Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
08/07/2024, 11:13
General
-
Target
2c1cc3c797775b2c0fa60c518b8f707d_JaffaCakes118.exe
-
Size
2.1MB
-
MD5
2c1cc3c797775b2c0fa60c518b8f707d
-
SHA1
5624a27349dc57f98c8df86fc9db978aef215d93
-
SHA256
4ef285a790c4c3dd3625215bba8a2d94a83abe5df1300ccf34377c0259feea7b
-
SHA512
a9342041bf27a8951dc9fd00cac97b6abefd89efebca3480d1c0a5d48bc2baf9dd1c8afb5976d0b187f3fbd9fd91d9050895815224b4f39c3c1fb5decb0f43e7
-
SSDEEP
49152:SJatr4B55TU6dPW5dgMOc3g3sM1EDB2TsbtLR0JwQaorjhRz:Scrc5RPWIM1gcMIgAtl8wQvz
Score
7/10
Malware Config
Signatures
-
Unexpected DNS network traffic destination 15 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c1cc3c797775b2c0fa60c518b8f707d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2c1cc3c797775b2c0fa60c518b8f707d_JaffaCakes118.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 5562⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1900 -ip 19001⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB