Analysis

  • max time kernel
    140s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    27-06-2024 10:27

General

  • Target

    15a728eb02f735954e25d79d64001162_JaffaCakes118.exe

  • Size

    152KB

  • MD5

    15a728eb02f735954e25d79d64001162

  • SHA1

    94f5cddcd514a7e8d03da43c15e8b74dab4ea766

  • SHA256

    49ee1a7cca26d576c9c9d8068d430eb6802c15c8d3fb708cdfcabc698027be80

  • SHA512

    210139ddfb39e7ec5961fae5310ccc1aa42d9175f4d67d0725b8f6fa394c8ea60cf7e4b6bde7a476beb1106c4b624d743392dbde85dd2448a222b0e69591ab68

  • SSDEEP

    3072:xfTed/96HM0XU+aDe5UEGJSKz7ccRJMM3Ojl5M0rI6K/XI0urd3BZ8Xs2C:xKd/n+aCyIK3ccnMxj3rI3Id3BZEE

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Modifies registry class 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15a728eb02f735954e25d79d64001162_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\15a728eb02f735954e25d79d64001162_JaffaCakes118.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Modifies registry class
    PID:2416

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2416-0-0x0000000001000000-0x0000000001062000-memory.dmp

    Filesize

    392KB

  • memory/2416-2-0x0000000000C40000-0x0000000000C41000-memory.dmp

    Filesize

    4KB

  • memory/2416-1-0x0000000000C30000-0x0000000000C31000-memory.dmp

    Filesize

    4KB

  • memory/2416-3-0x0000000000C20000-0x0000000000C21000-memory.dmp

    Filesize

    4KB

  • memory/2416-5-0x0000000000C80000-0x0000000000C81000-memory.dmp

    Filesize

    4KB

  • memory/2416-4-0x0000000000C90000-0x0000000000C91000-memory.dmp

    Filesize

    4KB

  • memory/2416-6-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

    Filesize

    4KB

  • memory/2416-7-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

    Filesize

    4KB

  • memory/2416-8-0x0000000000D40000-0x0000000000D41000-memory.dmp

    Filesize

    4KB

  • memory/2416-9-0x0000000001000000-0x0000000001062000-memory.dmp

    Filesize

    392KB