Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 14:24

General

  • Target

    06cc2bf552ab081d6ed474fd13fb250d_JaffaCakes118.exe

  • Size

    154KB

  • MD5

    06cc2bf552ab081d6ed474fd13fb250d

  • SHA1

    ac25b750a6e6ef426a47059e857e4507255c6fd0

  • SHA256

    4778db65938e7531e308dd893851c71db03dcca57858d14156d4ceaa2c11b39e

  • SHA512

    1f2fab4e16614fe74f4eb22221d75779e835e563184e37957006d25bed14d9453c2fae083acbb4752977ba18d9bafa42b6e67601188614122209d31f678f28bd

  • SSDEEP

    3072:M3Pnai+j6RmtzBSfQgcbbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU7UojkdJ:Myj6ezBCQgywvP6bQ7yMP+DE827UBJ

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Modifies WinLogon 2 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 1 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1196
      • C:\Users\Admin\AppData\Local\Temp\06cc2bf552ab081d6ed474fd13fb250d_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\06cc2bf552ab081d6ed474fd13fb250d_JaffaCakes118.exe"
        2⤵
        • Modifies WinLogon
        • Writes to the Master Boot Record (MBR)
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3068
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\DeleteMe.bat
          3⤵
          • Deletes itself
          PID:3040

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\DeleteMe.bat

      Filesize

      237B

      MD5

      f51f5958745b17fdbd1c8868aa693a5e

      SHA1

      08dbb2be1ebfa9811901440fdec933789c33294c

      SHA256

      225b48155d382d72fefcf065a13d951c4a9b09e909ee27c7b02a1cca97c15fe3

      SHA512

      ab2de50155f20b75cb55c327ec27ce0ed37bb10823830c686c90f6279136bc284b6100012c440812b7f79a2b9e467d223b883e2d08e767cdecc17daa0e6b9c5e

    • memory/1196-11-0x0000000002530000-0x0000000002531000-memory.dmp

      Filesize

      4KB

    • memory/3068-7-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/3068-10-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/3068-9-0x0000000000440000-0x0000000000441000-memory.dmp

      Filesize

      4KB

    • memory/3068-8-0x0000000000450000-0x0000000000451000-memory.dmp

      Filesize

      4KB

    • memory/3068-0-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/3068-6-0x0000000000220000-0x0000000000221000-memory.dmp

      Filesize

      4KB

    • memory/3068-5-0x00000000003F0000-0x00000000003F1000-memory.dmp

      Filesize

      4KB

    • memory/3068-4-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/3068-2-0x0000000000250000-0x0000000000252000-memory.dmp

      Filesize

      8KB

    • memory/3068-1-0x00000000002E0000-0x0000000000310000-memory.dmp

      Filesize

      192KB

    • memory/3068-20-0x00000000002E0000-0x0000000000310000-memory.dmp

      Filesize

      192KB

    • memory/3068-19-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB