes118.exe
-
Size
140KB
-
MD5
06b792f6ca88035c601a6c2915883d8f
-
SHA1
84230d6c1d4185b2b35cdbbd754edff14b258fcd
-
SHA256
b558b8aa47f974ee071544e4acae5944e528a55a848aa0afc6c46f1c779a7a42
-
SHA512
d23b9691c4ca22716976a1ec993444f7292909b17ea606d1deb1904e8561762c3253123a5adb98d4ef1f6eaa465fa25443ce14a5ef30621923439c0f1aaacb42
-
SSDEEP
3072:lVt10cHJ63KdZIIjUjPZSNZRd20i2XuY0eydKTN66zMsq0hHCb:lDSb3KoIjUzUN3wN2XuYfydCTIsq0hA
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\physicaldrive0 06b792f6ca88035c601a6c2915883d8f_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2768 06b792f6ca88035c601a6c2915883d8f_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 2768 06b792f6ca88035c601a6c2915883d8f_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\06b792f6ca88035c601a6c2915883d8f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\06b792f6ca88035c601a6c2915883d8f_JaffaCakes118.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:2768