Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
10/07/2024, 16:17
General
-
Target
357840d61505ea5fcc44aa0bea813807_JaffaCakes118.exe
-
Size
112KB
-
MD5
357840d61505ea5fcc44aa0bea813807
-
SHA1
f48fa76ef5daa0730387119dd0da019faed54bbf
-
SHA256
d3972908c2634c7365dde347164754184efc6ae90bcc4a623f3a175e7e690892
-
SHA512
59792d79b0fd1896f8aff5ef637edfa1c0d58ba849bda45e9df013cc5278b8e5c34cd4df1adcf476fee884e33ce927c0da4eb6dfa66705b824f87fa879e97e05
-
SSDEEP
3072:VjskZTe5bPddPClXwfnSaaxavca7qeeBeKPoiSWyH:VjzVWzddPwwfHaxPa72cK2/H
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\357840d61505ea5fcc44aa0bea813807_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\357840d61505ea5fcc44aa0bea813807_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c delplme.bat2⤵
-
-
C:\Windows\avp.exeC:\Windows\avp.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
306B
MD54e1ffac9f15d30845e51229db90ed1d1
SHA1778e99b32e0bb709f3bb310b522ba8fb9579261d
SHA256fcf842144597e8c988190ea4fe19bd6c9edd1d8d7b765ebbf16f646c12c79def
SHA512162531906caee063a6d01e96c3e6ef50771ea98f56f0b2575dacac0f22ba048d9f14754b43692d50fac56863583c77da76fee765e5741ad39415daffdca906ea
-
Filesize
238KB
MD51bebb7fd2c7c824526e02fa1510a683c
SHA1bf4ca65eecd6859ec37c58c6254ab8645ecec232
SHA2564e16ce800ee8b212aa816484f54ab93686e03feaa9d987e1601eb30b1de80f45
SHA5121f0f9fc982adffb245ed2e52fcd2fd3354655018f69c13284f3995feb52775b9dc23e3839f2e5df647e96d493cda49666656e23e24849fbe12e86f542d81ffe9
-
Filesize
18KB
MD57c69a12311f8e84bd050a9af991e464f
SHA11b75740fd0f733503af9bdab5fef2d4b0820bab8
SHA25692756a98467956036111667df9f3174ee71cfd935d091a2c1f6d51e4cb48c652
SHA5129dc6f15ba0d567ff087b0aff34267b60e3eaf75b94c8dd21cba8f8beac2e7504e6fb53693e5c37af99e88625b8ceb3f46d805c66d8a5b72e3fb1ec0e6b50ac37
-
Filesize
332KB
-
Filesize
8KB
-
Filesize
288KB
-
Filesize
332KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB