Analysis
-
max time kernel
135s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2024 10:48
Behavioral task
behavioral1
Sample
11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe
-
Size
420KB
-
MD5
11bc744801b516d0b84fba5850ec8789
-
SHA1
b3e4dcfb4a2e6e0f15286b9d5664e1a3f2e89dfa
-
SHA256
decfaa83bf2eb9afe57a09da2d3142512a543708214608fdd19bdb7e17051a7c
-
SHA512
ecf88363b274855302062283e641a03ff7456b7781bbbadcf1a040730c0f36660e0f852847d7488c624afcd0f780e49427aa385e245a5d49ff986f57139eda81
-
SSDEEP
6144:oIEuZi3QrY8G0QtZAGQ0hBK0IauE2W0L2g2yRCSwz6cUABXA71M6KqI0KpC/tFV:R7t837AGQ0bReL5Z7C1y1M+xIct/
Malware Config
Signatures
-
Unexpected DNS network traffic destination 11 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 199.249.18.1 Destination IP 161.150.197.252 Destination IP 192.128.167.77 Destination IP 128.253.180.2 Destination IP 216.52.97.33 Destination IP 161.150.129.252 Destination IP 192.35.82.50 Destination IP 130.160.4.114 Destination IP 208.255.120.35 Destination IP 165.254.12.151 Destination IP 209.154.198.86 -
resource yara_rule behavioral2/memory/1556-0-0x0000000000400000-0x00000000004E2000-memory.dmp vmprotect behavioral2/memory/1556-1-0x0000000000400000-0x00000000004E2000-memory.dmp vmprotect behavioral2/memory/1556-5-0x0000000000400000-0x00000000004E2000-memory.dmp vmprotect -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe 1556 11bc744801b516d0b84fba5850ec8789_JaffaCakes118.exe