Analysis

  • max time kernel
    1s
  • max time network
    3s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 14:13

Errors

Reason
Machine shutdown

General

  • Target

    06b792f6ca88035c601a6c2915883d8f_JaffaCakes118.exe

  • Size

    140KB

  • MD5

    06b792f6ca88035c601a6c2915883d8f

  • SHA1

    84230d6c1d4185b2b35cdbbd754edff14b258fcd

  • SHA256

    b558b8aa47f974ee071544e4acae5944e528a55a848aa0afc6c46f1c779a7a42

  • SHA512

    d23b9691c4ca22716976a1ec993444f7292909b17ea606d1deb1904e8561762c3253123a5adb98d4ef1f6eaa465fa25443ce14a5ef30621923439c0f1aaacb42

  • SSDEEP

    3072:lVt10cHJ63KdZIIjUjPZSNZRd20i2XuY0eydKTN66zMsq0hHCb:lDSb3KoIjUzUN3wN2XuYfydCTIsq0hA

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06b792f6ca88035c601a6c2915883d8f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\06b792f6ca88035c601a6c2915883d8f_JaffaCakes118.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    PID:2768

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2768-0-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB